ent-v2.2.0-base

gravitational/teleportent-v2.2.0-baseSep 15, 2026by akshaydeo

Upgrading?

AI Summary

Enterprise v2.2.0 base release focusing on governance enhancements, pricing models, and Bedrock provider support.

Key Highlights

  • Entity DAC overrides per-entity governance roles in Helm chart
  • Prompt cache reload through the server for multi-node gossip
  • Trusted networks support for SSRF guard
  • Regex pattern support for model allow/block lists
  • Time-of-day peak/off-peak pricing implementation

Breaking Changes

  • Reverted 'vk allowed models * handling for governance'

New Features

  • Entity DAC overrides per-entity governance roles
  • Prompt cache reload through server
  • Trusted networks for SSRF guard
  • Regex pattern support for model allow/block lists
  • Time-of-day peak/off-peak pricing
  • GA realtime transcription support
  • Claude Desktop and Cowork Marketplace support
  • MCP governance entity names on logs
  • Endpoint-attributed MCP inspections
  • Virtual MCP references by name
  • Normalized error_type metric label
  • Bedrock OpenAI-Compatible endpoint routing
  • Anthropic tool search on Bedrock
  • Namespace tool support across providers
  • Guardrail tool-call argument redaction
  • Pricing UI updates for off-peak and peak hours

