BullSequana AI 1.2.1

← All release notes

Released: August 6, 2026

Executive summary

This is a patch release on top of 1.2.0. API keys now work as standard Authorization: Bearer tokens through the platform gateway, so OpenAI-compatible tools and SDKs connect without workarounds, and the updated BSQAI API backend delivers the Anthropic Messages API and streaming model downloads. LiteLLM gains a 600-second request budget for long generations, Redis-backed response and authentication caching, and high-availability hardening. Kubeflow default pipelines and MLflow notebook credentials are fixed for all profile namespaces. The BSQAI API backend is updated to 1.2.9 and the portal to 1.2.3.

Fixes & improvements

• API keys as Bearer tokens through the gateway: requests carrying a BSQAI API key as Authorization: Bearer sk-bsq-... are now routed past gateway-level JWT validation and authenticated by the BSQAI API itself. Previously the gateway rejected these requests with Jwt is not in the form of Header.Payload.Signature before they reached the backend, which is why 1.2.0 recommended the X-Api-Key header for clients behind the gateway. That workaround is no longer required: OpenAI-compatible SDKs and tools that hardcode the Authorization: Bearer header now work natively. X-Api-Key remains fully supported. Invalid or malformed keys are still rejected by the backend, and JWT validation at the gateway is unchanged for all other bearer tokens. See Use local models via API.

• API keys accepted in the interactive API docs: the Swagger (/docs) and Scalar (/scalar) UIs now authenticate correctly with BSQAI API keys, and the X-Api-Key security scheme resolves on WebSocket routes in the generated API documentation.

• Anthropic Messages API compatibility: the BSQAI API now serves an Anthropic-compatible endpoint at /anthropic. Tools that speak the Anthropic wire format, such as Claude Code and the Anthropic SDK, can use platform-hosted models with platform authentication. No Anthropic account is required. The endpoint supports streaming and non-streaming turns, model and agent configuration resolution, token counting, and a per-user model catalogue. See Claude Code.

• Streaming model downloads: model installer downloads from Hugging Face and S3-compatible storage now stream directly to the destination instead of buffering the full artifact in memory. This reduces memory pressure and improves reliability for large model imports.

• LiteLLM reliability and performance: LiteLLM is upgraded to 1.89.4 (mirrored in the private registry) with several operational fixes:

  • Gateway route and proxy request timeouts are raised to 600 seconds, so long generations and streaming responses are no longer cut off mid-request by the previous short gateway timeout.
  • A Redis instance now backs a response cache and a shared authentication cache, keeping virtual-key state consistent across workers and replicas.
  • Worker count is pinned per pod instead of derived from node cores, preventing CPU oversubscription on large nodes.
  • Replicas spread across nodes, health probes are defined for startup, liveness, and readiness, and failed upstream calls retry up to three times.

• Kubeflow default pipeline and MLflow notebook credentials: expanded Kyverno policies now generate the MLflow notebook credentials (secret and PodDefault), registry pull-secret PodDefault, pipeline S3 credentials, per-profile MLflow provisioning job, and scoped RBAC in every profile namespace, including both existing namespaces and newly created profiles. This fixes the default Kubeflow pipeline failing to run and notebooks failing with a missing MLflow secret.

• Reranker model mode: reranker models are now recognized as a dedicated rerank model mode across the backend model catalogue and the portal, fixing reranker model selection in Global Configuration.

• Self-contained backend image builds: the backend container image now builds without internet access and multi-architecture image builds are fixed, supporting offline and air-gapped delivery pipelines.

• Security patches: the backend 1.2.9 image patches CVE-2026-69244, CVE-2026-69247, CVE-2026-69249, and GHSA-3f7w-8rr8-f37f; the portal 1.2.3 image patches Next.js and PostCSS dependency vulnerabilities.

• BSQAI API backend 1.2.9: the release moves the backend from 1.2.5 to 1.2.9, which carries the API-key authentication paths, the Anthropic Messages API, streaming model downloads, the reranker model mode, and the build and security fixes above.

• CoreAI Web Portal 1.2.3: carries the reranker model mode fix and the dependency security patches above.

• Speech-to-text GPU model corrected: the default GPU Whisper model is now deepdml/faster-whisper-large-v3-turbo-ct2, a CTranslate2 build compatible with FasterWhisper. The previous default referenced a model artifact the GPU speech server could not load.

• Platform CLI: optional temp-file retention: setting CLEANUP_TEMPORARY_FILES=false keeps the rendered Helm values files and the cloned GitOps repository directory after a run for debugging. Cleanup remains the default. See Platform CLI.

Platform deployment changes

• New litellm-redis StatefulSet: the litellm namespace gains a Redis StatefulSet with a persistent volume and a generated connection secret. Argo CD is configured to ignore server-side-apply drift on its volumeClaimTemplates.
• New API-key HTTPRoute: the BSQAI API gateway configuration adds a dedicated HTTPRoute matching Authorization: Bearer sk-bsq-* requests, covered by a CORS-only security policy instead of the JWT policy.
• No manual migration steps are required. Deployments pick up the changes through the standard render and GitOps sync flow.

API updates

No breaking changes in this release.

Authentication: API keys in the Authorization: Bearer header

API keys are now accepted through the gateway in both header styles:

Authorization: Bearer sk-bsq-v1-<key>
X-Api-Key: sk-bsq-v1-<key>

In 1.2.0, only X-Api-Key worked for clients calling through the platform gateway. As of 1.2.1 both forms are equivalent end to end; when both headers are present, X-Api-Key still takes precedence. WebSocket connections continue to use the token query parameter.

Anthropic Messages API

A new Anthropic-compatible API surface is available at /anthropic.

Authentication uses the same X-Api-Key or Authorization: Bearer headers as the main API. Model ids must use the claude-model-<name> or claude-agent-<uuid> prefix for Claude Code compatibility. Direct SDK and curl callers may also use bare model names.

The models endpoint is scoped per user: agent configurations the caller cannot access are not listed, and requesting one returns 404 rather than 403.

See Claude Code for configuration and usage.

Documentation updates