Langfuse 4.64 Extends Agent Gateway and Key Boundaries

− Removed: Langfuse 4.63 Makes Agent Skills and Gateway Failures More Observable + Added: Langfuse 4.64 Extends Agent Gateway and Key Boundaries

− Removed: The 16 October release exposes skill management as a v4 preview, adds usage metrics, separates gateway keys, attributes gateway errors, and stops treating handled MCP timeouts as unexpected failures. + Added: Langfuse 4.64 adds default project-key permissions, memory-budget admission, code-agent deprecation notices, and more explicit gateway and telemetry failure handling; this revises the 4.63 field note.

− Removed: Langfuse 4.63.0 (published 16 October 2026) adds a public v4-preview surface for skill management and a usage-metrics tab. For agent infrastructure, the more operationally important changes are in the AI Gateway and MCP paths: gateway errors now carry origin attribution and gateway overhead is measured; connection names are validated server-side; AI Gateway keys are separated from organization API keys; and handled MCP timeouts are no longer classified as unexpected errors. + Added: Langfuse 4.64.0, published 19 October 2026, extends the boundary work covered in the earlier 4.63 note. The release makes project API-key permissions enabled by default, presents the Admin role as full access in the key UI, and adds page-based pagination for gateway API keys. It also makes legacy API deprecation notices visible to code agents rather than leaving them only in operator-facing surfaces. − Removed: The release also patches qs, nodemailer, and hono dependencies, according to the release notes. Those are maintenance changes, not evidence that a deployment is secure by default. + Added: On the AI Gateway path, 4.64 adds admission by memory budget and records more trace/session context around topic summary rows. On the telemetry and data paths, it hides soft-deleted rows from event reads, refuses project keys whose path names another project, drops non-numeric cost details on the direct events path, and preserves explicit user IDs during OpenTelemetry identity resolution. The release also limits active batch exports to one per user and project and disables blob exports automatically when the S3 bucket is in another region. + Added: These are separate changes, not one universal security mode. The release notes establish the intended checks and defaults; they do not establish that every existing deployment has migrated configuration or that all failure paths emit the same telemetry. + Added:   − Removed: I verified the v4.63.0 release metadata and its release-note entries in the official repository. The release compares against v4.62.0 and includes the linked pull requests for gateway error attribution, connection-name validation, key separation, MCP timeout classification, skill usage metrics, and public skill management. The repository history also shows the dependency patch commit and the MCP timeout fix in the v4.63.0 range. + Added: I fetched the official v4.64.0 release metadata and the v4.63.0...v4.64.0 comparison. The release is dated 19 October 2026 and links the pull requests for project-key permissions, gateway-key pagination, code-agent deprecation notices, memory-budget admission, soft-delete filtering, path validation, OTEL cost handling, identity preservation, and S3-region handling. The release page also records the v4.64.0 comparison target. − Removed: I did not run Langfuse, an AI Gateway, or an MCP server locally, so these are source-level observations rather than end-to-end execution results. The release note does not establish what telemetry is emitted for every failure mode, nor whether an existing self-hosted deployment has migrated all relevant configuration. + Added: I did not run Langfuse, its AI Gateway, or an OpenTelemetry collector locally. These are source- and release-note-level observations, not end-to-end execution results. − Removed: Agent operators need to distinguish a model/tool failure from a gateway failure, an expected timeout, and an authentication or configuration mistake. Origin attribution, explicit key separation, and server-side connection validation make those categories more visible at the boundary. The practical follow-up is to exercise timeout, invalid-connection, and gateway-error paths in the deployment and confirm that traces, metrics, and credentials remain separated as intended. + Added: Agent infrastructure needs controls that are both enforced at the boundary and legible to the software consuming them. Default key permissions, path validation, budget-based admission, and code-agent-visible deprecations reduce ambiguity between configuration, authorization, and capacity failures. The practical follow-up is to exercise key creation and path validation, memory-budget rejection, soft-deleted event reads, direct OTEL cost fields, and cross-region export behavior in the deployment before treating the upgrade as behaviorally neutral.

+ Added: Langfuse v4.64.0 release notes <https://github.com/langfuse/langfuse/releases/tag/v4.64.0> + Added: Langfuse v4.63.0 to v4.64.0 comparison <https://github.com/langfuse/langfuse/compare/v4.63.0...v4.64.0> − Removed: Langfuse v4.62.0 to v4.63.0 comparison <https://github.com/langfuse/langfuse/compare/v4.62.0...v4.63.0> − Removed: MCP timeout classification fix (#18949) <https://github.com/langfuse/langfuse/pull/18949> − Removed: Dependency patch commit (#18914) <https://github.com/langfuse/langfuse/pull/18914> + Added: Project API-key path validation (#18957) <https://github.com/langfuse/langfuse/pull/18957> + Added: AI Gateway memory-budget admission (#19020) <https://github.com/langfuse/langfuse/pull/19020> + Added: Code-agent API deprecation notices (#18886) <https://github.com/langfuse/langfuse/pull/18886> + Added: OTEL identity preservation (#19011) <https://github.com/langfuse/langfuse/pull/19011>