Diego Rodrigues de Sa e Souza a5d19bf4b9 fix(api): allow private webhook targets behind explicit opt-in (#3269) (#3279) ...

Webhooks hardcoded parseAndValidatePublicUrl, which blocks any RFC1918/loopback host —
breaking self-hosted setups that legitimately point webhooks at internal services
(n8n, Home Assistant, a LAN box). Provider URLs already had an opt-in
(OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS); webhooks now reuse it.

- outboundUrlGuard: add parseAndValidateWebhookUrl — gates the private-host check on
  arePrivateProviderUrlsAllowed() (default OFF); protocol + embedded-credential checks
  stay unconditional.
- swap all webhook call sites (create/update/test/validate-url + dispatcher x2) to it.

Regression test: tests/unit/webhook-private-optin-3269.test.ts (RED before, GREEN after);
existing webhook SSRF/dispatcher suites stay green (33/33).

2026-06-06 02:59:09 -03:00

..

benchmarks

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

e2e

test: stabilize quota syncQuotaCombos shards + fix 2 e2e specs

2026-06-02 22:39:13 -03:00

fixtures

feat(plugins): plugin hook wiring + comprehensive test suite + welcome-banner example (#3045)

2026-06-01 16:20:11 -03:00

golden-set

Release v3.7.9 (#1917)

2026-05-04 01:36:53 -03:00

helpers

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

integration

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

live

fix(security): resolve CodeQL ReDoS + URL sanitization alerts

2026-05-17 07:43:32 -03:00

load

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

manual

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

security

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

translator

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

unit

fix(api): allow private webhook targets behind explicit opt-in (#3269) (#3279)

2026-06-06 02:59:09 -03:00

scratch_test.mjs

refactor: implement path utilities, add custom date formatting, improve type safety, and unify database imports

2026-04-21 21:10:48 -03:00

theoldllm-stress.test.ts

feat(provider): add The Old LLM (theoldllm) — free Playwright-backed provider (#3217)

2026-06-05 11:45:24 -03:00