0.121.18 (2026-07-07)
Features
- add Node.js 20 support cutoff campaign (#9862) (d4d35da)
- add per-test repeat option (#9781) (3e1f02b)
- app: surface websocket subprotocols (#9947) (88c7445)
- config: add YAML source location to prompt reference errors (#9940) (5f13e76)
- providers: add Bedrock support for Grok 4.3, GLM, MiniMax, Kimi, Nemotron, Gemma, Palmyra (#9788) (84a274b)
- providers: add Claude Sonnet 5 support across Anthropic, Bedrock, Vertex, and Azure (#9924) (3ea1e71)
- providers: add GPT-5.6 preview support (#9893) (853710f)
- providers: add Moonshot (Kimi) provider (#9672) (47c4def)
- providers: expand Google model support — Nano Banana 2 Lite, GA image aliases, gemini-pro-latest (#9923) (87be4d5)
Bug Fixes
- address GitHub AI findings (#9765) (fd8320a)
- assertions: let contains-sql extract fenced SQL with backtick identifiers (#9785) (f97c932)
- assertions: make is-xml reject non-well-formed XML (#9782) (96929e8)
- assertions: respect inverse for is-refusal when output is missing (#9818) (59898f2)
- assertions: stop is-sql false-rejecting SELECT DISTINCT (#9784) (c08cfc4)
- bleu: return pass:false for empty output instead of throwing (#9841) (9e98c3e)
- ci: re-pin code-scan Node to 24.15.0 to stop install timeout (#9871) (8cc2cbb)
- cloud: stop legacy API_HOST env var from steering cloud host resolution (#9920) (49614da)
- code-scan: run GitHub Action on Node 24 runtime (#9772) (c25974e)
- csv: preserve quoted commas in contains-any/all assertion values (#9761) (ae4a73a)
- csv: preserve zero __threshold in testCaseFromCsvRow (#9768) (7e7f1ae)
- csv: reject __expected0 instead of silently dropping its config (#9815) (5097c23)
- deps: bump pydantic-ai from 1.101.0 to 1.102.0 in /examples/integration-pydantic-ai in the pip group across 1 directory (#9903) (1f2ac90)
- deps: bump pypdf to 6.13.3 in eval-rag-full (#9806) (a432a8d)
- deps: override launch-editor to 2.14.1 (#9883) (e96f32b)
- deps: require hono v4.12.25 (#9777) (c5b397a)
- deps: resolve audit vulnerabilities (#9880) (e55b37b)
- deps: restore LangChain examples (#9778) (fb16af0)
- deps: update anthropic packages (#9817) (fe73e2e)
- deps: update anthropic packages (#9831) (7f1cb4a)
- deps: update anthropic packages (#9904) (63c5a7a)
- deps: update anthropic packages (#9989) (25aa530)
- deps: update anthropic packages to v0.102.0 (#9776) (3e18ecb)
- deps: update dependency @anthropic-ai/sdk to v0.104.2 (#9879) (81adada)
- deps: update dependency csv-parse to v7 (#9870) (83f2ff6)
- deps: update dependency js-yaml to v5 (#9919) (9696a2f)
- deps: update dependency semver to v7.8.3 (#9804) (7a6b199)
- deps: update dependency swiper to v14 (#10005) (e8a929a)
- deps: update opentelemetry (#9827) (f45c2e0)
- deps: update type definitions (#9832) (f545c51)
- init: promptfoo init will print undefined when initializing and selecting redteam as action (#9899) (bfb2ad4)
- providers: apply xAI cache-read discount to cost calculation (#9783) (f273300)
- providers: Azure provider audit — cost reporting, token refresh, doc accuracy (#9794) (7d304ee)
- providers: correct Claude context pricing by platform (#9995) (433d8f5)
- providers: correct Mistral alias pricing drift and refresh models/docs (#9929) (ae04fcc)
- providers: correct stale model pricing (#9951) (4e969db)
- providers: correct watsonx token usage (total omits prompt; completion miscomputed) (#9780) (9056649)
- providers: flatten Moonshot config options (#9803) (f0e87d9)
- providers: support websocket subprotocols (#9944) (ce40d66)
- redteam: remote materialize mcp tool calls (#9935) (ede696e)
- redteam: stop presenting deprecated or invalid prompt-injection ids in tool guidance (#9936) (9a337ab)
- redteam: support Sharp 0.35 (#9823) (92108f0)
- restore Docker CLI links and validate rate-limit reset metadata (#9790) (58e7c83)
- sanitizer: redact malformed token params (#9779) (ad1ad35)
- scheduler: fall back from invalid retry-after-ms (#9796) (81fe447)
- site: declare js-yaml dependency so Cloudflare Pages build resolves v5 (#9957) (65f0f4c)
- testCaseReader: preserve JSONL row description instead of overwriting (#9840) (644e71b)
- ui: preserve WebSocket protocol input (#10002) (ed192d3)
- util: keep ellipsize within maxLen when maxLen is below 3 (#9822) (60939c0)
- util: match JavaScript/TypeScript file extensions case-insensitively (#9799) (9f18d92)
- util: report file and line for malformed JSON/JSONL test files (#9942) (250af9d)
- util: select xlsx sheet by name when name starts with digits (#9932) (ede3302)