Diego Rodrigues de Sa e Souza d82b68274c fix(sse): exact-domain cookie match and origin-equality URL assertions (#11452) ...

Clears CodeQL js/incomplete-url-substring-sanitization alerts #860-#865:

- volcengineConsoleAutoLogin: cookie domain filter now uses an exact/
  dot-suffix helper (isVolcengineCookieDomain) instead of substring
  includes(), rejecting look-alike hosts like volcengine.com.evil.test
- security-s1-s2-s4 tests: agent-card/agent.json URL assertions compare
  parsed origin equality instead of startsWith prefix

Co-authored-by: Markus Hartung <mail@hartmark.se>

2026-08-24 23:46:45 -03:00

..

config

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

executors

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

handlers

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

lib

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

mcp-server

feat(search): add context7 as a library-docs search and fetch provider (#11140)

2026-08-23 02:24:01 -03:00

services

fix(sse): exact-domain cookie match and origin-equality URL assertions (#11452)

2026-08-24 23:46:45 -03:00

shared

Release v3.8.46

2026-07-07 13:14:06 -03:00

transformer

fix(sse): strip corrupted request_id from upstream SSE responses (#10223) (#10666)

2026-08-20 13:21:03 -03:00

translator

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

utils

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

vendor/codex-chatgpt-web

fix(quality): green release/v3.8.50 base-reds round 2 (#9985) (#10131)

2026-08-12 16:09:34 -03:00

index.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

package.json

chore(release): open v3.8.51 development cycle

2026-08-24 19:59:24 -03:00

tsconfig.json

chore(sse): drop deprecated baseUrl from open-sse tsconfig for TS 7.0 (#8473)

2026-07-25 02:53:01 -03:00

types.d.ts

feat(api): add per-key prompt compression bypass (#10001)

2026-08-11 09:20:41 -03:00