Starstruk Logo MarkStarstruk

transports/v1.5.7

maximhq/bifrosttransports/v1.5.7May 30, 2026by akshaydeo

AI Summary

This is a security-focused patch release that addresses multiple CVEs in Go dependencies (clearing 20 advisories with severity up to 10.0) and the container image (removing standalone GNU wget). The release also fixes authentication issues where Ollama and SGL streaming requests were not properly forwarding the Authorization header, and removes the deprecated `from_memory` query parameter from Governance and Logging APIs.

Key Highlights

  • Go dependency CVE remediation - updated golang.org/x dependencies (crypto, net, sys, text, term), clearing 20 advisories with severity up to 10.0
  • Hardened container image - removed standalone GNU wget package, eliminating CVE-2025-69194
  • Fixed Ollama streaming auth - now properly forwards API key as Authorization: Bearer header
  • Fixed SGL streaming auth - now properly sends Authorization header on streaming requests
  • Removed from_memory query parameter from VK and config list APIs for consistent DB-backed results

Breaking Changes

  • Removed the `from_memory` query parameter from virtual key and config list APIs - applications using this parameter will need to be updated

New Features

  • Hardened container image using built-in busybox wget applet
  • Batch-fetching of VK names in a single query for improved performance

Full Release Notes

## Bifrost HTTP Transport Release v1.5.7

## 🔒 Security

- **Go Dependency CVE Remediation** — Updated `golang.org/x` dependencies flagged by Docker Scout, clearing 20 advisories (severity up to 10.0): `crypto` v0.49.0 → v0.52.0, `net` v0.52.0 → v0.55.0, `sys` v0.42.0 → v0.45.0, `text` v0.35.0 → v0.37.0, `term` v0.41.0 → v0.43.0 (cli). Verified with `govulncheck` against the live Go vulnerability database: zero vulnerabilities remain in any module (#3900)
- **Hardened Container Image** — Removed the standalone GNU `wget` package from the Alpine runtime image, eliminating CVE-2025-69194 (8.8); the `HEALTHCHECK` now uses the built-in busybox `wget` applet, with no functional change

## 🐞 Fixed

- **Ollama Streaming Auth** — Ollama streaming text and chat requests now forward the configured API key as an `Authorization: Bearer` header (#3906)
- **SGL Streaming Auth** — SGL provider now sends the `Authorization` header on streaming requests (#3307) (thanks [@hensapir](https://github.com/hensapir)!)
- **Governance & Logging APIs** — Removed the `from_memory` query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (#3903)

### Installation

#### Docker
```bash
docker run -p 8080:8080 maximhq/bifrost:v1.5.7
```

#### Binary Download
```bash
npx @maximhq/bifrost --transport-version v1.5.7
```

### Docker Images
- **`maximhq/bifrost:v1.5.7`** - This specific version
- **`maximhq/bifrost:latest`** - Latest version (updated with this release)

---
_This release was automatically created with dependencies: core `v1.5.15`, framework `v1.3.15`. All plugins have been validated and updated._