v1.2.1

What's Changed

• fix(ci): regenerate uv.lock for ogx-client 1.2.0 on release-1.2.x by @cdoern in #6300
• fix(ci): generate ogx-client in-repo instead of cloning external repo (backport #6297) by @mergify[bot] in #6299
• fix(containers): pass --insecure to entrypoint to restore starter image boot (backport #6288) by @mergify[bot] in #6293
• fix(inference): strip duplicate /v1 prefix in vLLM Anthropic message URLs (backport #6294) by @mergify[bot] in #6295
• fix(ci): publish ogx-client-typescript on release-1.2.x (backport #6301) by @cdoern in #6302

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• fix(vertexai): use structured logging key-value style by @major in #6081
• chore: bump fallback_version to 1.1.1.dev0 by @cdoern in #6084
• chore: Limit payload-bearing logs to debug (vector search, rerank, guardrails) by @franciscojavierarceo in #6086
• docs: add Skills API to README, ARCHITECTURE, and provider docs by @varshaprasad96 in #6087
• fix(milvus): use explicit output_fields in query_vector for milvus-lite 3.0 compatibility by @derekhiggins in #6091
• fix(file_processor): offload sync parsing to thread pool by @derekhiggins in #6095
• chore: dummy gpu ec2 runner workflow by @skamenan7 in #6102
• fix(vertexai): prevent RuntimeError from stale client after startup event loop by @goingforstudying-ctrl in #6072
• docs: Adding OGX Paper by @franciscojavierarceo in #6042
• fix(ci): make ci-status wait for flaky test re-runs by @leseb in #6079
• fix(vector_io): propagate search errors instead of returning empty results by @derekhiggins in #6093
• fix(containers): embed distribution configs as OCI labels on published images by @cdoern in #6121
• chore(python-deps): bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in #6122
• chore: bump fallback_version to 1.1.2.dev0 by @cdoern in #6119
• chore(python-deps): bump pytest-socket from 0.7.0 to 0.8.0 by @dependabot[bot] in #6112
• chore(api-deps): bump openai from 2.41.0 to 2.41.1 in /src/ogx_api by @dependabot[bot] in #6110
• feat(ci): add Trivy security scanning by @nathan-weinberg in #6074
• chore(python-deps): bump pypdf from 6.11.0 to 6.12.0 by @dependabot[bot] in #6106
• fix(conversations): cascade delete orphaned conversation items by @skamenan7 in #6059
• feat(files): fix Files API gaps for OpenAI spec parity by @leseb in #6127
• feat(multi-tenancy): add tenant isolation as a hard partition key independent of ABAC by @leseb in #6126
• chore(python-deps): bump starlette from 1.1.0 to 1.3.1 by @dependabot[bot] in #6125
• chore(github-deps): bump actions/cache from 4.2.3 to 5.0.5 by @dependabot[bot] in #6108
• fix(file_processor): add ZIP decompression limits to MarkItDown processor by @derekhiggins in #6100
• chore(github-deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 by @dependabot[bot] in #6109
• chore(python-deps): bump cryptography from 48.0.0 to 48.0.1 by @dependabot[bot] in #6124
• chore(deps): remove upper bound constraint on pydantic by @mattf in #6131
• chore(python-deps): bump pypdf from 6.12.0 to 6.13.0 by @dependabot[bot] in #6132
• fix(api-docs): Move vector stores docs to top-level tag by @franciscojavierarceo in #6137
• chore(python-deps): bump python-multipart from 0.0.28 to 0.0.31 by @dependabot[bot] in #6123
• chore: bump fallback_version to 1.1.3.dev0 by @cdoern in #6138
• refactor(vector-io): Convert Qdrant, Milvus, Elasticsearch to eager collection initialization by @mattf in #6144
• docs: document nimble web search provider in guides and starter distro by @wildcard in #6082
• chore(ci): change CI to use ogx_open_client by @aegeiger in #6016
• docs(blog): add guardrails Responses API post by @leseb in #6029
• ci: record the bedrock inference suite in record workflow by @cdoern in #6165
• fix(tests): add Bedrock replay recordings by @skamenan7 in #6166
• fix(bedrock): preserve bearer token env compatibility by @skamenan7 in #6167
