chore(deps): update gsoci.azurecr.io/giantswarm/agentgateway docker tag to v1.4.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
gsoci.azurecr.io/giantswarm/agentgateway	minor	v1.3.1 → v1.4.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

agentgateway/agentgateway (gsoci.azurecr.io/giantswarm/agentgateway)

v1.4.1

Compare Source

🎉 Welcome to the 1.4.1 release of the agentgateway project!

Artifacts

Docker images are available:

• cr.agentgateway.dev/agentgateway:v1.4.1
• cr.agentgateway.dev/controller:v1.4.1

Helm charts are available:

• cr.agentgateway.dev/charts/agentgateway:v1.4.1
• cr.agentgateway.dev/charts/agentgateway-crds:v1.4.1
• cr.agentgateway.dev/charts/agentgateway-standalone:v1.4.1

Binaries for agentgateway and the agctl CLI are available below.

Quick Start

Follow the Kubernetes or Standalone quick start guide to get started!

Agentgateway v1.4.1

This release fixes a few bugs around LLM and MCP, increasing compatibility with the new 07-28-2026 specification.

Upgrade notes

• Top-level standalone llm and mcp listeners may no longer share a port. To expose both on one port, attach them to the same configured gateway.
• When a model references a named custom provider, that provider’s configured name is now used for custom model-catalog lookup. Catalog entries keyed under the generic custom provider name may need to be updated.
• OAuth token-exchange configurations that relied on an implicit fallback to validated JWT claims must explicitly select jwt.rawToken.unredacted() as the subject-token source.

MCP improvements

• Added MCP Tasks support, including task retrieval, updates, cancellation, multiplexed task IDs, capability advertisement, RBAC enforcement, and task context in CEL and telemetry.
• MCP upstream responses are now validated against the expected response type.
• Asynchronous MCP errors are included in access logs.
• Fail-open fan-out requests now return an error when every upstream fails instead of producing an empty success.
• OpenAPI-derived MCP tools use the operation summary as their human-readable title.
• Synthetic internal session identifiers are no longer logged as MCP session IDs.

LLM and model handling

• Model catalogs now hot reload consistently when changed through either configuration files or the UI/configuration store.
• Fixed Amazon Bedrock requests containing tool-call history but no current tool definitions. Agentgateway now supplies the tool configuration Bedrock requires to continue these conversations.
• Fixed GitHub Copilot embedding responses that omit required OpenAI-compatible object and model fields.
• Prompt-cache writes are no longer charged as both cache writes and ordinary input. Catalogs without a cache-write price fall back to the standard input rate.

Prompt guards

• Prompt guards now preserve structured Anthropic tool-use and tool-result content when masking text, preventing malformed requests and upstream 400 responses.
• Consecutive text blocks are evaluated together, allowing patterns spanning block boundaries to be detected.
• Non-text blocks and metadata such as Anthropic cache controls are preserved during masking.
• Zero-width regular-expression matches no longer insert masking placeholders throughout the input.
• Webhook prompt guards can access the full llmRequest CEL variable and add CEL-computed headers through standalone configuration, Kubernetes CRDs, and xDS.

Authentication and security

• OAuth token exchange now fails closed when its configured subject-token source is missing or empty. Validated JWT claims are no longer used as an implicit fallback; configurations that intentionally use the validated token can select it explicitly with CEL.
• Cross-namespace JWKS backend references now honor the configured Gateway API ReferenceGrant policy.

Configuration and operations

• Configuration storage and request logging can use separate databases when their settings differ, while identical configurations continue to share resources.
• Environment expansion now happens before configuration parsing, allowing variables in fields needed during startup.
• External authorization and processing services can return large response bodies without an artificial size limit.

Networking

• Added a full connection-handshake timeout so requests do not accumulate behind hung HTTP/2 connections.

