mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-22 06:42:19 +03:00

Files

diegosouzapw d5137d0772 fix(auth): restore keyless local-first posture on GET /v1/models (#13354 )

#9320 tightened /v1/models auth to opt-out only when requireAuthForModels
is explicitly false, but isAuthRequired() can return true purely from its
setupComplete bootstrap fallback with zero credentials configured anywhere.
Pre-existing keyless installs that completed onboarding without ever
setting a password/OIDC/INITIAL_PASSWORD now 401 on loopback /v1/models
requests.

getModelCatalogAuthRejection() now also skips the gate when there is no
password, no OIDC, no INITIAL_PASSWORD, and no API key ever created
(fail-closed on a DB error), matching #9320's stated intent without
reopening its leak for any install that has a real credential surface.

2026-09-21 21:17:58 -03:00

features

feat(sse): learn hard request caps from 429 bodies and pace under them (#13895 )

2026-09-19 00:05:07 -03:00

fixes

fix(auth): restore keyless local-first posture on GET /v1/models (#13354 )

2026-09-21 21:17:58 -03:00

maintenance

chore(credit): record co-authorship dropped by three squash merges

2026-09-21 16:33:10 -03:00

README.md

Release v3.8.47 (#6569 )

2026-07-13 09:12:40 -03:00

README.md

changelog.d/ — changelog fragments

A PR never edits CHANGELOG.md directly during the cycle. Instead it adds ONE new file here — its changelog entry as a fragment. Two PRs never touch the same file, so changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full CI re-run after every sibling merge) are structurally impossible.

Convention

Directory	Aggregates under
`features/`	`### ✨ New Features`
`fixes/`	`### 🐛 Bug Fixes`
`maintenance/`	`### 📝 Maintenance`

Filename: <PR-number>-<short-slug>.md (e.g. fixes/6700-dockerfile-better-sqlite3.md). The PR number prefix keeps aggregation order deterministic.
Content: the exact bullet line(s) that should land in CHANGELOG.md, starting with - . Multi-line (continuation) bullets are fine. Keep the repo's credit format: (#PR — thanks @user).
One fragment per PR (rarely more, e.g. a PR that both fixes and adds).

Example

changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md:

- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen

Aggregation

The release captain (or /generate-release) folds all fragments into CHANGELOG.md and deletes them:

node scripts/release/aggregate-changelog.mjs            # write + delete fragments
node scripts/release/aggregate-changelog.mjs --dry-run  # preview only

Fragment well-formedness is enforced by npm run check:changelog-integrity (the same gate that guards against CHANGELOG-eat for legacy direct edits).