chore(deps): bump the go-minor-and-patch group with 5 updates

[dependabot]

Bumps the go-minor-and-patch group with 5 updates:

Package	From	To
github.com/maximhq/bifrost/core	1.8.4	1.8.6
golang.org/x/crypto	0.56.0	0.57.0
golang.org/x/net	0.58.0	0.59.0
golang.org/x/sys	0.47.0	0.48.0
golang.org/x/text	0.41.0	0.42.0

Updates github.com/maximhq/bifrost/core from 1.8.4 to 1.8.6

Release notes

Sourced from github.com/maximhq/bifrost/core's releases.

Core v1.8.6

Core Release v1.8.6

[fix]: preserve documents in Bedrock tool results @​michaeldunn9

• feat: Claude Cowork proxy support: claude-cowork user agents resolve to the Claude Cowork app, and Anthropic text documents sent as base64 data URLs (text/*, JSON) are decoded into text document sources on the chat and Responses paths (#7012)
• fix: CheckFirstStreamChunkForError observes the request context while waiting for the first chunk, returning 499 on cancel and 504 on deadline instead of blocking the worker until the stream idle timeout (#6993)

Installation

go get github.com/maximhq/bifrost/core@v1.8.6

---

This release was automatically created from version file: core/version

Core v1.8.5

Core Release v1.8.5

• fix: map forced tool choice any to required on OpenAI Responses and Chat egress (#6887) @​Atharva-Kanherkar
• [fix]: preserve max reasoning effort for GPT-6 Astra @​nettee
• fix: give a Bedrock message a placeholder text block instead of a null content field when it has no text and no tool calls - BedrockMessage.Content has no omitempty, so a message with empty text and no tool calls (or an empty tool_calls array) serialized as content:null, which Converse rejects with "Member must not be null" (#2765)
• [fix]: marshal required nullable response fields as null @​PSR94
• fix: accept top-level arrays from OpenAI-compatible model APIs @​dani29
• feat: add Baseten to Hugging Face inference provider discovery @​nicolastoulemont
• fix: strip the encrypted reasoning signature when the upstream reports the field as unsupported (e.g. Bedrock Converse replaying a Claude signature onto a non-Anthropic model after a mid-conversation model switch), extending the existing unverifiable-signature fail-soft
• fix: clear Anthropic raw-body passthrough based on the resolved provider and model pair, so non-Claude models on multi-family providers (Vertex, Azure, Bedrock Mantle) convert the request instead of passing the Anthropic payload through
• feat: optionally synthesize prompt-cache breakpoints for requests that carry none, so agentic clients that emit no cache markers (Codex and similar) stop paying the cache-write rate on every turn; off by default per provider via prompt_cache.auto_inject, with cache_control_injection_points for role/index targeting, and extended to translate the marker into prompt_cache_breakpoint plus explicit cache mode on the gpt-5.6 family
• fix: drop unsigned reasoning blocks from Bedrock Converse replays to Claude, which verifies the thinking signature and rejects a block without one in every serialisation; Nova and MiniMax keep receiving unsigned blocks with the field omitted. Gated on a new datasheet capability bedrock_requires_signed_reasoning with an Anthropic-family fallback (#6624)
• fix: render reasoning the upstream actually returned on Bedrock Converse-shaped responses (/bedrock converse and the framework drop-ins that reuse it): a native Grok or OpenAI reasoning summary with no encrypted content was resolved through the request-direction redacted shape and silently dropped, so clients saw text only; the response direction now emits reasoningText for exposed text and keeps redactedContent for opaque blocks, while replays to Bedrock are unchanged @​akshaydeo
• feat: add Databricks as a first-class provider covering Model Serving and Unity AI Gateway with PAT or OAuth M2M auth, per-model parameter sanitization from datasheet capabilities, Claude reasoning translation, remote image inlining, Responses-to-chat fallback and surfaced upstream errors (#6665, #6676, #6770, #6958)
• feat: add GitHub Copilot provider that mints installation tokens server-to-server from GitHub App credentials, with chat completions, Responses and list models (#6352, #6353, #6356)
• feat: add virtual MCP server support, endpoint slugs for direct MCP servers, and config.json wiring for mcp.virtual_mcps (#6746, #6791, #6904)
• feat: add the project governance dimension to request context, schemas and log payloads (#6702, #6705)
• feat: settle per-request identity onto a grant at context conversion and rename AllowOnAllVirtualKeys to AllowByDefault with backward-compatible wire aliases (#6306, #6307, #6308, #6641, #6642, #6649)
• feat: add allow_all_providers to virtual key schemas (#6662)
• feat: add semantic complexity routing contracts, vector store and embedding executor, LLM classifier fallback, session-aware routing and the 750-phrase limit; rename BifrostCacheDebug, BifrostGuardrailDebug and BifrostRoutingDebug to *Metadata with type aliases, and rename the routing_debug field to routing_metadata (#6164, #6166, #6177, #6317, #6722, #6727)
• feat: support native raw request redaction for Anthropic and Gemini passthrough and add RawStreamTextCodec with a paused buffer transform for native SSE redaction (#6365, #6386)
• feat: route Azure DeepSeek Responses requests from coding harnesses to chat completions, fall back for models without a Responses endpoint, and gate it on compat.azure_deepseek (#6326, #6737)
• feat: split converter processing into individual span buckets and add the overhead spans export toggle (#6588, #6945)
• feat: persist the served model from the provider response (#6693)
• feat: record MCPConnectionFailure on client state (#6794)
• feat: remove the plugin version field in favour of hash-based reconciliation (#6250)
• fix: patch fasthttp to remove races when closing streams, drain abandoned streams so upstream connections return to the pool, terminate streams that send only heartbeats after usage, and add does_not_send_done_marker for custom providers (#6799, #6802, #6948, #6960)
• fix: alias assistant reasoning_content for Groq and Cerebras instead of stripping it (#6949)
• fix: populate summary_index, summary text and signatures on reasoning_summary_* stream events for Anthropic, Bedrock and Gemini (#6902)
• fix: derive chat finish_reason from the Responses terminal state and incomplete details (#6901)
• fix: emit proper terminal events for Anthropic response.incomplete and response.failed instead of truncating, and synthesize a missing terminal text suffix from output_text.done (#6159, #6805)
• fix: route Anthropic-on-Vertex passthrough usage and stream terminal detection through the Anthropic parsers (#6639)
• fix: remove raw body passthrough when the provider does not support the output config format (#6798)

