mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-12 10:12:11 +03:00
344e4398c8
* fix(quality): green release/v3.8.50 base-reds — env-doc sync + file-size freeze (#9985) Sweep base-reds from issue #9985 on release/v3.8.50: - env-doc-sync: add COMMANDCODE_API_URL + ANTIGRAVITY_ALLOW_SIGNATURE_BYPASS to .env.example and ENVIRONMENT.md (in code, missing from docs); add OMNIROUTE_STRICT_SYSTEM_PROVIDERS + TLS_FINGERPRINT_PROVIDERS to ENVIRONMENT.md (in .env.example, missing from doc). Restores the 3-way env contract. - file-size: freeze open-sse/utils/proxyFetch.ts at 1207 (new proxied-TLS fetch helper over the 1000 cap). Owner-authorized quick rebaseline; slim for v3.9.0. Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> * fix(quality): green open-sse+dashboard typecheck base-reds (#9985) Release-equivalent fast-gates surface 5 real TS regressions inherited by the base from merged Fal/guardrails/cursor work (fast-gates PR->release do not run these, so they accrued on release/v3.8.50): - open-sse/handlers/imageGeneration/providers/fal.ts: normalizeProviderImagePayload missing 4th 'b64_json' arg (TS2554). - open-sse/handlers/videoGeneration/falHandler.ts: narrow video to Record before .url. - src/app/api/v1/images/generations/route.ts: type the toJsonErrorPayload read. - src/lib/guardrails/visionBridgeHelpers.ts: cast through unknown for UA fetch. - src/lib/providers/mergeProviderModelListing.ts: drop index-signature requirement that made interface RegistryModel[] unassignable (TS2322, from #9911). All fixed in source (keeps the gates meaningful); each reproduces on the base tip. Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> * fix(quality): allowlist onnxruntime-node in dependency allowlist (#9985) check:deps base-red — onnxruntime-node is a real production dep (transformers embedding path) landed via the LLMLingua/transformers bump (#9962) without an allowlist entry. Legit package: microsoft onnxruntime, verified in registry. * fix(quality): rebaseline CodeQL ratchet 1->2 for #9940 fingerprint alerts (#9985) Base-red: 2nd js/insufficient-password-hash alert on chatBodyAdmission API-key fingerprints (sha256->16-hex admission-lane key), not password verification. Reproduces on release/v3.8.50 tip. Owner-authorized rebaseline (revisit v3.9.0). * fix(quality): green release/v3.8.50 unit base-reds (#9985) 8 unit-test base-reds reproducing on the pristine release tip, fixed in-source (fast-gates PR->release do not run the unit suite, so these accrued silently): - ServiceSupervisor: spawn-failure now resolves with error status (was throwing); health-probe-failure path still rejects. Distinct via spawnFailed flag. - stream + responseSanitizer: numeric passthrough id preserved as string (was regenerated chatcmpl-); finish chunk with empty delta no longer swallowed by the emptyChoices guard. - proxyFetch: genuine (non-abort) proxy transport failures keep the underlying reason in the surfaced error. - auto-combo builtinCatalog: advertised undefined-variant auto/* ids (auto/chat, auto/best-chat, auto/pro-chat) materialize instead of throwing 'Unknown'. - getTranslations en.json: add missing providers.iconUrlInvalid. - optional-transformers-dependency.test: reconcile to #9962's deliberate move of @huggingface/transformers to a regular dep (napi onnxruntime). Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@gmail.com> Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
147 lines
2.8 KiB
JSON
147 lines
2.8 KiB
JSON
{
|
|
"_comment": "Allowlist anti-slopsquatting (check-deps.mjs). Toda dep nova exige adicao EXPLICITA aqui apos verificar que e legitima.",
|
|
"allowed": [
|
|
"@atjsh/llmlingua-2",
|
|
"@aws-sdk/client-bedrock-runtime",
|
|
"@axe-core/playwright",
|
|
"@cyclonedx/cyclonedx-npm",
|
|
"@dnd-kit/core",
|
|
"@dnd-kit/sortable",
|
|
"@dnd-kit/utilities",
|
|
"@huggingface/transformers",
|
|
"@lobehub/icons",
|
|
"@modelcontextprotocol/sdk",
|
|
"@monaco-editor/react",
|
|
"@ngrok/ngrok",
|
|
"@opencode-ai/plugin",
|
|
"@playwright/test",
|
|
"@size-limit/file",
|
|
"@stryker-mutator/core",
|
|
"@stryker-mutator/tap-runner",
|
|
"@swc/helpers",
|
|
"@tailwindcss/postcss",
|
|
"@tensorflow/tfjs",
|
|
"@testing-library/jest-dom",
|
|
"@testing-library/react",
|
|
"@toon-format/toon",
|
|
"@types/better-sqlite3",
|
|
"@types/bun",
|
|
"@types/mdx",
|
|
"@types/node",
|
|
"@types/react",
|
|
"@types/react-dom",
|
|
"@types/safe-regex",
|
|
"@types/ws",
|
|
"@vitejs/plugin-react",
|
|
"@xyflow/react",
|
|
"axios",
|
|
"bcryptjs",
|
|
"better-sqlite3",
|
|
"bottleneck",
|
|
"bun",
|
|
"c8",
|
|
"clsx",
|
|
"commander",
|
|
"concurrently",
|
|
"cross-env",
|
|
"cron-parser",
|
|
"csv-stringify",
|
|
"ctrf",
|
|
"dompurify",
|
|
"dpdm",
|
|
"electron",
|
|
"electron-builder",
|
|
"electron-updater",
|
|
"eslint",
|
|
"eslint-config-next",
|
|
"eslint-plugin-sonarjs",
|
|
"express",
|
|
"fast-check",
|
|
"fetch-socks",
|
|
"fflate",
|
|
"fumadocs-core",
|
|
"fumadocs-mdx",
|
|
"fumadocs-ui",
|
|
"glob",
|
|
"http-proxy-middleware",
|
|
"https-proxy-agent",
|
|
"httpyac",
|
|
"husky",
|
|
"ink",
|
|
"ink-spinner",
|
|
"ink-text-input",
|
|
"ioredis",
|
|
"jose",
|
|
"js-tiktoken",
|
|
"js-yaml",
|
|
"jscpd",
|
|
"jsdom",
|
|
"jsonc-parser",
|
|
"junit-to-ctrf",
|
|
"keytar",
|
|
"knip",
|
|
"license-checker-rseidelsohn",
|
|
"lint-staged",
|
|
"lockfile-lint",
|
|
"lowdb",
|
|
"lucide-react",
|
|
"marked",
|
|
"marked-terminal",
|
|
"material-symbols",
|
|
"mermaid",
|
|
"monaco-editor",
|
|
"next",
|
|
"next-intl",
|
|
"next-themes",
|
|
"node-loader",
|
|
"node-machine-id",
|
|
"omniglyph",
|
|
"open",
|
|
"opencode-ai",
|
|
"onnxruntime-node",
|
|
"ora",
|
|
"parse5",
|
|
"pino",
|
|
"pino-abstract-transport",
|
|
"pino-pretty",
|
|
"playwright",
|
|
"playwright-ctrf-json-reporter",
|
|
"prettier",
|
|
"promptfoo",
|
|
"react",
|
|
"react-dom",
|
|
"react-is",
|
|
"react-markdown",
|
|
"react-reconciler",
|
|
"recharts",
|
|
"safe-regex",
|
|
"selfsigned",
|
|
"sharp",
|
|
"size-limit",
|
|
"smol-toml",
|
|
"socks",
|
|
"sql.js",
|
|
"sqlite-vec",
|
|
"tailwind-merge",
|
|
"tailwindcss",
|
|
"tls-client-node",
|
|
"tsup",
|
|
"tsx",
|
|
"type-coverage",
|
|
"typescript",
|
|
"typescript-eslint",
|
|
"undici",
|
|
"update-notifier",
|
|
"uuid",
|
|
"vitest",
|
|
"wait-on",
|
|
"wreq-js",
|
|
"ws",
|
|
"wtfnode",
|
|
"xxhash-wasm",
|
|
"yazl",
|
|
"zod",
|
|
"zustand"
|
|
]
|
|
}
|