- Remove the unused `swag/jsonname` indirect module dependency.
- Prune stale checksums for superseded dependency versions.
- Retain checksums for currently resolved module versions.
- Refresh the fixture module checksum for version 0.27.3.
## CHANGES
- Add Claude Opus 5 to supported model selection
- Disable sampling parameters for Claude Opus 5 requests
- Restrict one-million-token beta headers to compatible Claude models
- Remove unsupported 200K-context models from beta header mapping
- Upgrade Anthropic, AWS, Ollama, Google, and supporting dependencies
- Add Claude Sonnet 5 to supported Anthropic models
- Omit sampling parameters for Claude Sonnet 5 requests
- Centralize Anthropic sampling restrictions behind prefix matching
- Enable one-million-token context beta for Claude 5 models
- Remove older Claude 4 aliases from model listings
- Update Anthropic tests for Sonnet 5 beta mapping
- Refresh Go dependencies across AI provider integrations
- Add persistent cache for provider model discovery results
- Serve stale model caches during discovery failures
- Return concise localized errors for rate-limited model fetches
- Send GitHub Models API version header automatically
- Add Claude Fable 5 Anthropic model support
- Omit sampling parameters for Claude Fable 5
- Update model rate-limit translations across supported locales
- Add tests for cache, rate-limit, and GitHub headers
- Update Go dependencies for AI provider integrations
# CHANGES
- Upgrade Go toolchain to 1.26.0
- Bump anthropic-sdk-go to v1.46.0
- Add Claude Opus 4.8 to supported models
- Update AWS SDK and Bedrock service modules
- Bump ollama client to v0.24.0
- Refresh OpenTelemetry, gRPC, and genai dependencies
- Update go-git, sqlite3, and assorted indirect modules
- Upgrade Vite from 5.4.21 to 8.0.8 in web
- Bump @sveltejs/vite-plugin-svelte from 4.0.4 to 7.0.0
- Upgrade vite-plugin-tailwind-purgecss from 0.2.1 to 0.3.5
- Bump AWS SDK Go v2 modules to latest patches
- Update ollama client from 0.20.4 to 0.21.1
- Upgrade go-git from 5.17.2 to 5.18.0
- Bump hasura go-graphql-client from 0.15.1 to 0.16.0
- Update perplexity-go from 2.15.0 to 2.16.1
- Refresh google api, genai, and transitive Go modules
- Upgrade `anthropic-sdk-go` dependency from v1.34.0 to v1.37.0
- Add `claude-opus-4-7` to supported models list
- Enable 1M context window beta for Opus 4.7
- Update model beta comments to reflect Opus 4.7 support
- Upgrade `anthropic-sdk-go` from v1.27.1 to v1.34.0
- Upgrade `ollama` from v0.18.2 to v0.20.4
- Bump AWS SDK v2 packages to latest patch releases
- Update `go-git/v5` from v5.17.1 to v5.17.2
- Upgrade `go-sqlite3` from v1.14.37 to v1.14.42
- Bump `google.golang.org/api` from v0.272.0 to v0.275.0
- Upgrade `google.golang.org/genai` from v1.51.0 to v1.53.0
- Update OpenTelemetry packages from v1.42.0 to v1.43.0
- Bump `golang.org/x` crypto, net, sys, text, and mod packages
- Upgrade `google.golang.org/grpc` from v1.79.3 to v1.80.0
- Bump `anthropic-sdk-go` from v1.23.0 to v1.27.1
- Upgrade AWS SDK Go v2 packages to latest patch versions
- Update `gin-gonic/gin` to v1.12.0 and `go-git` to v5.17.0
- Bump `ollama/ollama` from v0.16.2 to v0.18.2
- Upgrade `google.golang.org/api` to v0.272.0 and `genai` to v1.51.0
- Update OpenTelemetry packages to v1.42.0/v0.67.0
- Bump `golang.org/x` packages to latest minor versions
- Remove deprecated `ModelClaude4Sonnet20250514` and `ModelClaude4Opus20250514` aliases
- Add `go.mongodb.org/mongo-driver/v2` as new indirect dependency
## CHANGES
- Add new `azure_entra` plugin client to plugin registry