What's Changed

• krt: fix Equals signatures by @​stevenctl in #​2704
• openapi: set title based on summary by @​stevenctl in #​2697
• refactor(controller): use apiequality.Semantic.DeepEqual for K8s API comparisons by @​dongjiang1989 in #​2687
• better cpu profile defaults by @​ilrudie in #​2682
• standalone: reject shared port for llm and mcp by @​howardjohn in #​2698
• fix: rewatch replaced model catalog files by @​iploooox in #​2702
• add Goose to Client Setup by @​mkorbi in #​2722
• Adding Configuration for GatewayClass and Controller Name by @​jaiveerk in #​2694
• Bump wiremock-rs by @​markuskobler in #​2726
• database: make connection pool size configurable by @​sj-louw in #​2705
• ext*: do not limit serve response size by @​howardjohn in #​2728
• database: split or share based on whether config is the same by @​howardjohn in #​2730
• client: avoid waiting on hung h2 connections by @​howardjohn in #​2729
• connect: scope internal bind lookup based on IP by @​howardjohn in #​2731
• llm: price prompt cache writes once by @​danehans in #​2727
• waypoint: accept traffic when serving as a weighted waypoint by @​ymesika in #​2716
• mcp: move off rmcp fork by @​howardjohn in #​2708
• webhook guardrail: expose llmRequest CEL var by @​howardjohn in #​2733
• fix(copilot): add OpenAI metadata to embedding responses by @​iandvt in #​2684
• feat: expose webhook prompt guard headers through Kubernetes CRD and xDS API (fixes #​2718) by @​ibariens in #​2723
• Bump to rmcp v3 beta5 by @​howardjohn in #​2738
• fix(config): run shellexpend before parsing the config by @​yanir75 in #​2736
• jwks: add ref grant support by @​howardjohn in #​2706
• Add initial extensible standalone configuration importer by @​danehans in #​2605
• mcp tasks support by @​stevenctl in #​2745
• mcp: avoid logging synthetic session id by @​howardjohn in #​2743
• llm: remove guardrail deadcode by @​howardjohn in #​2746
• promptGuard: scan anthropic tool output by @​stevenctl in #​2732
• fix(bedrock): set toolConfig when messages carry tool history by @​howardjohn in #​2747
• llm: when using custom provider ref, override provider name by @​howardjohn in #​2754
• catalog: always hot reload by @​howardjohn in #​2753
• auth: fail closed when OAuth subject token source is missing by @​markuskobler in #​2740
• mcp: validate response body shape and log async errors by @​howardjohn in #​2744
• promptGuard: apply guard to merged consecutive text blocks by @​stevenctl in #​2755

New Contributors

• @​ilrudie made their first contribution in #​2682
• @​mkorbi made their first contribution in #​2722
• @​jaiveerk made their first contribution in #​2694
• @​sj-louw made their first contribution in #​2705
• @​iandvt made their first contribution in #​2684
• @​ibariens made their first contribution in #​2723

Full Changelog: agentgateway/agentgateway@v1.4.0...v1.4.1

v1.4.0

Compare Source

🎉 Welcome to the 1.4.0 release of the agentgateway project!

This release brings a number of highlight features.

First, we have full support for the new MCP 2026-07-28 protocol, which we have been working with the MCP community to develop over the past year.
Additionally, Enterprise-Managed Authorization (also known as Cross App Access) for MCP has been added, enabling centralized access control for MCP servers.
Along the same authentication line, a flexible and feature-rich OAuth token exchange backend authentication mode has been added, enabling a number of security authentication strategies.

The standalone mode has a number of enhancements: configuration created in the UI can now be stored in the database (sqlite for local usage, postgres for remote or HA setups), avoiding the need for a persistent disk. A new gateways configuration replaces the low-level binds API and enables serving LLM, MCP, generic routes, and the UI on the same port; additionally, this enables authentication (such as OIDC) for the UI. A new agentgateway-standalone Helm chart is available for deploying standalone agentgateway in Kubernetes.

The Kubernetes deployment has a new (off by default) experimental AgentgatewayModel API, bringing the standalone LLM experience to Kubernetes. AgentgatewayModel allows serving a number of LLM models under the same gateway, routed based on the model name in the request. This offers a higher level API than AgentgatewayBackend, simplifying the common configuration cases; the existing API remains available.

The release also includes Gateway API v1.6 support, fault injection, richer guardrails, and many other enhancements and bug fixes.

