promptfoo Files

0.120.27 (2026-03-06)

Features

• add promptfoo-evals agent skill for Claude Code and Codex (#7985) (71160fe)
• app: add media library page (#6901) (4eba85a)
• code-scan: add retry with exponential backoff for capacity errors (#8016) (8d263e4)
• dod ethical ai mappings (#7948) (4e2c897)
• eval-creator: add yaml download and cli callout (#7932) (c73c002)
• eval: detect missing API keys before running evaluation (#7937) (d2b7d61)
• eval: disable auto-share by default unless paid cloud customer (#7982) (9df2250)
• handle email_verification_required in redteam prechecks (ENG-1531) (#7979) (2c66d1b)
• providers/google: add Nano Banana 2 image model support (#7884) (0dba833)
• providers: add gpt-5.3 and gpt-5.2 aliases (#7965) (2001eda)
• providers: add gpt-5.4 and gpt-5.4-pro aliases (#8008) (3d9826e)
• providers: add gpt-5.4 model support (#8009) (968ca35)
• providers: add ModelsLab image generation provider (#7925) (df5f07a)
• providers: add Vertex AI cost calculation for Gemini models (#7490) (f2b7de4)
• providers: expose all choices in metadata when n > 1 (#8007) (d8f4239)
• providers: rewrite QuiverAI for native SVG API (#7951) (f76ffb5)
• redteam: add monthly probe limit for non-cloud users (#7966) (ef8ff9c)
• redteam: rate-limit expensive strategies for unauthenticated users (#8005) (662a8bc)
• targetLink: add HTTP probe, filesystem ops, and error classification types (#7981) (e988d56)

Bug Fixes

• app: deduplicate image outputs in eval cell (#8012) (71a1cd4)
• app: improve data table expanded rows (#8015) (ead520b)
• app: restore default border color for Tailwind v4 (#7920) (e17430e)
• ci: use npm ci for docs and site-tests jobs to fix serialize-javascript override (#7952) (013f90d)
• cloud: strip heavy fields from permission check payload (#7839) (aba832d)
• deps: override dompurify to >=3.3.2 to resolve XSS CVE in monaco-editor (#8026) (fc7a3a8)
• deps: resolve all npm audit vulnerabilities via overrides (#7947) (0b94778)
• deps: update dependency @actions/github to v9 (#7432) (efa1625)
• deps: update dependency @apidevtools/json-schema-ref-parser to ^15.3.0 (#8010) (aa25f9b)
• deps: update dependency @apidevtools/json-schema-ref-parser to ^15.3.1 (#8011) (82eaaa3)
• deps: update dependency @opentelemetry/semantic-conventions to ^1.40.0 (#7957) (ece8f61)
• deps: update dependency minimatch to ^10.2.4 (#7939) (639301f)
• deps: update dependency simple-git to ^3.32.3 (#7954) (1d62387)
• deps: update github actions to v3 (major) (#7946) (2a6600d)
• deps: update openai packages (#7928) (9facd14)
• eval: improve eval setup web UI (#8000) (d2c166d)
• eval: pass dynamic prompt config to providers (#7970) (8a75163)
• matchers: handle missing context-faithfulness verdicts (#7991) (242486c)
• output: redact exported config secrets and clarify docs (#7974) (1e0a48b)
• providers: avoid bedrock http2 runtime failures (#7993) (76e256c)
• providers: guard top_p for reasoning models, remove dead code, update UI defaults (#7963) (cec3ac0)
• providers: handle system messages in Vertex Claude API calls (#7902) (b2116a5)
• providers: improve Vertex Claude system message handling (#7977) (45c2de2)
• providers: reduce google ADC metadata lookup warnings (#7992) (f31e779)
• providers: resolve env var placeholders in file:// provider references (#7997) (5397dd6)
• redteam: add anti-hallucination guardrails to policy grader rubric (#7829) (cf04414)
• redteam: clarify hydra/meta error when OPENAI_API_KEY blocks remote generation (#8020) (21eae98)
• redteam: exclude default strategies from OSS setup sidebar count (#7989) (8bf49cf)
• redteam: honor config.model for openai:chat (#7971) (a5cc127)
• redteam: propagate sessionId to context.vars in hydra stateful mode (#7960) (554c305)
• redteam: show pointer cursor on setup tabs and filters (#7929) (bf43419)
• skill: correct plugin structure, transform syntax, and provider format (#7986) (592fca9)
• ui: wrap long log lines in log viewer (#8001) (98c35be)