• feat(ci): update pip_packages in registry specs during Dependabot PRs by @leseb in #6156
• fix(vertexai): walk into routing tables to reset provider clients by @Artemon-line in #6148
• refactor(core): replace bespoke DFS topological sort with graphlib.TopologicalSorter by @mattf in #6157
• feat(containers): add Containers API surface under /v1alpha by @cdoern in #5913
• refactor(server): decouple stack.initialize from authn and tenancy middleware by @mattf in #6171
• fix(pgvector): ensure vector extension exists before creating connection pool by @Artemon-line in #6168
• chore: bump fallback_version to 1.1.4.dev0 by @cdoern in #6179
• fix(core)!: move rerank code to sentence_transformers by @zy1o in #5882
• fix(tests): allow slower Bedrock chat completion recordings by @skamenan7 in #6175
• ci: support refreshing integration recordings via dispatch on main by @cdoern in #6185
• fix(vertexai): pin google-genai below 2 by @skamenan7 in #6186
• fix(tests): re-key responses recordings broken by reranker provider rename (#5882) by @cdoern in #6187
• feat: add GPU-enabled self-hosted runners for vLLM recording (#5793) by @skamenan7 in #6101
• refactor(server): move route-to-API map construction to lazy first-request build by @mattf in #6173
• refactor: extract ZstdDecompressionMiddleware out of create_app() by @mattf in #6174
• feat: add inline::unstructured file processor by @sahana-sreeram in #6159
• fix: temporarily pin nodejs image version to avoid Premature Close errors by @rhdedgar in #6213
• fix(responses): normalize empty function tool parameters to valid JSON Schema by @derekhiggins in #6021
• fix: support developer chat messages by @skamenan7 in #6077
• feat(file_processors): add remote::unstructured-api provider by @sahana-sreeram in #6076
• feat(file-processors): add async/fallback support to docling-serve by @sahana-sreeram in #6014
• chore(github-deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6201
• chore(python-deps): bump joserfc from 1.6.5 to 1.6.7 by @dependabot[bot] in #6216
• fix(deps): bump urllib3 and python-dotenv constraints for multiple CVEs by @EleanorWho in #6184
• chore(github-deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6200
• chore(github-deps): bump actions/setup-java from 5.2.0 to 5.4.0 by @dependabot[bot] in #6202
• fix: require replay checks in ci status gate by @skamenan7 in #6188
• chore(api-deps): bump opentelemetry-exporter-otlp-proto-http from 1.42.1 to 1.43.0 in /src/ogx_api by @dependabot[bot] in #6204
• chore(python-deps): bump python-socketio from 5.16.1 to 5.16.2 by @dependabot[bot] in #6217
• fix(letsgo): use single asyncio.run() in run_letsgo_cmd for clean event loop lifecycle by @mattf in #6206
• fix(file_processors): allow owner-encrypted PDFs in pypdf processor by @Artemon-line in #6182
• fix: honor file_search ranking_options.weights by @Mykelxu in #6198
• chore(api-deps): bump opentelemetry-sdk from 1.42.1 to 1.43.0 in /src/ogx_api by @dependabot[bot] in #6203
• docs: add June 30 blog for ogx connect codex by @skamenan7 in #6118
• chore(api-deps): bump openai from 2.41.1 to 2.43.0 in /src/ogx_api by @dependabot[bot] in #6153
• chore(github-deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #6154
• chore(python-deps): bump pydantic-settings from 2.14.1 to 2.14.2 by @dependabot[bot] in #6150
• chore(python-deps): bump msgpack from 1.1.2 to 1.2.1 by @dependabot[bot] in #6151
• chore(python-deps): bump pypdf from 6.13.0 to 6.13.3 by @dependabot[bot] in #6142
• chore: update ogx stack run references to ogx run by @nathan-weinberg in #6115
• fix(deps): bump aiohttp and pyjwt constraints for CVE-2026-34993 and CVE-2026-48526 by @EleanorWho in #6183
• chore(python-deps): bump langgraph-sdk from 0.3.14 to 0.3.15 by @dependabot[bot] in #6190
• fix(cli): resolve env var templates before validation in list-deps by @nathan-weinberg in #5914
• f...

