diegosouzapw 084f2c53ce fix(security): replace Object.assign with spread to eliminate prototype pollution flow ...

CodeQL js/prototype-polluting-assignment tracks Object.assign on
dynamically-keyed objects as a potential pollution vector, even when
runtime guards (isSafeKey) are in place. Replace with spread assignment
which creates a new value — CodeQL does not flag this pattern.

Addresses remaining alerts #167 and #168.

2026-04-27 20:23:49 -03:00

..

a2a

chore(release): v3.5.6 — email masking, model toggle, OpenRouter registries & bug fixes (#1080)

2026-04-09 15:55:59 -03:00

acp

feat(providers): add lm studio and grok 4.3 support

2026-04-21 08:27:48 -03:00

api

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

auth

feat(runtime): add hot-reloadable guardrails and model diagnostics

2026-04-17 11:56:52 -03:00

batches

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

catalog

feat: features 07/09/04/06 — codex clamp, openrouter cache, quota preflight & monitor

2026-03-08 17:36:17 -03:00

combos

feat: add expert combo configuration mode (#1547)

2026-04-24 09:04:10 -03:00

compliance

feat(dashboard): expand observability and provider tooling

2026-04-23 16:57:43 -03:00

config

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

db

fix(migration): prevent compat-renamed version slot from shadowing new migrations (#1637)

2026-04-26 23:29:25 -03:00

display

feat: add hidden Claude Code compatible provider

2026-04-01 04:35:16 -04:00

env

feat(chatgpt-web): image generation + edit (Open WebUI compatible) (#1607)

2026-04-25 23:51:37 -03:00

evals

feat(dashboard): add custom CLI builder and eval suite management

2026-04-23 16:57:43 -03:00

guardrails

feat(network): add guarded remote image fetch utility

2026-04-27 02:25:46 -03:00

jobs

fix(postinstall): extend native module repair to cover wreq-js for pnpm global installs (#1634)

2026-04-26 20:15:47 -03:00

memory

Fix Codex Responses WebSocket memory retention and weekly limit handling (#1581)

2026-04-25 11:16:54 -03:00

monitoring

feat(dashboard): expand observability and provider tooling

2026-04-23 16:57:43 -03:00

oauth

fix(i18n): translate 519 untranslated pt-BR keys — PR #1602 regression fix

2026-04-25 19:08:52 -03:00

plugins

chore(release): v3.4.8 — security compliance and fix algorithms

2026-04-03 00:15:35 -03:00

promptCache

feat(cache): add OpenAI prompt_cache_key and Gemini cachedContent support

2026-03-31 04:50:50 +07:00

providerModels

fix(claude): preserve tool_result adjacency (#1555)

2026-04-24 09:22:46 -03:00

providers

[Improvement] Fix Providers Default models list (Done) (#1577)

2026-04-25 11:03:31 -03:00

resilience

refactor: unify resilience controls (#1449)

2026-04-21 04:13:28 -03:00

runtime

feat: enhance port configuration and API bridge support

2026-02-26 15:11:40 +00:00

search

feat(runtime): add hot-reloadable guardrails and model diagnostics

2026-04-17 11:56:52 -03:00

skills

fix(security): resolve 14 CodeQL code scanning alerts

2026-04-27 20:00:10 -03:00

spend

feat(core): add payload rules, tag routing, and scheduled budgets

2026-04-17 09:00:32 -03:00

sync

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

system

chore(release): v3.5.6 — email masking, model toggle, OpenRouter registries & bug fixes (#1080)

2026-04-09 15:55:59 -03:00

translator

feat(dashboard): add custom CLI builder and eval suite management

2026-04-23 16:57:43 -03:00

usage

fix(security): replace Object.assign with spread to eliminate prototype pollution flow

