Maurice 7cfec6452d fix(ssrf): let a listed link-local address through, such as a rootless Podman host gateway ...

A rootless Podman container reaches its host through 169.254.1.2, and an
identity provider behind that address failed the OIDC login with "Requests
to link-local / cloud-metadata addresses are not allowed", with no setting
to change it.

ALLOW_LINK_LOCAL_IPS names single link-local IPv4 addresses that may be
reached after all. The admin-configured lane (OIDC, AI parsing, plugin
OAuth, routing engines) reaches a listed address directly; the guard on
user-supplied URLs treats it as internal, so it also needs
ALLOW_INTERNAL_NETWORK there. 169.254.169.0/24 and 169.254.170.0/24, where
clouds serve instance metadata and credentials, cannot be listed, and an
entry that is not one link-local IPv4 aborts startup. Unset, nothing
changes.

Closes #2400

2026-09-19 22:39:12 +02:00

..

app-config

fix(ssrf): let a listed link-local address through, such as a rootless Podman host gateway

2026-09-19 22:39:12 +02:00

budget

refactor(server): delete trips.bridge via leaf membership reads and prompt relocation

2026-08-11 20:28:49 +02:00

days

Give day notes a domain of their own

2026-08-10 13:38:26 +02:00

db

test(db): pin the roadtrip preferences replay to its own schema version

2026-09-12 17:33:04 +02:00

demo

fix(server): the second pass over this branch's own fixes

2026-08-23 11:59:12 +02:00

files

feat(mcp): read and organise the documents on a trip

2026-08-28 14:20:02 +02:00

mcp

fix(assignments): keep untimed stops in place when a start is saved

2026-09-19 19:24:38 +02:00

middleware

feat(roadtrip): avoid tolls, motorways and ferries, through a second engine

2026-09-09 19:03:00 +02:00

nest

fix(docsync): an orphaned binding stays stopped on every path that starts a run

2026-09-19 21:57:04 +02:00

nest-mcp

fix(mcp): prompts take the trip id as the string every client sends (#2207)

2026-09-03 09:15:14 +02:00

packing

test: cover the new code paths SonarCloud flagged as unmeasured

2026-09-02 16:21:50 +02:00

places

test(places): the delete doubles answer in the shape the service now uses

2026-09-13 23:49:01 +02:00

plugins

feat(plugins): let a plugin answer place searches from its own index

2026-09-10 21:40:51 +02:00

reservations

test(accommodations): cover the paths the day stop added, and the ratchet fell on

2026-09-13 12:12:38 +02:00

services

fix(places): deleting a place cancels the nights booked at it

2026-09-13 15:36:02 +02:00

systemNotices

feat(notices): bring the release notes back on every update

2026-09-15 23:50:15 +02:00

tags

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

todo

Split PluginsModule into four, and gate coverage per domain

2026-08-09 18:44:59 +02:00

trips

Split the trip aggregate root into its parts

2026-08-10 13:38:26 +02:00

utils

fix(ssrf): let a listed link-local address through, such as a rootless Podman host gateway

2026-09-19 22:39:12 +02:00

auto-backup.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

config.test.ts

fix(server): the second pass over this branch's own fixes

2026-08-23 11:59:12 +02:00

idempotency-cleanup.test.ts

Type the cron registrar stub so the tests typecheck again

2026-08-11 09:58:37 +02:00

shared-contract.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

shutdown.test.ts

fix(packing,journey,server): address review findings on the three fixes

2026-09-02 16:21:50 +02:00

uploads-dirs.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00