Diego Rodrigues de Sa e Souza 898e2bfcaa fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042) ...

isDdnProjectPromptQlToken() (jwt.ts) and isLikelyDdnToken() (usage/promptql.ts) used
`iss.includes("auth.pro.hasura.io")`, which a spoofed issuer like
"https://auth.pro.hasura.io.evil.com/ddn/token" also satisfies
(js/incomplete-url-substring-sanitization, 2 open CodeQL high alerts).

Adds a shared issuerHostIsTrusted() helper in jwt.ts that parses `iss` with `new URL()`
and compares the hostname (exact match or trusted subdomain), and points both call
sites at it, de-duplicating the previously copy-pasted predicate.

2026-07-21 21:42:36 -03:00

..

config

feat(providers): add hailuo-web (MiniMax web) chat provider (#6673) (#7734)

2026-07-21 21:40:31 -03:00

executors

fix(sse): bound Codex SSE peek read with per-read timeout (#8020) (#8043)

2026-07-21 21:41:58 -03:00

handlers

fix(auto): pool accounts by provider model (#7928)

2026-07-21 12:17:18 -03:00

lib

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

mcp-server

perf: lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) (#7893)

2026-07-21 11:50:14 -03:00

services

fix(sse): replace spoofable .includes() PromptQL issuer check with hostname comparison (#8029) (#8042)

2026-07-21 21:42:36 -03:00

shared

Release v3.8.46

2026-07-07 13:14:06 -03:00

transformer

Hide internal reasoning replay placeholders (#7912)

2026-07-20 22:52:54 -03:00

translator

fix(translators): normalize TitleCase tool names for non-Anthropic models (#7926)

2026-07-21 13:40:57 -03:00

utils

perf: lazy provider init, P2C quota cache, structuredClone elimination, getSettings→getCachedSettings (batch 2) (#7893)

2026-07-21 11:50:14 -03:00

.npmignore

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

index.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

package.json

deps: bump the production group with 8 updates (#7897)

2026-07-20 19:28:30 -03:00

tsconfig.json

Release v3.8.23

2026-06-12 23:49:22 -03:00

types.d.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00