- Extract shared Azure logic into `azurecommon` package
- Move `ParseDeployments`, `BuildEndpoint`, and middleware to `azurecommon`
- Upgrade `azidentity` to v1.13.1 with Entra ID/MSAL support
- Add `golang-jwt`, `pkg/browser`, and `go-keychain` as new dependencies
- Add `azure_credential_failure`, `azure_base_url_question` i18n keys across all locales
- Validate Azure deployment names are non-empty on configure
- Bump go-sqlite3 from v1.14.33 to v1.14.34
- Bump ollama from v0.15.6 to v0.16.1
- Bump google.golang.org/api from v0.265.0 to v0.266.0
- Bump google.golang.org/grpc from v1.78.0 to v1.79.0
- Remove deprecated Claude 3.x model references from Anthropic client
- Remove claude-3-7-sonnet model from OpenAI-compatible provider config
- Add changelog entry for PR #1996
- Add PDFURL and URLPDF to VSCode spell-check dictionary
- incoming 1996 changelog entry
- Upgrade Anthropic SDK Go dependency to version 1.23.0
- Add Claude Sonnet 4.6 to list of supported models
- Update `go.sum` checksums for new SDK version
# CHANGES
- Update Anthropic SDK to version 1.22.0 for improved functionality
- Bump AWS SDK and Bedrock runtime to improve cloud integration
- Upgrade Ollama dependency to version 0.15.6 for model support
- Refresh Google API and GenAI libraries to current stable releases
- Update Go Git and Billy modules to enhance repository handling
- Synchronize various golang.org x-library versions for better system compatibility
- Patch minor dependencies including SQLite, i18n, and Perplexity SDK
See https://www.anthropic.com/news/claude-opus-4-6
## CHANGES
- Upgrade anthropic-sdk-go from v1.20.0 to v1.21.0
- Add `ClaudeOpus4_6` to supported Anthropic model list
- Remove unused indirect dependencies from go.mod and go.sum
- Clean up legacy protobuf and gRPC version references
- Remove stale tensor, math, and image processing libraries
- Drop unused table writer and console dependencies
- Prune obsolete cloud.google.com version pins
## CHANGES
- Bump `anthropic-sdk-go` dependency from v1.19.0 to v1.20.0
- Add deprecation notice for pre-February 2026 legacy models
- Add new Claude Sonnet 4.0 and Opus 4.0 model aliases
- Extend 1M context beta support to all Sonnet 4 variants
- Reorganize model list to separate deprecated from current models
- Add `neturl` to VS Code spell-check dictionary
Add support for Google Cloud Vertex AI as a provider to access Claude models
using Application Default Credentials (ADC). This allows users to route their
Fabric requests through Google Cloud Platform instead of directly to Anthropic,
enabling billing through GCP.
Features:
- Support for Claude models (Sonnet 4.5, Opus 4.5, Haiku 4.5, etc.) via Vertex AI
- Uses Google ADC for authentication (no API keys required)
- Configurable project ID and region (defaults to 'global' for cost optimization)
- Full support for streaming and non-streaming requests
- Implements complete ai.Vendor interface
Configuration:
- VERTEXAI_PROJECT_ID: GCP project ID (required)
- VERTEXAI_REGION: Vertex AI region (optional, defaults to 'global')
Closes#1570
# CHANGES
- Upgrade AWS SDK v2 components to latest stable versions.
- Update Ollama library to version 0.13.5 for improvements.
- Bump Google API and GenAI dependencies to newer releases.
- Refresh Cobra CLI framework and Pflag to latest versions.
- Advance Go-Git and Go-Readability to their most recent commits.
- Update OpenTelemetry and gRPC libraries for better observability.
- Include new AWS sign-in service dependency in the module.