Artifacts

Docker images are available:

• cr.agentgateway.dev/agentgateway:v1.4.0
• cr.agentgateway.dev/controller:v1.4.0

Helm charts are available:

• cr.agentgateway.dev/charts/agentgateway:v1.4.0
• cr.agentgateway.dev/charts/agentgateway-crds:v1.4.0
• cr.agentgateway.dev/charts/agentgateway-standalone:v1.4.0

Binaries are available below.

Quick Start

Follow the Kubernetes or Standalone quick start guide to get started.

🔥 Breaking changes

Gateway API v1.6 and TCPRoute v1

Agentgateway now builds against Gateway API v1.6, and the Kubernetes controller uses the v1 version of TCPRoute instead of v1alpha2. Re-apply the Gateway API CRDs that match this release before you upgrade.

MCP request-phase guardrail rejections return HTTP 200

When an MCP guardrail rejects a request during the request phase, agentgateway now returns the rejection as an HTTP 200 with a JSON-RPC error body, matching the existing response-phase behavior. Update any clients or tests that expected a non-200 status for request-phase rejections.

For more information, see Kubernetes MCP guardrails and Standalone MCP guardrails.

(Standalone) auth.location no longer nests expression

The auth.location configuration no longer uses a double-nested expression field. Update any policies that set a custom token location to use the flattened form.

musl container images removed

The musl-based container image variants are no longer published. Switch to the standard (glibc) images.

The binary releases are still built with musl.

🔒 Security

Stateful MCP sessions can cross routes and overwrite the authorization policy

This release addresses the security advisory GHSA-mvgg-jvj2-4frq of a High (8.1) severity impacting MCP authorization.

Please see the advisory for details and mitigation steps.

Thank you to Aonan Guan for this report.

Request/Response Body CEL policies

A report was made to us that authorization policies written against the request.body or response.body CEL variables may result in unexpected behavior due to the truncation behavior of these attributes.

This is a security recommendation on the usage of these fields in authorization policies, and not a bug in agentgateway.

This behavior has also changed in this release; see below:

Attribute	Version	Behavior
request.body	1.3.x and earlier	Truncated to http.maxBufferSize (default 2MB)
request.body	1.4	Not available if truncated
request.truncatedBody	1.3.x and earlier	Not available
request.truncatedBody	1.4	Truncated to http.maxBufferSize (default 2MB)

The split between body and truncatedBody allows more control over the body when it exceeds the maximum buffer size.

In all cases, usage of these fields in authorization requests is prone to mistakes. For example, consider this request:

string(request.truncatedBody).contains("attacker-payload")

If the request is over 2MB, the attacker-payload may be present but missed.
Additionally, request encoding schemes (compression, etc) can result in additional bypasses.
When using these fields in authorization policies, ensure the policy correctly degrades in these cases.

Thank you to Aonan Guan for this report.

🌟 New features

MCP protocol 2026-07-28 support

Agentgateway adds support for the upcoming MCP 2026-07-28 protocol version.

• Stateful and stateless servers: Agentgateway supports both stateful and stateless MCP servers, including closing the SEP-2575 server-stateless conformance gap and skipping the synthetic initialize handshake for modern requests.
• Trace context propagation: Distributed trace context propagates through the MCP _meta field.
• MCP Apps: Basic support for MCP Apps, including multiplexing fixes for app-originated tool calls.
• Capability and multiplexing improvements: Preserved multi-resource tool result capabilities for modern clients, multi-target subscriptions and listen, and opaque resource URI multiplexing.

Because MCP 2026-07-28 support is new in this release, most of it is not yet covered by a dedicated guide. For the fields available today, see the Kubernetes API reference and Standalone configuration reference.

Cross App Access for MCP

Agentgateway supports MCP Enterprise-Managed Authorization through the OAuth Identity Assertion Authorization Grant, also known as Cross App Access or ID-JAG. An enterprise identity provider can broker access between a client application and the MCP server without the end user completing a separate OAuth flow for each downstream app.

For more information, see Kubernetes Cross App Access and Standalone Cross App Access.

OAuth token exchange backend authentication

Agentgateway can exchange an incoming token for a backend credential by using RFC 8693 OAuth 2.0 token exchange and the RFC 7523 JWT bearer grant. This release adds Kubernetes controller support, custom token types and OAuth 2.1 exchange defaults, the ability to inject multiple secret-sourced headers, and an override for the resolved secret key.

