chore: bump bifrost/core to v1.7.15

[huang195]

Summary

Supersedes #830, which proposed v1.8.4. This takes v1.7.15 instead — the last release that does not force a Go toolchain migration.

Why #830 fails

bifrost v1.8.0 raised its own go directive to 1.27.0. Go propagates that into every module in the workspace, so Dependabot's PR rewrote go 1.26.5 → go 1.27.0 in all seven go.mod files while authbridge/go.work stayed at 1.26.5:

go: module . listed in go.work file requires go >= 1.27.0,
    but go.work lists go 1.26.5

That also explains the odd file list on #830 — seven go.mod edits but only three matching go.sum, because most modules changed only their go directive.

Why v1.7.15

bifrost/core	go directive
v1.7.13 (current)	go 1.26.5
v1.7.14, v1.7.15	go 1.26.5
v1.8.0 → v1.8.4	go 1.27.0

The requirement arrives at v1.8.0, so v1.7.15 gets two patch releases with zero toolchain change. Dependabot only ever proposes the newest version, so this middle ground was never surfaced.

What adopting v1.8.x would actually cost

Not the one-line go.work bump it looks like:

• authbridge/go.work → 1.27.0
• four digest-pinned golang:1.26-alpine builders in cmd/authbridge-{envoy,proxy,praxis,cpex}/Dockerfile → 1.27 plus new digests. Those stages set GOWORK=off but not GOTOOLCHAIN, so they would not fail — they would silently download the 1.27 toolchain mid-build and ship images where a pinned 1.26 base bootstraps an unpinned 1.27. Worse than a clean failure.
• every developer moves to Go 1.27.0, roughly a month old at time of writing

CI itself is fine either way; it reads go-version-file: authbridge/authlib/go.mod.

And it buys nothing today. authlib touches exactly three bifrost symbols — bschemas.ModelProvider, bschemas.Anthropic, bschemas.OpenAI — in one six-line function in plugins/contextguru/plugin.go:

func providerFor(path string) bschemas.ModelProvider {
	if strings.HasSuffix(path, "/v1/messages") {
		return bschemas.Anthropic
	}
	return bschemas.OpenAI
}

Nothing in bifrost 1.8 is reachable from our code, and #830 carries no security label.

Good news for later

The code side of v1.8.x is already clear. I built and tested v1.8.4 locally with go.work at 1.27.0: it compiles and the full authlib suite passes. There is no API break waiting — whenever the Go 1.27 move happens deliberately, it is purely a toolchain exercise.

Verification

• every module's go directive and go.work unchanged at 1.26.5 (confirmed explicitly, since that is the whole point)
• go build ./... && go vet ./... for every authbridge module: pass (all but cmd/authbridge-cpex, which has no packages without -tags cpex and cannot link locally without libcpex_ffi)
• go test ./... across authlib: pass, 48 packages
• cmd/* go.sum files tidied by hand, mirroring dependabot-tidy.yml — that workflow is gated on if: github.actor == 'dependabot[bot]' and will not run on this branch

Diff is 6 files, 9 insertions, 9 deletions: pure version bump in the three modules that reference bifrost.

Companion change: #838 gates >=1.8.0 in .github/dependabot.yml so v1.8.x is not re-proposed weekly while 1.7.x patches keep flowing.

Closes #830

Assisted-By: Claude Code

Summary by CodeRabbit

• Maintenance
  • Updated the Bifrost core component to version 1.7.15 across Authbridge modules.
  • Ensures all related Authbridge components use the same updated core version.

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 278ac35e-2414-4458-a794-810afd837960

📥 Commits

Reviewing files that changed from the base of the PR and between 1dc7aa1 and c4493ba.

⛔ Files ignored due to path filters (3)

• authbridge/authlib/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-envoy/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-proxy/go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• authbridge/authlib/go.mod
• authbridge/cmd/authbridge-envoy/go.mod
• authbridge/cmd/authbridge-proxy/go.mod

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: d93ceaa6-578d-4d27-9ca9-0f68eba31a70

📥 Commits

Reviewing files that changed from the base of the PR and between 89bee37 and 1dc7aa1.