2026-04-27 20:23:49 -03:00

versionManager

build(next): tighten standalone tracing and ignore runtime fs lookups

2026-04-17 23:48:37 -03:00

ws

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

zed-oauth

feat(providers): add Empower and Poe gateway support

2026-04-24 07:48:19 -03:00

apiBridgeServer.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

apiKeyExposure.ts

Scope API key reveal to Api Manager (#740)

2026-03-29 04:30:11 -03:00

benchmarks.ts

feat: complete memory and skills implementation for antigravity

2026-04-01 08:42:03 -03:00

cacheControlSettings.ts

feat: add cache control settings and token-based metrics

2026-03-29 14:37:55 +02:00

cacheLayer.ts

fix(build): remove node: protocol prefix from all src/ imports (#turbopack-compat)

2026-03-17 04:24:46 -03:00

cloudflaredTunnel.ts

fix(chat): extract pipeline helpers and harden edge cases

2026-04-06 09:28:24 -03:00

cloudSync.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

consoleInterceptor.ts

Release v3.4.0 (Integration) (#861)

2026-03-31 10:22:52 -03:00

container.ts

feat: add error pages, harden DB layer and compliance module

2026-03-04 19:35:38 -03:00

dataPaths.ts

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

gracefulShutdown.ts

fix(logs): add periodic runtime log rotation check (#1504)

2026-04-22 12:25:53 -03:00

idempotencyLayer.ts

feat(cache): implement dynamic cache components with TDD

2026-04-01 08:45:39 +07:00

initCloudSync.ts

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

ipUtils.ts

feat(sub2api): implement T01-T15 gap analysis tasks (3.0.0-rc.6)

2026-03-22 20:55:35 -03:00

localDb.ts

fix(cache): replay cached reasoning for tool-calling think models

2026-04-26 18:53:54 -03:00

localHealthCheck.ts

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

logEnv.ts

Release v3.6.0 (#1109)

2026-04-10 09:56:42 -03:00

logPayloads.ts

chore: fix CodeQL alerts and missing docker postinstall

2026-04-18 11:44:20 -03:00

logRotation.ts

feat(providers): add AWS Polly and Lemonade provider support

2026-04-24 13:20:59 -03:00

modelAliasSeed.ts

feat(providers): expose antigravity preview aliases and gemini cli onboarding

2026-04-16 23:25:58 -03:00

modelCapabilities.ts

fix(sse): enable tool calling for GPT OSS and DeepSeek Reasoner models (#1455)

2026-04-21 04:50:00 -03:00

modelMetadataRegistry.ts

feat(runtime): add hot-reloadable guardrails and model diagnostics

2026-04-17 11:56:52 -03:00

modelsDevSync.ts

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

piiSanitizer.ts

feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars

2026-02-18 14:43:57 -03:00

pricingSync.ts

fix: resolve CI hangs by unref-ing setIntervals and increase E2E timeouts

2026-04-06 20:45:52 -03:00

proxyHealth.ts

feat: sub2api T05/T08/T09/T13/T14 + bump to 3.0.0-rc.7

2026-03-22 23:17:52 -03:00

proxyLogger.ts

Release v3.4.0 (Integration) (#861)

2026-03-31 10:22:52 -03:00

semanticCache.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

settingsCache.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

tailscaleTunnel.ts

fix(tailscale): support sudo auth and live daemon socket detection

2026-04-25 21:59:50 -03:00

tokenHealthCheck.ts

Release v3.6.9 (#1404)

2026-04-19 19:50:30 -03:00

toolPolicy.ts

feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars

2026-02-18 14:43:57 -03:00

translatorEvents.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

usageAnalytics.ts

perf: reduce analytics page load — DB filter, parallel costs, merged queries (#1038)

2026-04-07 17:27:19 -03:00

usageDb.ts

feat(dashboard): expand observability and provider tooling

2026-04-23 16:57:43 -03:00

webhookDispatcher.ts

feat: API Endpoints dashboard — interactive catalog, webhooks, OpenAPI viewer

2026-03-23 22:07:10 -03:00