v2.6.3

AI Gateway /v1 routing, approver checks and the MCP server in the backend

This release makes the AI Gateway /v1 base URL work on deployments whose proxy sends everything to the frontend container. Before, those /v1 calls returned 503. Approve and reject on approval requests now check that the caller is an approver on the current step. The super admin MCP server now runs inside the backend, so it needs no separate package.

Upgrade notes

• AI Gateway /v1 (#5070): the frontend container now forwards /api and /v1 to the backend at VW_BACKEND_URL (default http://backend:3000). Docker Compose, Helm and the Kubernetes manifests set it, so they need no change. If your host proxy is hand-edited, either give it a /v1/ block like the one in docs/deployment/PRODUCTION_DEPLOYMENT_GUIDE.md, or let it send /v1 to the frontend. The guide also has a checklist for hand-edited proxies. Check with curl https://<your-host>/v1/models -H "Authorization: Bearer sk-vw-invalid", which should return 401 {"detail":"Virtual key not found"}.
• Client address behind a proxy (#5070): the frontend takes the client address from X-Forwarded-For only when the request comes from an address in VW_TRUSTED_PROXIES. Docker Compose sets this to private networks. If you publish the frontend port yourself, set it to your proxy's address. Otherwise all clients share one rate limit.
• MCP server (#5060): the super admin MCP server is now served by the backend at /api/mcp, and the separate MCPServer/ package has been removed. If you set it up before, set it up again from the MCP tab in Super admin settings: download the config and run the command shown there.
• Approval overrides (#5059): only approvers on the current step can approve or reject. If a step needs every approver and one of them has left, a role with the approvalRequest.admin permission can decide that step through the API (override: true, step_number and a comment). There is no UI for this yet.

Highlights

• AI Gateway: /v1 works through the frontend container. Proxy errors come back as JSON. A stopped backend now fails in 5 seconds with a 503 instead of after 60. The virtual key base URL shown in the UI keeps the page's own port. Agent guides, the hook script and the Python SDK use your VerifyWise URL instead of localhost:8100.
• MCP: the super admin MCP server runs in the backend. The connect page downloads a single server config and gives a command you can run again after a token rotation.
• Approvals: approving now shows what happened (approved, moved to the next step, or still waiting on N approvers). The timeline shows each approver's vote and comment.
• Fixes: the Linked risks tab explains what it shows and has clearer forms. "Enable automatic sync" in extensions uses the standard toggle. The MCP tools page has a back link when opened from MCP servers.
• Security: any logged-in user, Auditors included, could reject a pending approval request. Only approvers on the current step can now approve or reject (#5059). follow-redirects is updated for two advisories (#5061, #5064).
• Dependencies: Dependabot updates for the frontend packages and EvalServer (#5063, #5065). GRSModule's CI audit passes again (#5066).

---

What's Changed

• fix(approvals): only an approver on the current step may approve or reject by @gorkem-bwl in #5059
• fix(approvals): confirm an approve and show each approver's vote by @gorkem-bwl in #5064
• deps(frontend): bump follow-redirects from 1.16.0 to 1.16.1 in /Clients by @dependabot[bot] in #5061
• fix(ci): clear GRSModule pip-audit failures (certifi upgrade, pillow waiver) by @gorkem-bwl in #5066
• chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates by @dependabot[bot] in #5063
• chore(deps): bump the uv group across 1 directory with 1 update by @dependabot[bot] in #5065
• Fix MCP Server by @HarshP4585 in #5060
• fix(risks): explain the Linked risks tab and tidy its forms by @gorkem-bwl in #5069
• fix(extensions): house Toggle for "Enable automatic sync" by @gorkem-bwl in #5068
• fix(ai-gateway): back link on the MCP tools page opened from MCP servers by @gorkem-bwl in #5067
• fix(ai-gateway): route /v1 through the frontend container to the backend by @gorkem-bwl in #5070
• chore(release): bump Helm chart appVersion to v2.6.3 by @gorkem-bwl in #5071
• Merge develop into master (v2.6.3) by @gorkem-bwl in #5072

Full Changelog: v2.6.2...v2.6.3