⛔ Files ignored due to path filters (3)

• authbridge/authlib/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-envoy/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-proxy/go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• authbridge/authlib/go.mod
• authbridge/cmd/authbridge-envoy/go.mod
• authbridge/cmd/authbridge-proxy/go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Updated github.com/maximhq/bifrost/core from v1.7.13 to v1.7.15 in the Authbridge library, Envoy, and proxy Go modules.

Changes

Bifrost core dependency upgrade

Layer / File(s)	Summary
Update Bifrost core module requirements authbridge/authlib/go.mod, authbridge/cmd/authbridge-envoy/go.mod, authbridge/cmd/authbridge-proxy/go.mod	The three Go modules now reference Bifrost core v1.7.15 instead of v1.7.13.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 1dc7a

This PR updates bifrost/core from v1.7.13 to v1.7.15 without changing the Go toolchain or application behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: araujof, evaline-ju

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR does not satisfy issue #830. It upgrades bifrost/core to v1.7.15 instead of the required v1.8.4, so it does not incorporate the specified upstream fixes for encrypted reasoning signatures and A…	Upgrade github.com/maximhq/bifrost/core to v1.8.4 and address the required Go, workspace, builder, toolchain, dependency, and API compatibility changes. Verify that the specified upstream fixes are included. Alternatively, update the linked…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: upgrading bifrost/core to v1.7.15.
Out of Scope Changes check	✅ Passed	The reviewed changes only update github.com/maximhq/bifrost/core in the three modules that reference it. The changes are related to the dependency-upgrade objective and contain no unrelated code chang…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The PR does not satisfy issue #830. It upgrades bifrost/core to v1.7.15 instead of the required v1.8.4, so it does not incorporate the specified upstream fixes for encrypted reasoning signatures and Anthropic raw-body passthrough.

Resolution

Upgrade github.com/maximhq/bifrost/core to v1.8.4 and address the required Go, workspace, builder, toolchain, dependency, and API compatibility changes. Verify that the specified upstream fixes are included. Alternatively, update the linked issue to reflect the intentionally reduced v1.7.15 scope.

Full details: Out of Scope Changes check

Explanation

The reviewed changes only update github.com/maximhq/bifrost/core in the three modules that reference it. The changes are related to the dependency-upgrade objective and contain no unrelated code changes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch chore/bifrost-1.7.15

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bifrost-1.7.15

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mrsabath]

Clean, single-purpose patch bump of github.com/maximhq/bifrost/core v1.7.13 → v1.7.15 across the three authbridge modules that reference it. 6 files, 9/9 insert/delete, no go directive change.

Verified every load-bearing claim against authoritative sources:

Claim	Source	Result
v1.7.15 module hash h1:LOq+…uUv4=	sum.golang.org	✅ exact match
v1.7.15 /go.mod hash h1:XQGQ99…WEDI=	sum.golang.org	✅ match — genuinely identical to v1.7.13 (go.mod unchanged, not a copy-paste artifact)
v1.7.15 go directive is 1.26.5	proxy.golang.org .mod	✅ confirmed — the premise for preferring v1.7.15 over v1.8.x holds
v1.7.13 hashes on removed lines	sum.golang.org	✅ match
Only reachable bifrost symbols: ModelProvider, Anthropic, OpenAI	contextguru/plugin.go @ head	✅ confirmed, one file

Each go.sum swaps exactly the two v1.7.13 lines for the correct v1.7.15 lines — nothing else moves. Splitting the dependabot.yml >=1.8.0 gate into companion #838 keeps this PR focused. The v1.8.x analysis in the description (silent 1.27 toolchain download in the GOWORK=off but GOTOOLCHAIN-unset Dockerfile stages) is a sharp catch and a good reason to defer that move to a deliberate one.

CI green (DCO, CodeRabbit, add-to-project). No blocking issues, no inline comments. 一步一个脚印 — one solid step at a time. LGTM.