For more information, see Kubernetes OAuth token exchange and Standalone OAuth token exchange.

New MCP authentication providers

Agentgateway adds native MCP authentication provider support for Microsoft Entra ID. Standalone also adds native providers for Descope and authentik.

The entra provider bridges OAuth behaviors that Microsoft Entra ID implements differently from the MCP authorization specification, including serving RFC 8414 metadata from Entra's OIDC discovery document, stripping the RFC 8707 resource parameter, and short-circuiting Dynamic Client Registration with your pre-registered application ID.

For more information, see Kubernetes MCP authentication, Standalone MCP authentication, and the Standalone Descope integration guide.

New standalone gateways configuration model

Standalone configuration gains a new top-level gateways concept that unifies the UI, LLM, MCP, and routes so that they can share a single listener and port. gateways supersedes binds; existing binds configuration continues to work, and the UI offers a one-click migration from binds to gateways.

This release also adds simpler host and TLS configuration, the ability to serve LLM and MCP traffic on the same port, and an internal bind mode with wildcard fallback. For the full configuration surface, see the Standalone configuration reference.

Virtual keys from ConfigMaps and hashed keys

Virtual keys can now be sourced from a ConfigMap in addition to a Secret, and API keys can be stored as SHA-256 hashes so that raw key material never needs to live in the cluster or in plaintext configuration.

For more information, see Kubernetes virtual keys and Standalone virtual keys.

CEL enhancements

This release expands the CEL surface across policy, telemetry, and transformations:

• Custom CEL functions: Register custom CEL functions for use in policies.
• CEL filters for telemetry: An opt-in CEL filter selects which requests emit OpenTelemetry spans, and CEL filters decouple OTLP log fields and filtering from stdout logging.
• New CEL context and functions: Access inbound CONNECT request headers through source.connectHeaders, and use a CEL replace mode for header transformations.

For the full CEL surface, see the Kubernetes CEL reference and Standalone CEL reference.

Fault injection: request delay

A new delay traffic policy injects latency before a request is forwarded to the backend, for fault-injection and chaos testing. The delay duration accepts a duration string or a CEL expression that returns a duration, or a number interpreted as milliseconds. Injected delay counts against the request timeout.

For more information, see Kubernetes fault injection and Standalone fault injection.

AWS assume-role session tags and session name

AWS assumeRole backend authentication supports STS session tags and a configurable RoleSessionName. Both the session name (sessionNameExpression) and per-tag values (tags[].expression) can be set from CEL expressions evaluated per request, so you can propagate identity attributes such as jwt.sub into the assumed AWS session.

For more information, see Standalone backend authentication. For Kubernetes fields, see the Kubernetes API reference.

Guardrail enhancements

Guardrails include several new operational and policy controls:

• Backend connection policy for callouts: A BackendConnectionPolicy controls the TCP, TLS, HTTP, and tunnel settings agentgateway uses when it calls out to a guardrail service, and is available on the OpenAI moderation, Bedrock guardrails, and Google Model Armor policies.
• Default callout timeouts: Guardrail callouts now apply a default timeout.
• Improved logs and UI: Guardrail decisions surface more clearly in logs and the UI.
• failureMode for external processing: External processing supports fail-open or fail-closed behavior.

For more information, see Kubernetes LLM guardrails, Standalone prompt guards, Kubernetes MCP guardrails, and Standalone MCP guardrails.

External processing enhancements

The Kubernetes controller supports metadataContext, requestAttributes, and responseAttributes for external processing, and extProc exposes a failureMode for fail-open or fail-closed behavior.

For more information, see Kubernetes external processing and Standalone external processing.

LLM gateway enhancements

• Frontend TLS with multiple CAs: Client certificate validation can trust multiple CAs.
• Bedrock: Added Responses-to-Bedrock image translation, sanitized tool names that exceed the 64-character Converse limit, and propagated cache-write tokens to the access log.
• Gemini: Fixed embeddings handling and generateContent model and usage extraction in detect mode.
• A2A v1.0: Support for the A2A v1.0 agent card format in URL rewriting.
• Azure AI Foundry: Support for Anthropic endpoints on Foundry.

For the list of supported providers, see Kubernetes LLM providers and Standalone LLM providers.

