Changelog

1.1.2 - 2026-10-30

• Upgrade golang.org/x/net to 0.62.0, with its required transitive module updates, to address GO-2026-6860 and GO-2026-6866 reported in Grafana review ticket 240360.
• Check every backend executable at module level before release so a dependency warning cannot be overlooked solely because source reachability analysis passes.
• Preserve the existing provider behavior, configuration contract, Go toolchain, and Grafana SDK. The companion panel remains at 1.1.1; existing signed release artifacts are unchanged.

1.1.1 - 2026-10-30

• Prepare the first public-signed release following Grafana's review, preserving the reviewed 1.1.0 functionality and dependency versions.
• Require the signing token and public-signing gate before release builds, and a signed manifest in the exact release archive before publication.
• Retain checksum, source-tag provenance, and full Grafana plugin validation. Existing unsigned 1.1.0 release artifacts remain unchanged.

1.1.0 - 2026-10-26

• Clearly label the provisioned demo instance and show a mock warning with separate real-provider setup instructions. The fixture marker does not change backend request or credential policies.
• Added administrator-controlled image analysis, disabled by default, with explicit vision-model approval and strict PNG/JPEG, payload, dimension, pixel, rate, and concurrency limits.
• Added a local capabilities endpoint for companion panels and typed, validated image attachments without accepting remote image URLs or exposing provider credentials.
• Added Open WebUI and Grafana LLM app provider profiles. Grafana LLM uses a securely stored service-account token and the app's base/large aliases.
• Added a preview Copilot Studio Direct Line profile using a securely stored channel secret, approved public regional endpoints, and a fail-closed correlated completion contract. It does not implement end-user SSO or enforce model generation controls.
• Added non-cacheable, JSON-only resource responses and sanitized image, payload, provider, and timeout errors.
• Updated configuration, image privacy, provider, troubleshooting, and companion-panel documentation.
• Hold concurrency slots until upstream response bodies are closed, including slow query and model-discovery responses.
• Patch the development signing dependency and host-external Moment dependency; retain the documented moderate React Router advisory assessment.
• Update the backend to Go 1.26.10 and x/net 0.60.0 to remediate newly reported reachable standard-library and HTTP/2 vulnerabilities.

1.0.1 - 2026-09-27

• Reworked the packaged catalog overview around the Intelligence Gateway companion workflow, with real assessment imagery and documentation/support links.
• Clarified side-by-side plugin installation, same-organization instance setup, and separate query-data and AI-provider connections.
• Made local ZIP filenames follow built plugin metadata and added preflight validation plus automated packaging tests.
• Restricted model discovery to permitted IDs and removed provider-specific metadata. Empty allow-lists now permit only the configured default; nonempty lists must include it.
• Removed unused OAuth client-secret and streaming controls. Legacy values are ignored and streaming requests are rejected. The explicit insecure-HTTP override remains supported.
• Replaced the provider dropdown with a three-option radio group to avoid a configuration-editor crash when changing providers on older supported Grafana versions.
• Patched frontend dependencies while retaining React 18 compatibility. See docs/RELEASE_VALIDATION.md for the remaining host-external router advisory assessment.
• Updated the backend build toolchain to Go 1.26.8 and Grafana's Go SDK to 0.296.5 to address reachable standard-library and gRPC vulnerabilities.

Upgrade note: list additional model IDs explicitly if your 1.0.0 installation relied on an empty allow-list accepting any model. Authentication remains API key or bearer token. This is an unsigned catalog-review build, not Grafana approval or certification.

1.0.0 - 2026-08-12

• Initial secure backend data-source implementation.
• Added encrypted API key, bearer token, and reserved OAuth client-secret configuration.
• Added OpenAI, LM Studio, and custom OpenAI-compatible provider policies.
• Added model discovery, chat-completions/analyze resources, and a query-to-answer data frame path.
• Added server-side host, TLS, redirect, model, token, timeout, body-size, concurrency, rate, and error-redaction controls.
• Added an administrator-controlled allowInsecureHttp override for organizational provider networks that cannot be classified by hostname or IP range.
• Added a deterministic provisioned review environment, catalog screenshots, release provenance, and submission-readiness documentation.