Full Release Notes

## What's Changed
* docs: add MCP auth warning to 2.1.0 changelogs by @impoiler in https://github.com/maximhq/bifrost/pull/7022
* fix(http): add `Cache-Control: no-store` default for `/api/` responses to prevent CDN caching by @impoiler in https://github.com/maximhq/bifrost/pull/7014
* feat: add `entity_dac` per-entity DAC overrides to governance roles in Helm chart by @BearTS in https://github.com/maximhq/bifrost/pull/7024
* docs: remove resolved MCP auth warning from v2.1.0 changelog by @impoiler in https://github.com/maximhq/bifrost/pull/7026
* v2.1.1 by @akshaydeo in https://github.com/maximhq/bifrost/pull/7029
* fixes package.json for integration test for 7day check by @akshaydeo in https://github.com/maximhq/bifrost/pull/7030
* enterprise docs by @akshaydeo in https://github.com/maximhq/bifrost/pull/7036
* migration test fixes by @akshaydeo in https://github.com/maximhq/bifrost/pull/7038
* fixes reserved namespace redaction for bedrock by @akshaydeo in https://github.com/maximhq/bifrost/pull/7039
* docs: add trusted networks step and troubleshooting for private IdP OIDC discovery by @BearTS in https://github.com/maximhq/bifrost/pull/7040
* docs: update virtual key API configuration examples by @R-droid101 in https://github.com/maximhq/bifrost/pull/7043
* Revert "vk allowed models * handling for governance" by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7053
* prompt caching docs; and edge out of alpha by @akshaydeo in https://github.com/maximhq/bifrost/pull/7056
* docs update by @akshaydeo in https://github.com/maximhq/bifrost/pull/7058
* fix: responses event action string by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7060
* feat: route prompt cache reloads through the server so enterprise can gossip them by @impoiler in https://github.com/maximhq/bifrost/pull/7061
* fix(helm): support multiple access profiles on governance roles by @CarlosLanderas in https://github.com/maximhq/bifrost/pull/7044
* feat: add trusted_networks to Helm and config schema by @BearTS in https://github.com/maximhq/bifrost/pull/7081
* fix: route runtime responses compat models to responses api by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7071
* fix: config flag to route to openai compat api in bedrock by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7073
* fix: dynamic mantle base path and gpt 6 reasoning helpers by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7077
* fix: bedrock document source by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7079
* tests: harness test coverage for bedrock by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7083
* helm: update openai endpoints key field by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7088
* fix: guardrail identifier in runtime headers by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7095
* fix: strip Anthropic server tools on Fireworks/vLLM/SGLang Anthropic-compatible endpoints and report drops via `DroppedUnsupportedTools` by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7090
* docs: add `use_anthropic_endpoints` option for Fireworks Anthropic-compatible Messages endpoint by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7091
* docs: add `use_anthropic_endpoints` option and Anthropic-compatible endpoint routing to SGL provider docs by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7092
* docs: document vLLM server tool dropping behavior and `dropped_unsupported_tools` response field by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7094
* feat(configstore): add time-of-day peak/off-peak pricing columns and migration by @impoiler in https://github.com/maximhq/bifrost/pull/6574
* feat(cost): add time-of-day peak/off-peak pricing with cached timezone resolution and tests by @impoiler in https://github.com/maximhq/bifrost/pull/6575
* feat(pricing): add `off_peak_cost_multiplier` and `peak_hours` fields to `PricingPatch` schema and patch logic by @impoiler in https://github.com/maximhq/bifrost/pull/6576
* refactor(ui): extract `FormState`, `defaultFormState`, and `buildPatchFromForm` from sheet into `pricingFields.ts` by @impoiler in https://github.com/maximhq/bifrost/pull/6577
* feat(ui): add `off_peak_cost_multiplier` and `peak_hours` support to pricing overrides by @impoiler in https://github.com/maximhq/bifrost/pull/6578
* docs: add time-of-day pricing docs for model catalog, custom pricing, and DeepSeek caveats by @impoiler in https://github.com/maximhq/bifrost/pull/6579
* test(e2e): add time-of-day pricing Postman collection and Newman runner by @impoiler in https://github.com/maximhq/bifrost/pull/7054
* docs(logging): clarify `CountRecalcTargets` matview staleness and `Total` approximation by @impoiler in https://github.com/maximhq/bifrost/pull/7078
* feat: add GA realtime transcription support by @danpiths in https://github.com/maximhq/bifrost/pull/7089
