- Fix `handoffProviders` and `nextBody` unknown property TS errors in contextHandoff
- Correct fallback payload parsing from responses `input` array in combo service
When running OmniRoute with Node.js >=24, the better-sqlite3 native module
fails to load, causing a confusing 'not a valid Win32 application' or
'Module did not self-register' error at the login screen.
This change adds proactive Node.js version detection:
- API: /api/settings/require-login now returns nodeVersion and nodeCompatible
fields, computed before any SQLite access so they work even when the DB fails
- UI: A prominent red warning banner appears on the login page when an
incompatible Node.js version is detected, showing the current version and
instructions to install Node 22 LTS via nvm
- i18n: Added 4 new translation keys for the warning banner
Closes#1060, Closes#1040
- Fix SSRF (CodeQL #73): sync-models route uses localhost allowlist instead of
user-provided request.url to construct internal fetch target
- Fix insecure randomness (CodeQL #33,#34): already fixed in geminiHelper.ts
using crypto.randomBytes, stale alerts will close on rescan
- Fix incomplete URL sanitization (CodeQL #109,#110): already fixed with
startsWith in previous commit, stale alerts will close on rescan
- Fix incomplete hostname regexp (CodeQL #103-108): already fixed with escaped
dots in previous commit, stale alerts will close on rescan
- Fix Dependabot #50-55: override hono@4.12.12 and @hono/node-server@1.19.13
to patch cookie bypass, IP restriction, path traversal, and serveStatic
middleware bypass vulnerabilities
- Fix CI: update context-manager test expectation from 1000000 to 1048576 to
match registry defaultContextLength for gemini
- Fix CI: sync-models route now correctly resolves localhost origin from
incoming request for test compatibility
- Added Step 3.5 to redirect PR base branches from main to release/vX.Y.Z
- Updated merge commands to target release branch
- Replaced close-PR step with sync-local-branch step
- Added test coverage verification in finalization step
- Ensures all changes accumulate in release branch before final merge to main
- Split combined message/input/tools sanitization test into separate tests
to avoid Responses format detection triggered by input field (PR #1002)
- Updated tool assertions to handle both function-wrapped and top-level
name properties (built-in tool type preservation from PR #1014)
- Adapted input name sanitization test for Responses-to-Chat translation
Fixes Cursor/Codex Responses compatibility: hoists system messages to instructions, normalizes tools, and translates responses-style traffic. Integrated into release/v3.5.4.
Adds support for non-standard stream aliases (non_stream, disable_stream, disable_streaming, streaming=false). Includes unit tests. Integrated into release/v3.5.4.
Fixes critical Anthropic streaming input token undercount + adds detailed token tracking with DB migration 018. Includes 18 new unit tests. Integrated into release/v3.5.4.
Preserves built-in Responses API tool types (web_search, file_search, computer, etc.) from empty-name filter. Includes 3 new unit tests. Integrated into release/v3.5.4.
Escape backslashes before injecting combo stream tags so tagged SSE
payloads remain valid JSON, and call the provider models handler
directly during sync to avoid internal fetch SSRF warnings.
Also restore crypto UUID generation for Gemini request translation,
tighten dashboard error sanitization, and update tests to use stricter
URL matching and UUID-based fixture keys.
