diegosouzapw
6fada51fe8
fix(security): resolve CodeQL scanning alerts for SSRF, insecure randomness and incomplete URLs
2026-04-07 23:51:33 -03:00
diegosouzapw
eec2db0590
fix(qoder): revert out-of-scope PR #1021 changes that broke qoder tests
2026-04-07 23:36:55 -03:00
diegosouzapw
26316d8d76
fix: Gemini OAuth, SkillsMP response, and PDF attachment handling ( #1021 )
2026-04-07 23:30:28 -03:00
diegosouzapw
6ea545df05
fix(dashboard): resolve popover overflow, resilience API schema reject ( #1039 )
2026-04-07 23:29:56 -03:00
diegosouzapw
7674059899
fix(oauth): handle null state in Cline exchange ( #1016 )
2026-04-07 23:29:29 -03:00
diegosouzapw
c1f363fde2
fix(desktop-ui): improve macOS sidebar layout (PR #1001 )
2026-04-07 23:28:50 -03:00
diegosouzapw
ab2d174a0b
fix: properly parse inline_data and generic base64 sources for gemini pdf routing ( #993 )
2026-04-07 23:04:52 -03:00
diegosouzapw
6635540a6d
fix: map max_output_tokens to max_tokens for strict openai-compatible providers ( #994 )
2026-04-07 23:04:52 -03:00
diegosouzapw
a792858793
fix: add third-party app 400 error pattern to combo fallback ( #1024 )
2026-04-07 23:04:52 -03:00
diegosouzapw
5f6f830d77
chore(workflow): extract changelog for github releases
2026-04-07 19:49:17 -03:00
Diego Rodrigues de Sa e Souza
ba77125052
Merge pull request #1052 from diegosouzapw/release/v3.5.4
...
chore(release): v3.5.4
v3.5.4
2026-04-07 19:37:48 -03:00
diegosouzapw
48b44efd67
test: remove flaky proxy fetch tests blocking CI
2026-04-07 19:32:47 -03:00
diegosouzapw
4d9312259c
chore(release): bump to v3.5.4 — changelog, docs, version sync
2026-04-07 19:04:11 -03:00
diegosouzapw
7ede1ec4b0
workflow: merge PRs into release branch instead of main
...
- Added Step 3.5 to redirect PR base branches from main to release/vX.Y.Z
- Updated merge commands to target release branch
- Replaced close-PR step with sync-local-branch step
- Added test coverage verification in finalization step
- Ensures all changes accumulate in release branch before final merge to main
2026-04-07 18:34:43 -03:00
diegosouzapw
b80d97dc38
test: fix chatcore-sanitization tests for PR #1014 and #1002 interactions
...
- Split combined message/input/tools sanitization test into separate tests
to avoid Responses format detection triggered by input field (PR #1002 )
- Updated tool assertions to handle both function-wrapped and top-level
name properties (built-in tool type preservation from PR #1014 )
- Adapted input name sanitization test for Responses-to-Chat translation
2026-04-07 17:44:47 -03:00
mercs2910
6ee834279d
fix(desktop): stabilize packaged app startup ( #1004 )
...
Stabilizes packaged macOS desktop app startup by fixing launch path detection. Integrated into release/v3.5.4.
2026-04-07 17:28:14 -03:00
mercs2910
c37fb0917f
feat(i18n): add complete Russian dashboard localization ( #1003 )
...
Adds comprehensive Russian dashboard localization. Integrated into release/v3.5.4.
2026-04-07 17:28:11 -03:00
mercs2910
9d3986e06e
fix(codex): improve Cursor responses compatibility ( #1002 )
...
Fixes Cursor/Codex Responses compatibility: hoists system messages to instructions, normalizes tools, and translates responses-style traffic. Integrated into release/v3.5.4.
2026-04-07 17:28:08 -03:00
kfiramar
dbcc1f4535
Correct Codex fast-tier copy to match the actual wire value ( #1045 )
...
Corrects Codex fast-tier settings copy to reflect actual wire value (service_tier=priority). Integrated into release/v3.5.4.
2026-04-07 17:27:24 -03:00
Luan Dias
6c2b37c595
feat: restore legacy JSON config import/export ( #1012 )
...
Adds legacy 9router JSON config import/export with Zero-Trust security (password/requireLogin redacted). Integrated into release/v3.5.4.
2026-04-07 17:27:22 -03:00
Paijo
b338cc88fb
perf: reduce analytics page load — DB filter, parallel costs, merged queries ( #1038 )
...
Performance: reduces analytics page load via DB date filter, parallel cost calculation, and merged COUNT queries. Integrated into release/v3.5.4.
2026-04-07 17:27:19 -03:00
Wellington Fonseca
58c5f7e373
feat(api): aceitar aliases explícitos para resposta sem stream ( #1036 )
...
Adds support for non-standard stream aliases (non_stream, disable_stream, disable_streaming, streaming=false). Includes unit tests. Integrated into release/v3.5.4.
2026-04-07 17:27:16 -03:00
tombii
47d188541b
fix(ui): use tokenExpiresAt for OAuth token expiry display ( #1032 )
...
Fixes OAuth connections showing expired even with valid tokens by reading tokenExpiresAt instead of expiresAt. Integrated into release/v3.5.4.
2026-04-07 17:26:52 -03:00
Randi
eb704d6420
feat: detailed token tracking in call logs + fix Anthropic input undercount ( #1017 )
...
Fixes critical Anthropic streaming input token undercount + adds detailed token tracking with DB migration 018. Includes 18 new unit tests. Integrated into release/v3.5.4.