* fixes gpt-oss mistag by @akshaydeo in https://github.com/maximhq/bifrost/pull/7075
* fixes bedrock mantle streaming missing usage by @akshaydeo in https://github.com/maximhq/bifrost/pull/7076
* namespace tool name support across providers by @akshaydeo in https://github.com/maximhq/bifrost/pull/7082
* fix: prevent governance cleanup dump race by @Constantine3 in https://github.com/maximhq/bifrost/pull/7100
* move tool namespace collision check to datasheet by @akshaydeo in https://github.com/maximhq/bifrost/pull/7084
* adds custom tripper to fasthttp streaming clients by @akshaydeo in https://github.com/maximhq/bifrost/pull/7104
* [fix]: Gemini provider - preserve inline image and audio data in chat completions by @Atharva-Kanherkar in https://github.com/maximhq/bifrost/pull/7033
* adds clickhouse delte rows improvements by @akshaydeo in https://github.com/maximhq/bifrost/pull/7103
* feat(redaction): surface literal regions and service URLs in plaintext via `RedactedIfSecret` by @impoiler in https://github.com/maximhq/bifrost/pull/7085
* feat(mcp-usage-guide): add OAuth and IdP token auth methods alongside virtual key by @impoiler in https://github.com/maximhq/bifrost/pull/7111
* fix(sidebar): truncate long item titles to prevent overflow by @impoiler in https://github.com/maximhq/bifrost/pull/7069
* feat(schemas): add RE2 pattern lists for model allow/block rules on `Key` and `ProviderPermit` by @impoiler in https://github.com/maximhq/bifrost/pull/6987
* feat(models): add RE2 pattern twins for allow/block lists on provider keys and virtual key provider configs by @impoiler in https://github.com/maximhq/bifrost/pull/6988
* feat(ui): add regex pattern support for model allow/block lists via `ModelAccessSelector` by @impoiler in https://github.com/maximhq/bifrost/pull/6989
* docs: add `allowed_models_patterns` and `blacklisted_models_patterns` RE2 pattern fields to virtual keys, projects, and provider keys by @impoiler in https://github.com/maximhq/bifrost/pull/6990
* test(governance): add e2e coverage for regex entries in VK model allow/block lists by @impoiler in https://github.com/maximhq/bifrost/pull/7031
* improve color pallete of graphs by @akshaydeo in https://github.com/maximhq/bifrost/pull/7113
* fixes responses sse item null regression by @ReStranger in https://github.com/maximhq/bifrost/pull/6395
* scope fasthttp stale-connection retries to pooled sockets and end retry backoff on cancel by @akshaydeo in https://github.com/maximhq/bifrost/pull/7105
* cancel in-flight requests when the client closes its socket before the first byte by @akshaydeo in https://github.com/maximhq/bifrost/pull/7106
* fix(bedrock): assign unique names to untitled document blocks by @Huang-404-Q in https://github.com/maximhq/bifrost/pull/7027
* fix(core): clear provider response headers on fallback boundaries by @Huang-404-Q in https://github.com/maximhq/bifrost/pull/7021
* fixes missing stream termination for custom providers by @akshaydeo in https://github.com/maximhq/bifrost/pull/7115
* fix: handle incomplete fallback errors by @Constantine3 in https://github.com/maximhq/bifrost/pull/7110
* image & video model fallbacks fixes by @akshaydeo in https://github.com/maximhq/bifrost/pull/7118
* [fix]: route opencode-zen Responses calls through /v1/chat/completions by @miguelchico in https://github.com/maximhq/bifrost/pull/6819
* tool_search in invoke flow by @akshaydeo in https://github.com/maximhq/bifrost/pull/6900
* feat(bedrock): serve Anthropic tool search on Claude via InvokeModel routing by @akshaydeo in https://github.com/maximhq/bifrost/pull/6908
* fix: filter credential-bearing provider response headers by classifier by @Atharva-Kanherkar in https://github.com/maximhq/bifrost/pull/7121
* fixes caller cancellations detections by @akshaydeo in https://github.com/maximhq/bifrost/pull/7116
* oss changes for support for tool calls args redaction in guardrails by @Madhuvod in https://github.com/maximhq/bifrost/pull/6977
* docs: docs for singulr ai guardrail provider by @Madhuvod in https://github.com/maximhq/bifrost/pull/7055
* oss: passthru redaction for transformed output guardrails like model armor, bedrock by @Madhuvod in https://github.com/maximhq/bifrost/pull/7049
* fix(complexity): preserve input for continuation fallback classification when session state is absent by @Madhuvod in https://github.com/maximhq/bifrost/pull/7122
* fix: max tokens for deepseek provider by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7131
* revert: withdraw the model pattern fields (#6987 to #7031) by @impoiler in https://github.com/maximhq/bifrost/pull/7133
* feat(governance): add `regex:` pattern support to model allow/block lists by @impoiler in https://github.com/maximhq/bifrost/pull/7134
* fix: omit `client_secret` in refresh token grant when client has no secret by @Pratham-Mishra04 in https://github.com/maximhq/bifrost/pull/7042