Deployment, operations, and packaging

• Standalone Helm chart: A new agentgateway-standalone Helm chart deploys standalone agentgateway, with support for a metrics service and ServiceMonitor. For more information, see Standalone Helm deployment.
• DaemonSet workloads: Kubernetes can deploy the data plane as a DaemonSet.
• Sidecars in control plane pods: A Helm extraContainers value runs sidecar containers in control plane pods.
• Metrics scraping: Kubernetes can scrape proxy metrics with a PodMonitor, and a new agentgateway_controller_build_info metric reports controller build details.
• Database logging: Standalone logging writes both successes and errors to the SQL database, with optimized write performance.

For more information, see Kubernetes Helm installation, Kubernetes control plane metrics, and Standalone metrics.

Contributors

Thank you to everyone who contributed code, reviews, documentation, bug reports, and CI improvements for this release!

See the full contributor list below.

What's Changed

• costs: add prometheus counter metric by @​howardjohn in #​2243
• ext authz: cache HTTP as well as gRPC by @​howardjohn in #​2283
• ui: fix pricing catalog by @​howardjohn in #​2241
• dtrace: log body for streaming llm too by @​howardjohn in #​2287
• cel: expose CONNECT request headers as source.connectHeaders by @​shashankram in #​2285
• feat(telemetry): add opt-in CEL filter for OTel spans by @​inercia in #​2295
• fix(foundry): add support for anthropic endpoints on foundry by @​Darkflame72 in #​2190
• Centralize LLM provider format capabilities by @​danehans in #​2288
• ext authz: add custom body for http payloads by @​howardjohn in #​2284
• ui: fix virtual API key copy button by @​yalindogusahin in #​2294
• tracing: expose filter in Kubernetes by @​howardjohn in #​2300
• dtrace: add copy details button by @​howardjohn in #​2289
• controller: fix MCP Guardrails not referencing AGBE by @​howardjohn in #​2307
• build(deps): bump golang.org/x/image from 0.28.0 to 0.38.0 in the go_modules group across 1 directory by @​dependabot[bot] in #​2303
• admin: allow directly routing to internal admin interface by @​howardjohn in #​2299
• llm: fix detect and audio endpoints by @​howardjohn in #​2301
• Add standalone agentgateway Helm chart by @​kevin-shelaga in #​2255
• agctl: trim 100mb off the binary by @​howardjohn in #​2290
• proxy: terminate outer TLS before serving CONNECT tunnels by @​shashankram in #​2308
• api key: allow sha256 encoded keys by @​howardjohn in #​2240
• Custom CEL functions by @​howardjohn in #​2230
• test cost configmaps by @​nfuden in #​2306
• agctl: move trace and config command logic under proxy subcommand by @​GuruduGanesh in #​2197
• fix(llm): apply pathPrefix for passthrough routes on custom-host backends by @​onematchfox in #​2151
• Support A2A v1.0 agent card format in URL rewriting by @​timonschmidt in #​2251
• security: fix timing attacks in auth and add admin IP allowlist by @​rafael31p in #​2191
• proxy: avoid noisy TLS logs by @​howardjohn in #​2311
• auth: add RFC 8693 token exchange backend auth by @​gilad9366 in #​2189
• Release standalone Helm chart by @​kevin-shelaga in #​2320
• feat(ui): detect Claude subscription misuse and show warning by @​rajv2er in #​2321
• Allow conformance GatewayClass overrides by @​danehans in #​2329
• guardrails: avoid unnecessary regex guard allocations by @​stevenctl in #​2328
• Drop and test large stack sizes by @​howardjohn in #​2336
• binds: add internal bind mode and wildcard fallback by @​shashankram in #​2326
• pprof: use frame-pointers by @​howardjohn in #​2332
• build(deps): bump the cargo-weekly group with 11 updates by @​dependabot[bot] in #​2352
• cel: make duration(duration) and identity function by @​howardjohn in #​2354
• llm: remove unnecessary async/.await from process_streaming by @​markuskobler in #​2356
• [feat] GWAPI FrontendTLS: Support multiple CAs for the client cert validation in agentgateway by @​krinkinmu in #​2173
