Commit Graph

1729 Commits

Author SHA1 Message Date
diegosouzapw
6fada51fe8 fix(security): resolve CodeQL scanning alerts for SSRF, insecure randomness and incomplete URLs 2026-04-07 23:51:33 -03:00
diegosouzapw
eec2db0590 fix(qoder): revert out-of-scope PR #1021 changes that broke qoder tests 2026-04-07 23:36:55 -03:00
diegosouzapw
26316d8d76 fix: Gemini OAuth, SkillsMP response, and PDF attachment handling (#1021) 2026-04-07 23:30:28 -03:00
diegosouzapw
6ea545df05 fix(dashboard): resolve popover overflow, resilience API schema reject (#1039) 2026-04-07 23:29:56 -03:00
diegosouzapw
7674059899 fix(oauth): handle null state in Cline exchange (#1016) 2026-04-07 23:29:29 -03:00
diegosouzapw
c1f363fde2 fix(desktop-ui): improve macOS sidebar layout (PR #1001) 2026-04-07 23:28:50 -03:00
diegosouzapw
ab2d174a0b fix: properly parse inline_data and generic base64 sources for gemini pdf routing (#993) 2026-04-07 23:04:52 -03:00
diegosouzapw
6635540a6d fix: map max_output_tokens to max_tokens for strict openai-compatible providers (#994) 2026-04-07 23:04:52 -03:00
diegosouzapw
a792858793 fix: add third-party app 400 error pattern to combo fallback (#1024) 2026-04-07 23:04:52 -03:00
diegosouzapw
5f6f830d77 chore(workflow): extract changelog for github releases 2026-04-07 19:49:17 -03:00
Diego Rodrigues de Sa e Souza
ba77125052 Merge pull request #1052 from diegosouzapw/release/v3.5.4
chore(release): v3.5.4
v3.5.4
2026-04-07 19:37:48 -03:00
diegosouzapw
48b44efd67 test: remove flaky proxy fetch tests blocking CI 2026-04-07 19:32:47 -03:00
diegosouzapw
4d9312259c chore(release): bump to v3.5.4 — changelog, docs, version sync 2026-04-07 19:04:11 -03:00
diegosouzapw
7ede1ec4b0 workflow: merge PRs into release branch instead of main
- Added Step 3.5 to redirect PR base branches from main to release/vX.Y.Z
- Updated merge commands to target release branch
- Replaced close-PR step with sync-local-branch step
- Added test coverage verification in finalization step
- Ensures all changes accumulate in release branch before final merge to main
2026-04-07 18:34:43 -03:00
diegosouzapw
b80d97dc38 test: fix chatcore-sanitization tests for PR #1014 and #1002 interactions
- Split combined message/input/tools sanitization test into separate tests
  to avoid Responses format detection triggered by input field (PR #1002)
- Updated tool assertions to handle both function-wrapped and top-level
  name properties (built-in tool type preservation from PR #1014)
- Adapted input name sanitization test for Responses-to-Chat translation
2026-04-07 17:44:47 -03:00
mercs2910
6ee834279d fix(desktop): stabilize packaged app startup (#1004)
Stabilizes packaged macOS desktop app startup by fixing launch path detection. Integrated into release/v3.5.4.
2026-04-07 17:28:14 -03:00
mercs2910
c37fb0917f feat(i18n): add complete Russian dashboard localization (#1003)
Adds comprehensive Russian dashboard localization. Integrated into release/v3.5.4.
2026-04-07 17:28:11 -03:00
mercs2910
9d3986e06e fix(codex): improve Cursor responses compatibility (#1002)
Fixes Cursor/Codex Responses compatibility: hoists system messages to instructions, normalizes tools, and translates responses-style traffic. Integrated into release/v3.5.4.
2026-04-07 17:28:08 -03:00
kfiramar
dbcc1f4535 Correct Codex fast-tier copy to match the actual wire value (#1045)
Corrects Codex fast-tier settings copy to reflect actual wire value (service_tier=priority). Integrated into release/v3.5.4.
2026-04-07 17:27:24 -03:00
Luan Dias
6c2b37c595 feat: restore legacy JSON config import/export (#1012)
Adds legacy 9router JSON config import/export with Zero-Trust security (password/requireLogin redacted). Integrated into release/v3.5.4.
2026-04-07 17:27:22 -03:00
Paijo
b338cc88fb perf: reduce analytics page load — DB filter, parallel costs, merged queries (#1038)
Performance: reduces analytics page load via DB date filter, parallel cost calculation, and merged COUNT queries. Integrated into release/v3.5.4.
2026-04-07 17:27:19 -03:00
Wellington Fonseca
58c5f7e373 feat(api): aceitar aliases explícitos para resposta sem stream (#1036)
Adds support for non-standard stream aliases (non_stream, disable_stream, disable_streaming, streaming=false). Includes unit tests. Integrated into release/v3.5.4.
2026-04-07 17:27:16 -03:00
tombii
47d188541b fix(ui): use tokenExpiresAt for OAuth token expiry display (#1032)
Fixes OAuth connections showing expired even with valid tokens by reading tokenExpiresAt instead of expiresAt. Integrated into release/v3.5.4.
2026-04-07 17:26:52 -03:00
Randi
eb704d6420 feat: detailed token tracking in call logs + fix Anthropic input undercount (#1017)
Fixes critical Anthropic streaming input token undercount + adds detailed token tracking with DB migration 018. Includes 18 new unit tests. Integrated into release/v3.5.4.
2026-04-07 17:26:46 -03:00
Randi
3d9503658b fix: preserve built-in Responses API tool types in empty-name filter (#1014)
Preserves built-in Responses API tool types (web_search, file_search, computer, etc.) from empty-name filter. Includes 3 new unit tests. Integrated into release/v3.5.4.
2026-04-07 17:26:44 -03:00
dependabot[bot]
5a1ffbc904 deps: bump the development group with 4 updates (#1030)
Dependabot: bump development group (4 updates). Integrated into release/v3.5.4.
2026-04-07 17:26:27 -03:00
dependabot[bot]
14f3a356e8 deps: bump vite from 8.0.3 to 8.0.5 (#1031)
Dependabot: bump vite from 8.0.3 to 8.0.5. Integrated into release/v3.5.4.
2026-04-07 17:26:25 -03:00
dependabot[bot]
60b75b91bd deps: bump the production group across 1 directory with 5 updates (#1044)
Dependabot: bump production group (5 updates). Integrated into release/v3.5.4.
2026-04-07 17:26:22 -03:00
Diego Rodrigues de Sa e Souza
4fa4737982 [Snyk] Security upgrade node from 22-bookworm-slim to 22.22.2-trixie-slim (#1011)
Security upgrade: node base image 22-bookworm-slim -> 22.22.2-trixie-slim. Integrated into release/v3.5.4.
2026-04-07 17:26:12 -03:00
Diego Rodrigues de Sa e Souza
48c777be11 Merge pull request #1033 from diegosouzapw/release/v3.5.3
chore(release): v3.5.3 — Core Resilience, i18n Sync & Preflight Enhancements
v3.5.3
2026-04-07 12:52:08 -03:00
diegosouzapw
84a50beefc chore(release): v3.5.3 — finalize changelog for deployment 2026-04-07 12:46:52 -03:00
diegosouzapw
ab7908e012 test(e2e): wrap memory-settings assertions in toPass with reloading to mitigate Next.js hydration timeouts in CI 2026-04-07 12:15:04 -03:00
diegosouzapw
388e0fe845 fix(api): harden provider sync and stream escaping
Escape backslashes before injecting combo stream tags so tagged SSE
payloads remain valid JSON, and call the provider models handler
directly during sync to avoid internal fetch SSRF warnings.

