jubnl 4ad8146dbf fix(security): re-validate LLM endpoint fetch redirects per hop (GHSA-fmq9) ...

safeFetchLlm left undici's default redirect:'follow', so a configured LLM
endpoint could 302 to http://169.254.169.254/ and reach cloud-metadata
credentials — the DNS pin does not cover an IP-literal redirect hop, since
net.connect skips the pinned lookup for a literal IP. Follow redirects
manually now, re-resolving/re-checking/re-pinning each hop (allowing LAN/
localhost as before). Also block the Alibaba metadata IPs directly.

2026-07-11 21:58:14 +02:00

..

db

3.2.0 (#1426)

2026-07-05 01:13:04 +02:00

mcp

3.3.0 (#1472)

2026-07-11 19:02:34 +02:00

middleware

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

nest

3.3.0 (#1472)

2026-07-11 19:02:34 +02:00

plugins

fix(sdk): allow empty egress if and only if operatorEgress is true

2026-07-11 20:06:54 +02:00

services

fix(backup): snapshot the core DB and swap restores atomically

2026-07-11 21:52:53 +02:00

systemNotices

feat(system-notices): replace expiresAt with [minVersion, maxVersion) version gate

2026-04-17 20:03:23 +02:00

utils

fix(security): re-validate LLM endpoint fetch redirects per hop (GHSA-fmq9)

2026-07-11 21:58:14 +02:00

idempotency-cleanup.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

scheduler.test.ts

Bug fixes - April 27th 2026 (#907)

2026-04-28 05:17:20 +02:00

shared-contract.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00