• dtrace: include frontend policy selection by @​howardjohn in #​2355
• mcp: accept get stream when only a subset of servers have 405 by @​howardjohn in #​2342
• buffer: copy buffer limit around more by @​howardjohn in #​2353
• mcp: add modern MCP release foundation by @​filintod in #​2345
• Move incoming_connect_tunnel_reenters_internal_bind test to ephemeral port by @​howardjohn in #​2362
• fix extproc attributes and grpc initial metadata by @​jenshu in #​2364
• bump to rust 1.96.1 by @​nfuden in #​2390
• feat(buffer): Allow streaming on bodies larger than the limit by @​yanir75 in #​2358
• controller: support ext_proc metadataContext/requestAttributes/responseAttributes by @​fengxsong in #​2369
• chore: Bump kube-api-linter version and fix gosec linter by @​dongjiang1989 in #​2366
• fix: honor TLS for tracing HTTPS endpoints by @​jstar0 in #​2372
• llm: register transformation CEL expression by @​howardjohn in #​2393
• policy: support targeting frontend policies to a Gateway port by @​shashankram in #​2363
• guardrails: default timeouts for callouts by @​nfuden in #​2388
• Initial support for MCP 2026-07-28 by @​howardjohn in #​2365
• standalone: use simple schema macro more by @​howardjohn in #​2392
• otlp logs: decouple fields and filter from stdout by @​howardjohn in #​2313
• gateway: support internal bind mode via annotation by @​shashankram in #​2380
• controller: move to TCPRoute v1 by @​howardjohn in #​2389
• deployer: populate InternalPorts in GatewayIRFrom fallback by @​shashankram in #​2396
• standalone: add dependency tracking for config by @​howardjohn in #​2327
• tools: bump dependencies by @​howardjohn in #​2394
• docs: Update tool names in Authorization example by @​aakashsbhatia2 in #​2344
• refactor: replace sort.Slice with slices.Sort for natural ordering by @​dongjiang1989 in #​2367
• Use k8s:enum more by @​howardjohn in #​2405
• config: better error messages by @​howardjohn in #​2406
• add azureauth types to k8s side by @​jgreeer in #​2337
• Return request-phase MCP guardrail rejections as 200, matching the response phase by @​christensenjairus in #​2331
• llm: refactor standalone model router by @​howardjohn in #​2330
• chore(lint): upgrade golangci-lint and its plugins; run clippy before formatting by @​markuskobler in #​2381
• openapi: support application/octet-stream request bodies in MCP tool generation by @​dhruvbehl in #​2400
• Feat: Add Descope as an MCP authentication provider by @​joshwertheim in #​2376
• fix: add default timeout for oauthTokenExchange token endpoint by @​jgreeer in #​2410
• Bedrock: sanitize tool names exceeding 64-char Converse limit by @​devmittal02 in #​2384
• auth.location: remove double nested expression by @​howardjohn in #​2411
• dtrace: show final status and error by @​howardjohn in #​2412
• Expand OAuth token exchange backend auth by @​markuskobler in #​2338
• Bump istio version to fix broken startup due to TCPRoute 1.6.0 by @​keithmattix in #​2432
• build(deps): bump the cargo-weekly group with 5 updates by @​dependabot[bot] in #​2438
• feat(metrics): add agentgateway_controller_build_info metric and fix SetRegistry lifecycle bug by @​dongjiang1989 in #​2399
• feat: add support for AWS session tags & RoleSessionName by @​Lyqed in #​2435
• build(deps): bump cmov from 0.5.3 to 0.5.4 by @​dependabot[bot] in #​2439
• Code of conduct: clarify anti-issue agent stance by @​howardjohn in #​2441
• standalone: support LLM and MCP on the same port by @​howardjohn in #​2409
• controller: drop deadcode from opencensus by @​howardjohn in #​2440
• Refactor LLM translation paths by @​howardjohn in #​2415
• auth: OAuth Identity Assertion Authorization Grant Support (ID-JAG / "Cross App Access" / XAA) by @​markuskobler in #​2436
• fix(mcp): skip upstream JSON-RPC error frames in FailOpen fanout merge by @​syf2211 in #​2428
• Refactor examples folder by @​howardjohn in #​2242
• Resolve Istio CRDs via go mod download by @​johananl in #​2446
• Bump to head of gateway-api release-1.6 by @​howardjohn in #​2360