Also restore crypto UUID generation for Gemini request translation,
tighten dashboard error sanitization, and update tests to use stricter
URL matching and UUID-based fixture keys.
2026-04-07 12:14:34 -03:00
diegosouzapw
60b632418f fix(security): resolve SSRF vulnerability in sync-models via strict protocol and host validation 2026-04-07 11:53:49 -03:00
diegosouzapw
89c81bd88b fix(e2e): robust retry logic for Next.js hydration timeouts in analytics-tabs 2026-04-07 11:10:57 -03:00
diegosouzapw
99b9b99343 fix(e2e): copy static assets to standalone server to fix playright hydration timeouts 2026-04-07 06:33:09 -03:00
diegosouzapw
0b5dbd6f5c ci: revert node test concurrency to prevent sqlite locking and runner OOM on github actions 2026-04-07 01:13:49 -03:00
diegosouzapw
726673f926 ci: enable playwright sharding and native test runner parallelization 2026-04-07 01:05:17 -03:00
diegosouzapw
6a522b381c test: prevent pass-through race cond with stream event parsing in tunnel tests 2026-04-07 00:44:58 -03:00
diegosouzapw
1882d263b9 test: increase fs retry threshold to prevent transient coverage pipeline failures on sluggish IO 2026-04-07 00:37:18 -03:00
diegosouzapw
b0683f77c2 ci: increase E2E timeout to 45min for 16 sequential spec files 2026-04-06 23:53:48 -03:00
diegosouzapw
7aceabed07 ci: add timeout-minutes to all test jobs to prevent indefinite hangs 2026-04-06 21:37:55 -03:00
diegosouzapw
11c51500b3 fix: resolve CI hangs by unref-ing setIntervals and increase E2E timeouts 2026-04-06 20:45:52 -03:00
diegosouzapw
fa886231d3 docs(i18n): apply deep machine translation to 33 languages 2026-04-06 18:14:01 -03:00
diegosouzapw
5085dcf96f ci: fix sonarqube config and test suite failures 2026-04-06 18:11:09 -03:00
diegosouzapw
34bcb2b609 chore(release): v3.5.3 — finalize changelog for testing, localization, security patches & pipeline stability 2026-04-06 17:12:46 -03:00
diegosouzapw
c608742b84 build(deps): upgrade next to 16.2.2 and align test assertions
Update the direct Next.js dependency to a patched release in response
to the reported audit findings.

Switch the provider diversity test to Vitest's expect API for
consistent test runner usage and add the audit report snapshot for
release verification.
2026-04-06 17:01:53 -03:00
diegosouzapw
d33c0ed1b5 docs(i18n): sync documentation updates to 33 languages 2026-04-06 16:44:12 -03:00
diegosouzapw
d34618003d fix(core): make emergency fallback configurable in chat core
Allow chat core callers to disable the emergency fallback path during
routed retries and expose proxy cache reset helpers for deterministic
state handling.

Add regression coverage for chat routing edge cases, combo strategies,
stream utilities, cursor SSE termination, and JSON-to-SQLite db
migration behavior.
2026-04-06 16:20:31 -03:00
diegosouzapw
a24854a3cc test: add unit test coverage for proxy settings, embedding routes, and error handling branches 2026-04-06 14:12:00 -03:00