What's Changed
- test(ui): stop forced click from skipping audit log export submit by @thedadams in #8364
- fix(mcp): reuse configured base image for Docker setup containers by @calvinmclean in #8350
- fix: fix tests with unaccounted for mock handlers & errors by @ivyjeong13 in #8365
- Docs/versioned agent exports by @cloudnautique in #8369
- fix(mcp-tester): expose raw responses in error details by @calvinmclean in #8368
- fix(mcp): reconnect filter sessions after server restarts by @thedadams in #8378
- enhance: delay first upgrade check and product telemetry report until 30 minutes after startup by @cjellick in #8373
- fix: resolve a number of trivy-reported issues by @drpebcak in #8382
- fix(claude): remove crashed executions so their sessions can continue by @thedadams in #8383
- enhance: move local auth user management to users pages by @ivyjeong13 in #8372
- feat: add OneLogin auth provider by @g-linville in #8330
- fix: fall back to the registered Community license on delete by @njhale in #8375
- chore: bump ui & docs packages by @ivyjeong13 in #8379
- feat(registry): expose vMCPs with opt-in anonymous access by @calvinmclean in #8296
- chore: dependabot ui/docs packages bump qs/dompurify by @ivyjeong13 in #8386
- fix(oauth): check MCP access when exchanging an authorization code by @cjellick in #8380
- fix: update test for new parameter type by @thedadams in #8390
- fix: capture oauth request id for authz by @thedadams in #8388
- fix: Okta scim: ensure base URL has trailing slash by @g-linville in #8394
- fix(mcp): recover shared client sessions after server restarts by @thedadams in #8389
- chore(ci): add i18n linting by @calvinmclean in #8381
- fix: support 401/403 for any MCP request by @thedadams in #8385
- test(vmcps): split the configuration policy test to stop timeouts by @njhale in #8404
- chore(ci): cache golangci-lint results and drop redundant gofmt by @thedadams in #8403
- feat: list and remove enrolled devices on the Devices tab by @njhale in #8399
- chore: add doc describing mcp-images maintenance process by @drpebcak in #8401
- fix: allow scheduling updates without a vMCP connection by @thedadams in #8407
- fix: refuse sessions of deleted users instead of recreating them by @g-linville in #8408
- chore: mock/drop animations during ui test runs by @ivyjeong13 in #8406
- fix(ui): resume MCP client login when upstream OAuth completes by @cloudnautique in #8410
- fix: sanitize fallback sign-out redirects by @thedadams in #8411
- chore: dependabot/audit ui/docs bumps by @ivyjeong13 in #8412
- fix: update complete.svelte.spec.ts by @ivyjeong13 in #8416
- fix(docs): serve root llms-full.txt and label .md 404s as HTML by @cloudnautique in #8414
- fix: stop unused Bifrost A2A gateway to prevent idle goroutine leaks by @thedadams in #8421
- chore: remove leftover published artifacts references by @g-linville in #8426
- fix: discard MCP audit entries when encryption fails by @thedadams in #8424
- Stop draining failed requests by @thedadams in #8425
- fix: remember vmcp card/table state via localstorage by @ivyjeong13 in #8413
- fix: retain egress audit records and batch recovery by @thedadams in #8431
- feat: add Keycloak authentication provider by @cloudnautique in #8395
- Properly cleanup vMCPs after user access changes by @thedadams in #8428
- chore: remove email-based identity linking and env-configured roles by @g-linville in #8415
- chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 in the go_modules group across 1 directory by @dependabot[bot] in #8437
- chore: fix broken test by @g-linville in #8438
- fix: compare token usage times in UTC by @thedadams in #8436
- Upgrade embedded PostgreSQL to 18 with manual migration guidance by @drpebcak in #8441
- feat(ui): add icons for all model providers by @calvinmclean in #8442
- feat(mcp): add selectable caller attribution headers by @calvinmclean in #8392
- docs: tell admins to clear cookies when recovering from a provider lockout by @g-linville in #8447
- fix: coordinate audit shutdown with a shared deadline by @thedadams in #8433
- fix: allow oauth2 static access through proxy by @ivyjeong13 in #8446
- fix: enforce MCP session ownership by user and connection by @calvinmclean in #8409
- feat: add resource-backed LLM gateway configuration storage by @calvinmclean in #8434
- feat: add support for SCIM for Entra by @g-linville in #8432
- docs: move caller attribution to shared MCP server configuration by @calvinmclean in #8455
- fix: read camelCase provider manifest fields from YAML registry files by @g-linville in #8456
- fix: vmcps long page load fix by @ivyjeong13 in #8422
- fix: flaky test case scimview.spec & vmcps page.svelte.spec by @ivyjeong13 in #8458
- docs: restore MCP server tutorials to the sidebar and add Vercel by @cloudnautique in #8459
- chore: bump mmmcp to v0.2.1 by @thedadams in #8465
- feat: add standalone core LLM engine without subscription passthrough by @calvinmclean in #8454
- fix: keep the Users page usable with thousands of users by @g-linville in #8464
- fix(enforcement): allow Codex's built-in tools by @g-linville in #8463
- ci: raise the golangci-lint timeout to 10m by @g-linville in #8473
- chore: bump default obot-sentry to v0.1.9 by @g-linville in #8472
- docs: document Sentry tool call enforcement limits by @cjellick in #8478
- refactor: run the LLM gateway on llmcore by @calvinmclean in #8469
- docs: remove LLM gateway metrics from user documentation by @calvinmclean in #8479
- feat: clarify model provider authentication setup by @calvinmclean in #8443
Full Changelog: v0.28.0-alpha3...v0.28.0-rc1