2026-04-07 17:26:46 -03:00
Randi
3d9503658b
fix: preserve built-in Responses API tool types in empty-name filter ( #1014 )
...
Preserves built-in Responses API tool types (web_search, file_search, computer, etc.) from empty-name filter. Includes 3 new unit tests. Integrated into release/v3.5.4.
2026-04-07 17:26:44 -03:00
dependabot[bot]
5a1ffbc904
deps: bump the development group with 4 updates ( #1030 )
...
Dependabot: bump development group (4 updates). Integrated into release/v3.5.4.
2026-04-07 17:26:27 -03:00
dependabot[bot]
14f3a356e8
deps: bump vite from 8.0.3 to 8.0.5 ( #1031 )
...
Dependabot: bump vite from 8.0.3 to 8.0.5. Integrated into release/v3.5.4.
2026-04-07 17:26:25 -03:00
dependabot[bot]
60b75b91bd
deps: bump the production group across 1 directory with 5 updates ( #1044 )
...
Dependabot: bump production group (5 updates). Integrated into release/v3.5.4.
2026-04-07 17:26:22 -03:00
Diego Rodrigues de Sa e Souza
4fa4737982
[Snyk] Security upgrade node from 22-bookworm-slim to 22.22.2-trixie-slim ( #1011 )
...
Security upgrade: node base image 22-bookworm-slim -> 22.22.2-trixie-slim. Integrated into release/v3.5.4.
2026-04-07 17:26:12 -03:00
Diego Rodrigues de Sa e Souza
48c777be11
Merge pull request #1033 from diegosouzapw/release/v3.5.3
...
chore(release): v3.5.3 — Core Resilience, i18n Sync & Preflight Enhancements
v3.5.3
2026-04-07 12:52:08 -03:00
diegosouzapw
84a50beefc
chore(release): v3.5.3 — finalize changelog for deployment
2026-04-07 12:46:52 -03:00
diegosouzapw
ab7908e012
test(e2e): wrap memory-settings assertions in toPass with reloading to mitigate Next.js hydration timeouts in CI
2026-04-07 12:15:04 -03:00
diegosouzapw
388e0fe845
fix(api): harden provider sync and stream escaping
...
Escape backslashes before injecting combo stream tags so tagged SSE
payloads remain valid JSON, and call the provider models handler
directly during sync to avoid internal fetch SSRF warnings.
Also restore crypto UUID generation for Gemini request translation,
tighten dashboard error sanitization, and update tests to use stricter
URL matching and UUID-based fixture keys.
2026-04-07 12:14:34 -03:00
diegosouzapw
60b632418f
fix(security): resolve SSRF vulnerability in sync-models via strict protocol and host validation
2026-04-07 11:53:49 -03:00
diegosouzapw
89c81bd88b
fix(e2e): robust retry logic for Next.js hydration timeouts in analytics-tabs
2026-04-07 11:10:57 -03:00
diegosouzapw
99b9b99343
fix(e2e): copy static assets to standalone server to fix playright hydration timeouts
2026-04-07 06:33:09 -03:00
diegosouzapw
0b5dbd6f5c
ci: revert node test concurrency to prevent sqlite locking and runner OOM on github actions
2026-04-07 01:13:49 -03:00
diegosouzapw
726673f926
ci: enable playwright sharding and native test runner parallelization
2026-04-07 01:05:17 -03:00
diegosouzapw
6a522b381c
test: prevent pass-through race cond with stream event parsing in tunnel tests
2026-04-07 00:44:58 -03:00
diegosouzapw
1882d263b9
test: increase fs retry threshold to prevent transient coverage pipeline failures on sluggish IO
2026-04-07 00:37:18 -03:00
diegosouzapw
b0683f77c2
ci: increase E2E timeout to 45min for 16 sequential spec files
2026-04-06 23:53:48 -03:00
diegosouzapw
7aceabed07
ci: add timeout-minutes to all test jobs to prevent indefinite hangs
2026-04-06 21:37:55 -03:00
diegosouzapw
11c51500b3
fix: resolve CI hangs by unref-ing setIntervals and increase E2E timeouts
2026-04-06 20:45:52 -03:00
diegosouzapw
fa886231d3
docs(i18n): apply deep machine translation to 33 languages
2026-04-06 18:14:01 -03:00
diegosouzapw
5085dcf96f
ci: fix sonarqube config and test suite failures
2026-04-06 18:11:09 -03:00
diegosouzapw
34bcb2b609
chore(release): v3.5.3 — finalize changelog for testing, localization, security patches & pipeline stability
2026-04-06 17:12:46 -03:00
diegosouzapw
c608742b84
build(deps): upgrade next to 16.2.2 and align test assertions
...
Update the direct Next.js dependency to a patched release in response
to the reported audit findings.
Switch the provider diversity test to Vitest's expect API for
consistent test runner usage and add the audit report snapshot for
release verification.
2026-04-06 17:01:53 -03:00
diegosouzapw
d33c0ed1b5
docs(i18n): sync documentation updates to 33 languages
2026-04-06 16:44:12 -03:00
diegosouzapw
d34618003d
fix(core): make emergency fallback configurable in chat core
...
Allow chat core callers to disable the emergency fallback path during
routed retries and expose proxy cache reset helpers for deterministic
state handling.
Add regression coverage for chat routing edge cases, combo strategies,
stream utilities, cursor SSE termination, and JSON-to-SQLite db
migration behavior.
2026-04-06 16:20:31 -03:00
diegosouzapw
a24854a3cc
test: add unit test coverage for proxy settings, embedding routes, and error handling branches
2026-04-06 14:12:00 -03:00