- Upgrade anthropic-sdk-go from v1.16.0 to v1.19.0
- Bump golang.org/x/text from v0.28.0 to v0.31.0
- Update golang.org/x/crypto from v0.41.0 to v0.45.0
- Upgrade golang.org/x/net from v0.43.0 to v0.47.0
- Bump golang.org/x/sync from v0.16.0 to v0.18.0
- Update golang.org/x/sys from v0.35.0 to v0.38.0
- Add Claude Opus 4.5 model variants to Anthropic client
- chore: incoming 1845 changelog entry
- Add GitHub Models to supported OpenAI-compatible providers list
- Implement direct HTTP fallback for non-standard model responses
- Centralize model fetching logic in openai package
- Upgrade openai-go SDK dependency from v1.8.2 to v1.12.0
- Remove redundant model fetching code from openai_compatible package
- Add comprehensive GitHub Models setup documentation (700+ lines)
- Support custom models URL endpoint per provider configuration
- Add unit tests for direct model fetching functionality
- Update internationalization strings for model fetching errors
- Add VSCode dictionary entries for "azureml" and "Jamba"
- Upgrade `anthropic-sdk-go` to version 1.16.0
- Remove outdated model `ModelClaude3_5SonnetLatest`
- Add new model `ModelClaudeSonnet4_5_20250929`
- Include `ModelClaudeSonnet4_5_20250929` in `modelBetas` map
CHANGES
- switch Azure OpenAI config to openai-go azure helpers
- require API key and base URL during configuration
- default API version to 2024-05-01-preview when unspecified
- trim and parse deployments input into clean slice
- update dependencies to support azure client and authentication flow
- add tests for configuration and default API version behavior
- remove latest-tag boundary logic from changelog walker (revert to the v1.4.213 version)
- simplify version assignment by matching commit messages directly
- Upgrade Go from 1.24 to 1.25.1
- Update Anthropic SDK for web fetch tools
- Upgrade AWS Bedrock SDK 12 versions
- Update Azure Core and Identity SDKs
- Fix Nix config for Go version lag
- Update Docker base to golang:1.25-alpine
- Add comprehensive upgrade documentation
- Add internationalization system with Spanish support
- Create contexts and sessions tutorial documentation
- Fix broken Warp sponsorship image URL
- Add locale detection from environment variables
- Update VSCode settings with new dictionary words
- Exclude VSCode settings from version workflows
- Update pattern descriptions and explanations
- Add comprehensive i18n test coverage
• Update ollama package to version 0.11.7
• Refresh go.sum with new dependency checksums
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-0317](https://nvd.nist.gov/vuln/detail/CVE-2025-0317)
- **CVSS Score**: 7.5 (High)
- **Description**: A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service (DoS) attack.
- **Affected**: Ollama server versions ≤ 0.3.14
- **Impact**: Denial of Service through division by zero error
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-0315](https://nvd.nist.gov/vuln/detail/CVE-2025-0315)
- **CVSS Score**: 7.5 (High)
- **Description**: Vulnerability allows Denial of Service via customized GGUF model file upload on Ollama server.
- **Affected**: Ollama/ollama versions ≤ 0.3.14
- **Impact**: Denial of Service through malicious GGUF model file uploads
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-12886](https://nvd.nist.gov/vuln/detail/CVE-2024-12886)
- **CVSS Score**: 7.5 (High)
- **Description**: An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing.
- **Affected**: Ollama server version 0.3.14
- **Impact**: Denial of Service through memory exhaustion via gzip bomb attack
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-8063](https://nvd.nist.gov/vuln/detail/CVE-2024-8063)
- **CVSS Score**: 7.5 (High)
- **Description**: Security vulnerability with high severity rating
- **Impact**: Requires patching for security compliance
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-12055](https://nvd.nist.gov/vuln/detail/CVE-2024-12055)
- **CVSS Score**: 7.5 (High)
- **Description**: High-severity security vulnerability requiring immediate attention
- **Impact**: Critical security flaw needing remediation
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-51471](https://nvd.nist.gov/vuln/detail/CVE-2025-51471)
- **CVSS Score**: 6.9 (Medium)
- **Description**: Medium severity security vulnerability
- **Impact**: Security risk requiring patching as part of comprehensive security updates
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-46394](https://nvd.nist.gov/vuln/detail/CVE-2025-46394)
- **CVSS Score**: 3.2 (Low)
- **Description**: Low-severity security issue
- **Impact**: Minor security concern addressed as part of comprehensive security maintenance
- **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-58251](https://nvd.nist.gov/vuln/detail/CVE-2024-58251)
- **CVSS Score**: 2.5 (Low)
- **Description**: Low-severity security vulnerability
- **Impact**: Minimal security risk addressed for comprehensive security posture
This comprehensive security fix addresses **8 CVEs** total:
- **5 High Severity** vulnerabilities (CVSS 7.5)
- **1 Medium Severity** vulnerability (CVSS 6.9)
- **2 Low Severity** vulnerabilities (CVSS 3.2 and 2.5)
The majority of high-severity issues are related to **Ollama server vulnerabilities** that could lead to Denial of Service attacks through various vectors including division by zero errors, memory exhaustion, and malicious file uploads. These fixes ensure robust protection against these attack vectors and maintain system availability.
**Priority**: The high-severity Ollama vulnerabilities should be considered critical for any systems running Ollama server components, as they can lead to service disruption and potential system crashes.