v0.5.4

What's Changed

• fix(deps): make OCI dependencies optional on release 0.5 by @skamenan7 in #6193

Full Changelog: v0.5.3...v0.5.4

v0.5.3

What's Changed

• fix(containers): tolerate OTel bootstrap conflicts on release 0.5 by @skamenan7 in #6194

Full Changelog: v0.5.2...v0.5.3

v1.1.3

What's Changed

• chore: update ogx-client to ^1.1.2 in UI lockfile by @cdoern in #6139
• fix(vertexai): walk into routing tables to reset provider clients (backport #6148) by @mergify[bot] in #6177
• fix(pgvector): ensure vector extension exists before creating connection pool (backport #6168) by @mergify[bot] in #6178

Full Changelog: v1.1.2...v1.1.3

v1.1.2

What's Changed

• chore: update ogx-client to ^1.1.1 in UI lockfile by @cdoern in #6120
• fix(conversations): cascade delete orphaned conversation items (backport #6059) by @mergify[bot] in #6128
• fix(file_processor): add ZIP decompression limits to MarkItDown processor (backport #6100) by @mergify[bot] in #6133

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• chore: update ogx-client to ^1.1.0 in UI lockfile by @cdoern in #6085
• fix(file_processor): offload sync parsing to thread pool (backport #6095) by @mergify[bot] in #6097
• fix(milvus): use explicit output_fields in query_vector for milvus-lite 3.0 compatibility (backport #6091) by @mergify[bot] in #6096
• fix(vertexai): prevent RuntimeError from stale client after startup event loop (backport #6072) by @mergify[bot] in #6105
• fix(vector_io): propagate search errors instead of returning empty results (backport #6093) by @mergify[bot] in #6117

Full Changelog: v1.1.0...v1.1.1

v1.1.0

What's Changed

• fix(library-client): sanitize omitted headers before building requests by @leseb in #5807
• docs(releases): add 1.0 release notes by @cdoern in #5801
• docs(blog): add OGX 1.0 launch announcement by @leseb in #5785
• fix(ci): prevent test fixtures from overwriting main server log by @derekhiggins in #5797
• chore: Add OpenAI Responses schema drift checker by @leseb in #5805
• chore: bump fallback_version to 1.0.1.dev0 by @cdoern in #5810
• perf(routers): parallelize health and vector store fan-out by @leseb in #5802
• chore(deps): remove unused litellm dep by @mattf in #5813
• docs: update stale /v1/tools references to /v1/admin/tools by @leseb in #5816
• fix(storage): asyncio.Lock for SQLStore and MongoDB expiration enforcement by @leseb in #5803
• fix(docs): tag connector endpoints as Connectors for API docs page by @leseb in #5795
• fix: Harden secret handling and passthrough fallbacks by @leseb in #5799
• fix: improve async safety in routers and Redis KV reads by @leseb in #5800
• feat(compaction): add 5-step tokenizer resolution chain for non-OpenAI models by @franciscojavierarceo in #5791
• ci(deps): auto-update constraint-dependencies on Dependabot PRs by @leseb in #5790
• docs: move original RFC into ADR directory by @leseb in #5794
• docs: fix links to external providers, and base url for edits by @cybette in #5822
• chore: remove exemption for deleted safety router by @rhdedgar in #5819
• feat(pgvector): migrate from psycopg2 to asyncpg by @r3v5 in #5763
• fix(providers): async safety fixes for Databricks, WatsonX, Bing, Tavily, OCI, OpenAI Files by @leseb in #5828
• fix(ci): drop github.actor check from dependabot-constraints workflow by @leseb in #5826
• chore(python-deps): bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in #5788
• feat(vector-io): enforce metadata_store when auth is enabled by @leseb in #5830
• feat!: add Anthropic Message Batches API by @cdoern in #5577
• chore(deps): deduplicate dependency group declarations by @leseb in #5798
• fix(milvus): Handle missing collections in query/delete paths by @leseb in #5836
• fix(storage): reset SQL engines after temp event loop init by @leseb in #5837
• fix(storage): harden PostgreSQL storage and pgvector safety defaults by @leseb in #5834
• chore: bump fallback_version to 1.0.2.dev0 by @cdoern in #5839
• fix(unit_tests): test_library_client improvements by @zy1o in #5832
• chore: bump fallback_version to 1.0.3.dev0 by @cdoern in #5842
• fix(core): library client streaming request without aclose() by @zy1o in #5844
• fix(inference): fix concurrent request Rust borrow checker panic by @zy1o in #5733
• feat(responses): optimize storage from O(n²) to O(n) for multi-turn conversations by @leseb in #5804
• fix(conversations): add sort_order column for deterministic item ordering by @derekhiggins in #5850
• refactor: move blocking provider I/O off event loop by @leseb in #5835
• feat(ui): modernize chat playground to Responses API by @franciscojavierarceo in #5203
• chore(github-deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #5854
• feat(cli): add ogx connect opencode command by @nathan-weinberg in #5675