... (truncated)

Commits

• 4c22668 fixes package.json for integration test for 7day check (#7030) --skip-core-test
• 3d5ddfc fixes package.json for integration test for 7day check
• e0c8e2a chore: regenerate openapi.json --skip-ci
• 833f86b v2.1.1 (#7029) --skip-core-test
• 8c4fbc6 changelog update
• f9a6d85 test fixes and closes #6974 (#6993)
• 88abbac version bump (#7028)
• 5e39092 claude cowork proxy support (#7012)
• 287f438 feat: add overhead exports functionality to telemetry and otel metric exporte...
• 2124495 fix: vk UI for managed keys (#7025)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.56.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/net from 0.58.0 to 0.59.0

Commits

• 540d04c go.mod: update golang.org/x dependencies
• 20eef7f quic: clear fast-path receive buffer on stream reset
• c23af1b internal/http3: fix compilation error due to missed symbol name update
• eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
• 12e0501 internal/http3: server header size limits
• d89285e quic: add Stream.StopSending, and rework stream/application errors
• d34deae quic: ensure Endpoint.Close waits for connection loops to exit
• 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
• b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
• 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
• Additional commits viewable in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

• 613e257 cpu: add riscv64 hwprobe drift test
• 6f7b10f unix: add MLOCK_ONFAULT constant
• 663e7c8 cpu: add basic support for GOARCH=sparc64
• de5f12f cpu: add ppc64le POWER10 detection
• 80e8acf unix: run go fix
• 1e3c182 unix: add IPMI interface
• d429e20 unix: stop generating sparc termbits from the generic header
• bd3bddf unix: add missing HWTSTAMP_* constants
• e812f53 windows: add SO_SNDTIMEO constant for socket options
• f6989c5 unix: align Ifreq so its union accessors cannot fault
• Additional commits viewable in compare view

Updates golang.org/x/text from 0.41.0 to 0.42.0

Commits

• fafe4a0 go.mod: update golang.org/x dependencies
• f53c316 unicode/norm: don't truncate runes in the recomposition map key
• 37867f6 unicode/norm: let any starter block composition in compose
• 0dd525f unicode/norm: compose non-Hangul runes after a Hangul syllable
• bac26e5 unicode/norm: avoid improper ErrShortDst return in Form.transform
• 4f55186 unicode/norm: simplify short source detection in Form.transform
• a1b6c10 unicode/norm: prevent decomposeSegment from moving backwards
• cd1cbc9 unicode/bidi: panic rather than log.Panicf
• a459614 internal/export/idna: fix conformance with optional validation disabled
• be70a61 internal/export/idna: drop trie field from Profiles
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Advanced

Run ID: b4754d03-873c-4a7f-a5a7-54717c87a717

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}