## CHANGES
- Upgrade anthropic-sdk-go from v1.7.0 to v1.9.1
- Upgrade golang.org/x/crypto from v0.39.0 to v0.40.0
- Add modelBetas map for beta feature configuration
- Implement context-1m-2025-08-07 beta for Claude Sonnet 4
- Add beta header support in streaming requests
- Add beta header support in standard requests
- Implement fallback mechanism when beta features fail
- Preserve existing beta headers in OAuth transport
- Add test coverage for model beta configuration
CHANGES
- Add -V/--vendor flag to specify model vendor
- Implement vendor-aware model resolution and availability validation
- Warn on ambiguous models; suggest --vendor to disambiguate
- Update bash, zsh, fish completions with vendor suggestions
- Extend --listmodels to print vendor|model when interactive
- Add VendorsModels.PrintWithVendor; sort vendors and models alphabetically
- Pass vendor through API; update server chat handler
- Standardize docs and errors to --yt-dlp-args="..." syntax
- Add test covering ambiguous model warning across multiple vendors
- Promote go-shellquote to direct dependency in go.mod
## CHANGES
- Upgrade anthropic-sdk-go from v1.4.0 to v1.7.0
- Move changelog generation to separate workflow job
- Add Claude Opus 4.1 model support
- Fix temperature/topP parameter conflict for models
- Separate release artifact upload from changelog update
- Add dedicated update_release_notes job configuration
## CHANGES
- Replace deprecated generative-ai-go with google.golang.org/genai library
- Add TTS model detection and audio output validation
- Implement WAV file generation for TTS audio responses
- Add audio format checking utilities in CLI output
- Update Gemini client to support streaming with new SDK
- Add "Kore" and "subchunk" to VSCode spell checker dictionary
- Remove extra blank line from changelog formatting
- Update dependency imports and remove unused packages
## CHANGES
- Add high-performance Go changelog generator with GraphQL integration
- Implement SQLite-based persistent caching for incremental updates
- Create one-pass git history walking algorithm with concurrent processing
- Add comprehensive CLI with cobra framework and tag-based caching
- Integrate AI summarization using Fabric CLI for enhanced output
- Support batch PR fetching with GitHub Search API optimization
- Add VSCode configuration with spell checking and markdown linting
- Include extensive documentation with PRD and README files
- Implement commit-PR mapping for lightning-fast git operations
- Add content hashing for change detection and cache optimization
- Move golang.org/x/oauth2 from indirect to direct dependency
- Add OAuth login option for Anthropic client
- Implement PKCE OAuth flow with browser integration
- Add custom HTTP transport for OAuth Bearer tokens
- Support both API key and OAuth authentication methods
- Add Claude Code system message for OAuth sessions
- Update REST API to handle OAuth tokens
- Improve environment variable name sanitization with regex
### CHANGES
- Introduce local `chat` package for message abstraction
- Replace sashabaranov/go-openai with official openai-go SDK
- Update OpenAI, Azure, and Exolab plugins for new client
- Refactor all AI providers to use internal chat types
- Decouple codebase from third-party AI provider structs
- Replace deprecated `ioutil` functions with `os` equivalents
## CHANGES
- feat: Add `MaxTokens` field to `ChatOptions` struct for response control
- feat: Integrate Perplexity client into core plugin registry initialization
- build: Add perplexity-go/v2 dependency to enable API interactions
- feat: Implement stream handling in Perpexlty client using sync.WaitGroup
- fix: Correct parameter types for penalty options in API requests
## LINKS
<https://github.com/sgaunet/perlexipty-go> - Client library used
CHANGES
- Upgrade `anthropic-sdk-go` dependency to version `v1.2.0`.
- Integrate new Anthropic Claude 4 Opus and Sonnet models.
- Remove deprecated Claude 2.0 and 2.1 models from list.
- Adjust model type casting for `anthropic-sdk-go v1.2.0` compatibility.
- Refresh README: announce Claude 4, update date, fix links.
Update Go version across Dockerfile, Nix configurations, and Go modules.
Refresh dependencies and Nix flake inputs.
CHANGES:
* Update Go version to 1.24.2 in Dockerfile.
* Set Go version to 1.24.0 and toolchain to 1.24.2.
* Refresh Go module dependencies and sums (go.mod, go.sum).
* Update Nix flake lock file inputs.
* Configure Nix environment and packages for Go 1.24.
* Update gomod2nix lock file with dependency hashes.
* Use Go 1.24 in Nix development shell environment.
## CHANGES
- Upgrade Anthropic SDK from alpha.11 to beta.3
- Update API endpoint from v1 to v2
- Replace anthropic.F() with direct assignment
- Replace anthropic.F() with anthropic.Opt() for optional params
- Simplify event delta handling in streaming
- Change client type from pointer to value type
- Update comment with SDK changelog reference
Bumps the go_modules group with 1 update in the / directory: [golang.org/x/net](https://github.com/golang/net).
Updates `golang.org/x/net` from 0.36.0 to 0.38.0
- [Commits](https://github.com/golang/net/compare/v0.36.0...v0.38.0)
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.38.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <support@github.com>
