Skip to main content

v0.4.0

Released September 16, 2026. Supported until March 16, 2027.

v0.4.0 ships 7 security updates, 10 new features, and 18 bug fixes. Behavior between the management plane and the data plane changed in this release. The most severe security issue cleared is high.

Upgrade and rollback​

  • No breaking changes. No operator action is required before upgrading.
  • The upgrade rolls through without dropping traffic.
  • Rollback to v0.3.0 is unconditional.

Security updates​

Gateway​

The gateway now includes the gRPC-Go fix for malformed requests missing both the :authority and Host headers.

Changing a provider's authentication type now revokes the credential it used to hold.

The GKE Gateway charts can now attach a GCP SSL policy to the load balancers fronting the api, router, auth, dashboard, otel, proxy and registry endpoints, restricting them to TLS 1.2 or later and removing the 3DES (SWEET32) and static-RSA ciphers that GCP's default policy still permits.

Management plane API​

Claiming a hostname that is already in use no longer exposes details about the existing configuration.

A deleted user is now refused on the platform login path, and an existing session of a deleted or banned user stops working on its next use.

A guardrail rule can now be bound only to a provider its own project owns.

A management API key scoped to an unrelated area can no longer enumerate a project's guardrail providers.

New features​

Management plane API​

Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests.

Administrators can ban and unban a user through the management API.

Platform operators can soft-delete and restore user accounts over the management API.

The management API now serves the user directory the Admin Console reads.

The API can now permanently remove an inactive budget policy without changing the existing deactivation behavior of DELETE.

Creating or updating a guardrail provider now fails with a clear message when the provider could never run: an Azure AI Content Safety provider must carry an endpoint that is an absolute http(s) URL, alongside the existing checks on provider kind and on an external service's declared checks.

Data plane​

An active route deployment whose AI Gateway routes have gone missing now says so, as a Warning condition on the RouteDeployment naming how many of the routes its last render created are no longer there, alongside a warning log.

Guardrails​

Each project now owns its own guardrail providers instead of sharing three platform-wide ones, so provider settings such as an endpoint can differ per project.

A newly created project arrives with its own regexp, builtin and Tetrate guardrail providers, so a guardrail can be written and enforced in it without setting a provider up first.

A guardrail created from a template now binds each of its rules to the project's own provider of the same kind, so it enforces as soon as you enable it with no further setup.

Bug fixes​

Management plane API​

A user whose ban has expired can sign in again, and an existing session of theirs keeps working.

Registering a data plane now returns after its durable workspace bootstrap instead of waiting for the full configuration replay across the customer's catalog.

Creating or rotating a routing key through the API saves the key and its client membership together.

CreateBudgetPolicy now accepts only the released TEAM, TEAM_PER_USER_DEFAULT, and API_KEY scopes.

A revoked admin API key or registry credential now stops authenticating within five minutes.

Release process​

Customer-facing version labels now show the promoted release version after a final Helm chart is deployed, instead of the prerelease build identifier used during internal validation.

Data plane​

A route deployment for an API key no longer becomes active while only part of its AI Gateway routes exist.

tare CLI​

Model lifecycle states, new, preview, deprecated and retired, are now derived from catalog metadata by a single shared policy, so every catalog surface reads the same verdict.

Catalog sync now warns when a model past its retirement date is still enabled on this management plane, and names the remedy, --apply disables the ones the published catalogue still lists, --disable-absent the ones it no longer lists at all.

tare doctor no longer tells an operator their CLI is too old to check upstream reachability.

Catalog sync​

The scheduled catalog sync can now run on a management plane using that plane's admin key.

Gateway​

Passthrough requests now stay with one provider: the highest-priority leg that accepts a caller's own key, plus that provider's other legs.

Anthropic requests sent through AWS Bedrock now normalize system-role messages before forwarding them, and return a useful HTTP-status error when Bedrock responds with an empty error body.

Requests with max_tokens no longer fail because their input cost is larger than the output-only estimate.

A model your gateway lists but cannot yet serve now returns model_not_available and says its catalog entry is still propagating. Available once the data plane is on 0.4.0 or later.

Consoles​

Fixed the playground reporting "no gateway URL configured" on projects whose Base URL is configured; the playground now dials the same URL the API-keys page shows.

An API key's settings page no longer fails when you turn on model specific fallback or open the Budget section.

The fallback settings for an API key now name the one provider a passthrough request, one carrying your own provider credential, uses, and say that steps on any other provider are skipped.