• chore: remove leftover Meta copyright headers by @leseb in #5864
• fix(ci): update constraint deps script to handle missing and regular dependencies by @leseb in #5865
• chore: remove stale lint suppressions from pyproject.toml by @leseb in #5831
• fix(ci): update constraint deps script to handle missing and regular dependencies by @leseb in #5888
• fix(ci): use PAT for constraint update commits to trigger CI by @leseb in #5889
• docs: add Codex CLI integration blog post and fix docs page by @leseb in #5693
• chore(python-deps): bump google-genai from 2.1.0 to 2.4.0 by @dependabot[bot] in #5859
• chore(python-deps): bump torchvision from 0.25.0 to 0.27.0 by @dependabot[bot] in #5858
• chore(python-deps): bump requests from 2.34.0 to 2.34.2 by @dependabot[bot] in #5856
• fix(deps): add missing chardet dependency to file processor provider specs by @leseb in #5884
• fix(cli): stop ogx run --port argparse default from overriding config by @leseb in #5885
• fix(ui): fix sidebar conversations hydration mismatch by @franciscojavierarceo in #5900
• fix(ci): do not add deps to constraint-dependencies when already declared by @leseb in #5893
• fix(ci): update constraint deps script to handle missing and regular dependencies by @leseb in #5905
• chore(python-deps): bump boto3 from 1.43.6 to 1.43.11 by @dependabot[bot] in #5857
• chore(python-deps): bump ruff from 0.9.10 to 0.15.13 by @dependabot[bot] in #5855
• fix(ci): strip quotes from parsed dependency version in workflow by @leseb in #5907
• chore(python-deps): bump idna from 3.14 to 3.15 by @dependabot[bot] in #5898
• feat(messages): add URL image source and fix vision support in Messages API by @cdoern in #5895
• fix(api): fix field-level schema mismatches in Responses models by @EleanorWho in #5784
• feat(vllm): populate embedding metadata from models.dev by @mattf in #5917
• feat(cli/letsgo): add VLLM_API_TOKEN support to provider autodetection by @mattf in #5918
• fix(embedding): include trust_remote_code in embedding model cache key by @derekhiggins in #5928
• chore(python-deps): bump langchain-openai from 1.2.1 to 1.2.2 by @dependabot[bot] in #5925
• chore(python-deps): bump types-psutil from 7.2.2.20260508 to 7.2.2.20260518 by @dependabot[bot] in #5926
• chore(python-deps): bump myst-parser from 5.0.0 to 5.1.0 by @dependabot[bot] in #5927
• chore(python-deps): bump sentence-transformers from 5.5.0 to 5.5.1 by @dependabot[bot] in #5923
• chore(python-deps): bump ruff from 0.15.13 to 0.15.14 by @dependabot[bot] in #5924
• chore(github-deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #5922
• chore(github-deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #5920
• chore(github-deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #5921
• chore(github-deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #5919
• docs(blog): add RAG benchmarks blog post by @leseb in #5695
• fix(responses): propagate provider 4xx errors instead of returning 500 by @Artemon-line in #5935
• feat(docs): add Anthropic and Google SDK examples to API docs by @leseb in #5827
• fix: reuse cached local Weaviate client instead of leaking instances by @leseb in #5883
• fix(interactions): use Google error envelope for request validation errors by @leseb in #5886
• fix: close superseded OpenAI clients on API key or URL rotation by @leseb in #5902
• fix: bounded chunked reads before unbounded fallback in upload reader by @leseb in #5903
• fix(security): add authorization check to AuthorizedSqlStore.upsert by @derekhiggins in #5931
• feat(cli): add ogx connect claude command by @nathan-weinberg in #5877
• fix(api)!: add post-generation schema transforms for Responses API conformance by @EleanorWho in #5894
• test(security): add ABAC test coverage for vector store create by @derekhiggins in #5934
• docs: remove legacy Facebook references from CONTRIBUTI...

v0.4.6

What's Changed

• chore: bump llama-stack-client to 0.4.5 by @cdoern in #4958
• fix: bump pyjwt to 2.12.0 (CVE-2026-32597) by @eoinfennessy in #5188
• fix: bump pyasn1 to 0.6.3 (CVE-2026-30922) by @eoinfennessy in #5208
• fix: bump pypdf to 5.5.0 (CVE-2026-27628) by @eoinfennessy in #5189
• fix: NLTK Zip Slip Vulnerability (CVE-2025-14009) by @eoinfennessy in #5190
• fix: bump nltk to 3.9.4 (CVE-2026-33236) by @eoinfennessy in #5260
• ci: add release automation workflows to 0.4.x by @cdoern in #5278
• fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (backport #5977) by @mergify[bot] in #5988

Full Changelog: v0.4.5...v0.4.6

v0.7.2

What's Changed

• chore: update llama-stack-client to ^0.7.1 in UI lockfile by @cdoern in #5487
• fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (backport #5977) by @mergify[bot] in #5979

Full Changelog: v0.7.1...v0.7.2