* chore: fixes framework tests by @sammaji in https://github.com/maximhq/bifrost/pull/7139
* chore: fixes core tests by @sammaji in https://github.com/maximhq/bifrost/pull/7146
* fixes azure-firework model output token capping fix by @akshaydeo in https://github.com/maximhq/bifrost/pull/7142
* Attribute endpoint MCP inspections in the standard logging pipeline by @akshaydeo in https://github.com/maximhq/bifrost/pull/6959
* turn reasoning context support by @akshaydeo in https://github.com/maximhq/bifrost/pull/7140
* fix: Helm chart - map perUserHeaderKeys into rendered config.json by @CallumWayve in https://github.com/maximhq/bifrost/pull/6034
* feat: add normalized `error_type` label to `bifrost_error_requests_total` by @roroghost17 in https://github.com/maximhq/bifrost/pull/7141
* feat(logs): add pinnable search mode dropdown (auto / content / request ID) by @impoiler in https://github.com/maximhq/bifrost/pull/7149
* chore: helm version 2.1.42 with mcp per user header key support by @BearTS in https://github.com/maximhq/bifrost/pull/7148
* chore: harness test fixes by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7147
* fix: bedrock image block in tool result by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7150
* mid-conversation switch cache checkpoint by @akshaydeo in https://github.com/maximhq/bifrost/pull/7145
* feat: adds Claude Desktop marketplace support by @danpiths in https://github.com/maximhq/bifrost/pull/7152
* docs: add Claude Desktop marketplace setup guide by @danpiths in https://github.com/maximhq/bifrost/pull/7153
* feat(logs): record governance entity names on MCP tool logs by @impoiler in https://github.com/maximhq/bifrost/pull/7154
* fix/preserve-per-part-media-resolution by @akshaydeo in https://github.com/maximhq/bifrost/pull/7156
* fix: sort MCP tool schema properties and $defs on conversion by @dougcalobrisi in https://github.com/maximhq/bifrost/pull/7170
* fix: image edit check in genai by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7173
* namespace flattening fix for harness tools by @akshaydeo in https://github.com/maximhq/bifrost/pull/7161
* fix(anthropic): carry server-side tool search through the response path by @akshaydeo in https://github.com/maximhq/bifrost/pull/7162
* fix(bedrock): keep tool search alive across the invoke ingress (#7155) by @akshaydeo in https://github.com/maximhq/bifrost/pull/7163
* fix(bedrock): return tool search as server_tool_use on the invoke ingress by @akshaydeo in https://github.com/maximhq/bifrost/pull/7164
* fix(bedrock): stop streaming tool search as a client tool_use by @akshaydeo in https://github.com/maximhq/bifrost/pull/7165
* fix(bedrock): keep replayed tool-search blocks across the invoke ingress by @akshaydeo in https://github.com/maximhq/bifrost/pull/7166
* fixed mcp logs app icon by @akshaydeo in https://github.com/maximhq/bifrost/pull/7167
* feat: reference Virtual MCPs by name on access profiles and projects by @roroghost17 in https://github.com/maximhq/bifrost/pull/7181
* fixes: dropped sse chunks in raw response by @akshaydeo in https://github.com/maximhq/bifrost/pull/7184
* wait_for_usage flag for custom providers by @akshaydeo in https://github.com/maximhq/bifrost/pull/7187
* fix(gemini): keep generationConfig ExtraParams intact across retries by @VictorRequenaMaisa in https://github.com/maximhq/bifrost/pull/7138
* [fix]: Resolve vLLM aliases during key selection by @Constantine3 in https://github.com/maximhq/bifrost/pull/6956
* test fixes by @akshaydeo in https://github.com/maximhq/bifrost/pull/7192
* changelogs by @akshaydeo in https://github.com/maximhq/bifrost/pull/7194
* tests: langchain test fixes by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7193
* adds make recipie to run integration tests locally by @akshaydeo in https://github.com/maximhq/bifrost/pull/7196
* chore: uv package by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7197
* fix: cohere integration response conversion by @TejasGhatte in https://github.com/maximhq/bifrost/pull/7198
* v2.2.0 by @akshaydeo in https://github.com/maximhq/bifrost/pull/7199
* fixes race condition in skill serving handler by @akshaydeo in https://github.com/maximhq/bifrost/pull/7200

## New Contributors
* @Constantine3 made their first contribution in https://github.com/maximhq/bifrost/pull/7100
* @Huang-404-Q made their first contribution in https://github.com/maximhq/bifrost/pull/7027
* @miguelchico made their first contribution in https://github.com/maximhq/bifrost/pull/6819
* @CallumWayve made their first contribution in https://github.com/maximhq/bifrost/pull/6034
* @dougcalobrisi made their first contribution in https://github.com/maximhq/bifrost/pull/7170
* @VictorRequenaMaisa made their first contribution in https://github.com/maximhq/bifrost/pull/7138

**Full Changelog**: https://github.com/maximhq/bifrost/compare/ent-v2.1.1-base...ent-v2.2.0-base

Related Repositories