live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
releaseAI

Open GenAI Stack 1.5 makes API selection explicit and moves MCP clients to 2.x

The upgrade broadens provider support, but integrators should audit `apis:` configuration and test custom MCP adapters before rollout.

API config changed: omitted key, empty list, and route differences.
AI-generated illustration
By The News Desk· Oct 9, 2026the quick take — two AI hosts go live when you do

Open GenAI Stack 1.5 is not a drop-in upgrade for every deployment. The Oct. 9 release collects 108 commits since 1.4.0, adds MCP 2.x client support and new inference, search and storage integrations, but also changes how the server decides which HTTP APIs to expose.

API configuration now means what it says

The sharpest change is the treatment of apis:. In 1.4, apis: [] was indistinguishable from omitting the key and could expose every API supplied by configured providers. In 1.5, an explicit empty list is authoritative: it serves no provider-backed APIs. Omitting the key still means “serve everything,” while a bare apis: value is treated like an omitted key and produces a startup warning.

Route registration also follows a new three-tier rule. The merged routing change keeps admin, inspect and providers available for stack administration; serves conversations and prompts when they are listed or when responses is enabled; and serves other APIs only when they are listed. A deployment with an explicit list that omits responses must therefore add conversations or prompts if it expects those endpoints. Configurations that include responses, and configurations that omit apis:, retain the previous route surface.

That distinction matters most for gateways and split-service topologies. The project’s test case shows that removing responses from the list also turns off /v1/responses, /v1/conversations and /v1/prompts, while unrelated configured routes remain available. The same change notes that the bundled distributions already include responses, so their HTTP surface did not require configuration edits.

MCP 2.x is supported, with limits

The MCP integration now requires the MCP 2.x client SDK, resolving to 2.2.0 in the release work. OGX migrated its client code to renamed SDK attributes, switched transport exception handling to the SDK’s httpx2 dependency, moved custom headers onto a caller-owned asynchronous client and explicitly maps an HTTP 401 during connection to its authentication-required error.

The project reports end-to-end checks for both SSE and streamable HTTP transports, including server information, tool discovery, invocation, sessions, custom headers and the 401 path. Existing /sse URLs and distribution configurations remain unchanged. The same change explicitly leaves multi-round-trip elicitation, structuredContent, cache TTLs, reserved MCP headers and W3C trace propagation for follow-up work, so “MCP 2.x support” does not yet mean every new SDK capability is implemented.

Upgrade checklist

Before moving from 1.4, integrators should distinguish an omitted apis: key from an empty list, verify every route their gateway expects, and add conversations or prompts explicitly when responses is not exposed. Teams with custom MCP adapters should also test both transports, authentication failures and any code that depends on the old McpError name or httpx exception types. The 1.5 release notes describe 45 additional fixes and new providers, but the configuration and client-SDK transitions are the changes most likely to surface during rollout.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk