Diego Rodrigues de Sa e Souza 948d2d7f21 fix(security): explicit http(s) scheme allowlist in linkifyText href ...

CodeQL flagged the <a href> in LinkifiedText (#5486) with js/xss (high)
and js/client-side-unvalidated-url-redirection (medium) because href
traces back to user-provided text. URL_RE already requires an http(s)://
prefix, so a javascript:/data: scheme can never reach href — but that
guarantee was only implied by the regex. Validate the scheme explicitly
via new URL().protocol before exposing href (non-http(s) degrades to
plain text): defense-in-depth that also makes the sink provably safe to
static analysis. Regression test added.

2026-07-01 13:10:49 -03:00

..

a11yAudit.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

api.ts

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

apiAuth.ts

Release v3.8.13 (#3327)

2026-06-06 19:13:11 -03:00

apiKey.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

apiKeyPolicy.ts

feat(api): add opt-in API-key provider quota-policy bypass scope (#5731)

2026-06-30 23:45:29 -03:00

apiResponse.ts

feat: Add dashboard loading and error UIs, introduce standardized API response utilities, enhance call log redaction and configurable retention, and document architectural decisions.

2026-02-18 11:34:05 -03:00

bulkApiKeyParser.ts

feat(providers): bulk add API keys with Single/Bulk tabs

2026-05-17 11:30:49 -03:00

circuitBreaker.ts

Release v3.8.37 (#5053)

2026-06-26 02:51:06 -03:00

classify429.ts

fix: model lockout not recording for 429 rate_limit_exceeded from Antigravity

2026-06-30 10:42:16 -03:00

cliCompat.ts

fix(cli): add Gemini CLI fingerprint (#1866)

2026-05-02 00:48:54 -03:00

clineAuth.ts

Release v3.8.37 (#5053)

2026-06-26 02:51:06 -03:00

clipboard.ts

fix(combo): resolve cross-provider thinking 400 and http clipboard (#1444)

2026-04-21 04:36:16 -03:00

cloud.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

cn.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

codexBaseUrl.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

codexConfig.ts

Release v3.8.31 (#4377)

2026-06-20 14:55:24 -03:00

cors.ts

feat(authz): introduce centralized proxy-based authz pipeline and lifecycle policy (#1632)

2026-04-27 07:16:24 -03:00

costEstimator.ts

Release v3.7.6 (#1803)

2026-04-30 14:08:50 -03:00

dashboardCsrf.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

featureFlags.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

fetchError.ts

Release v3.8.14 (#3340)

2026-06-07 07:20:02 -03:00

fetchTimeout.ts

fix: NVIDIA NIM API key validation timeout (bypass proxy fetch patch) (#3226)

2026-06-05 11:52:27 -03:00

formatting.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

freeModels.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

index.ts

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

inputSanitizer.ts

fix(body-size): raise LLM API payload limit for responses routes (#5652)

2026-06-30 14:50:48 -03:00

linkify.ts

fix(security): explicit http(s) scheme allowlist in linkifyText href

2026-07-01 13:10:49 -03:00

logger.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

logRedaction.ts

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

machine.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

machineId.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

maskEmail.ts

feat(settings): unify routing rules and model aliases controls

2026-04-12 18:43:19 -03:00

modelCatalogSearch.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

noAuthProviders.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

nodeRuntimeSupport.ts

Release v3.8.40

2026-06-29 08:40:06 -03:00

parseApiKeys.ts

feat(providers): implement bulk paste for extra API keys (#1916)

2026-05-03 16:17:38 -03:00

providerDisplayLabel.ts

fix(dashboard): resolve custom provider display name across surfaces (#2968)

2026-05-31 09:34:16 -03:00

providerHints.ts

Merge remote-tracking branch 'origin/release/v3.8.0' into feat/zero-config-auto-routing

2026-05-10 18:33:20 -03:00

providerModelAliases.ts

fix openrouter available models sync

2026-03-30 17:07:46 -04:00

rateLimiter.ts

Release v3.8.36 (#4854)

2026-06-25 13:17:40 -03:00

releaseNotes.ts

Release v3.7.4 (#1730)

2026-04-28 20:46:25 -03:00

requestId.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

requestTelemetry.ts

Release v3.7.6 (#1803)

2026-04-30 14:08:50 -03:00

requestTimeout.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

resolveOmniRouteBaseUrl.ts

chore(release): v3.5.6 — email masking, model toggle, OpenRouter registries & bug fixes (#1080)

2026-04-09 15:55:59 -03:00

runtimeTimeouts.ts

fix: stream routed SSE chunks promptly (#3759)

2026-06-14 01:10:24 -03:00

secretsValidator.ts

chore(release): v3.6.6 — Stabilization (#1241)

2026-04-16 05:26:17 -03:00

secureRandom.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

serviceTierLabels.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

shuffleDeck.ts

Release v3.8.32 (#4418)

2026-06-21 08:56:51 -03:00

sidebarRouteMatch.ts

feat: implement email masking for test result labels and refactor sidebar route matching logic

2026-04-13 17:39:45 -03:00

streamTracker.ts

feat(phase4): focus indicators, session management, k6 load tests, remove @ts-check

2026-02-18 14:51:15 -03:00

structuredLogger.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

tiktokenCounter.ts

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

turkishText.ts

fix(i18n): Turkish locale-aware search and sorting (#3115)

2026-06-03 18:58:01 -03:00

upstreamError.ts

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00