• fix(bedrock): propagate cache-write tokens to access log for completi… by @​ankkod in #​2444
• standalone: allow simpler host + TLS configuration by @​howardjohn in #​2450
• test: add goleak to detect goroutine leaks in controller packages by @​dongjiang1989 in #​2419
• fix(jwt): no owners from policy fetch for targetSelectors by @​jgreeer in #​2452
• build(deps): bump golang.org/x/image from 0.38.0 to 0.41.0 in the go_modules group across 1 directory by @​dependabot[bot] in #​2454
• gemini: do not fail on embeddings by @​howardjohn in #​2455
• added demos and examples for cross app access for keycloak, xaa.dev, … by @​christian-posta in #​2449
• build: build embedded UI automatically and add UI=0 opt-out by @​jbohanon in #​2457
• added examples for oauth token exchange and jwt bearer by @​christian-posta in #​2424
• fix: Remove duplicate CEL validation markers by @​dongjiang1989 in #​2461
• llm: split credential cache from providers by @​howardjohn in #​2459
• Move end to end test flows to integration tests by @​howardjohn in #​2468
• fix: apply discoveryNamespaceSelectors filter to AgentgatewayBackend and AgentgatewayPolicy informers by @​julien-aubert in #​2442
• fix(llm): decode Content-Encoding on request bodies before JSON parse by @​westover in #​2404
• Split LLM into its own crate by @​howardjohn in #​2469
• llm: move auth back to main crate by @​howardjohn in #​2470
• feat: support CEL expressions for AWS session tag values by @​Lyqed in #​2447
• ui: update to tsc 7 by @​howardjohn in #​2471
• standalone: log errors to sql db as well, not just success by @​howardjohn in #​2476
• controller: OAuth Token Exchange support by @​markuskobler in #​2458
• Hardcode test CA certificate by @​johananl in #​2481
• Allow simple host+policy config in logs and traces too by @​howardjohn in #​2474
• Rust 1.97 by @​howardjohn in #​2479
• standalone: Add new "Gateways" concept, unifying UI + traffic on one port by @​howardjohn in #​2473
• fix: responses api with date based azure api + get_path_for_model rewrite by @​jgreeer in #​2493
• ui: misc improvements by @​howardjohn in #​2499
• Bump conformance to fix test flakes by @​howardjohn in #​2500
• controller: better logging by @​howardjohn in #​2491
• xds: version resources by @​howardjohn in #​2497
• Enable the generated crd description len to be configured by @​markuskobler in #​2489
• mcp: skip synthetic initialize for modern requests by @​stevenctl in #​2477
• azure: log construction errors when all credentials fail by @​jgreeer in #​2502
• Add LLM semantic routing example by @​danehans in #​2486
• bump go oras 2.6.2 by @​nfuden in #​2517
• Document Rust toolchain requirement by @​johananl in #​2516
• examples: suppress semantic router domain defaults by @​danehans in #​2506
• build(deps): bump the cargo-weekly group with 6 updates by @​dependabot[bot] in #​2514
• examples: use buffered semantic routing ExtProc by @​danehans in #​2521
• Expose OAuth Token Exchange builder by @​markuskobler in #​2522
• auth: inline OAuth Token Exchange & Cross App Access endpoint config by @​markuskobler in #​2529
• build(deps): bump soupsieve from 2.8.3 to 2.8.4 in /examples/traffic-a2a/strands-agents in the uv group across 1 directory by @​dependabot[bot] in #​2485
• mcp: basic support for Apps by @​stevenctl in #​2475
• fix flake in debug trace test by @​stevenctl in #​2523
• Wait for base gateway before port forwarding by @​johananl in #​2496
• build(deps): bump click, pillow, pygments in examples/traffic-a2a by @​markuskobler in #​2540
• feat(helm): add extraContainers value for running sidecars in control plane pods by @​zackwy in #​2542
• examples: support Responses semantic routing by @​danehans in #​2532
• Added descriptions by @​kristin-kronstain-brown in #​2545
• mcp: add "prefix: never" to fix multiplexing for app originated tool calls by @​stevenctl in #​2531
• .github: nightly agctl artifacts by @​nfuden in #​2556
• fix(standalone

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.