Nguyen Thanh Dat e5b7c40d11 fix(security): judge outbound hosts by address, not by spelling (#10843) ...

Obrigado — fix de segurança real (reportado via GHSA-qcfj-c39q-88jh): isCloudMetadataHost() decidia por spelling dotted-decimal, então um literal IPv4-mapped IPv6 (ex.: [::ffff:169.254.169.254]) alcançava o guard já canonicalizado por new URL() e não era reconhecido como endpoint de metadata de cloud — bypass no modo que permite endpoints privados/LAN (o default local-first). Também fecha o gap equivalente de 0.0.0.0/::.

Validação (worktree combinado a partir de origin/release/v3.8.50, 0 conflitos):
- typecheck:core limpo, complexity/cognitive-complexity dentro do baseline
- tests/unit/outbound-guard-mapped-ipv4.test.ts — 12/12 passando (IMDS, Alibaba, ECS task role, ambas as grafias, hosts públicos, guard `::`)
- Suítes SSRF relacionadas (webhook/firecrawl/kiro/provider-validation) — verdes

2026-08-20 15:20:29 -03:00

..

app

fix(catalog): stop advertising auto/* when auto routing is disabled (#10857)

2026-08-20 15:20:08 -03:00

domain

[v3.8.50] refactor(codex): isolate virtual quota pools (#8367)

2026-08-20 09:46:13 -03:00

hooks

fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn (#10452)

2026-08-18 10:50:26 -03:00

i18n

fix(i18n): stop rendering the Disabled status as "person with a disability" (#10853)

2026-08-20 15:20:19 -03:00

lib

fix(proxy): stop reporting IPv4-only proxies as dead (#10868)

2026-08-20 15:19:32 -03:00

middleware

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

mitm

fix(agent-bridge): make the regenerate-cert endpoint actually mint a new cert (#10467) (#10715)

2026-08-20 06:28:41 -03:00

models

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

fix(cli): restore packaged machine-token authentication (#10468)

2026-08-20 15:07:19 -03:00

shared

fix(security): judge outbound hosts by address, not by spelling (#10843)

2026-08-20 15:20:29 -03:00

sse

fix(chatgpt-web): refresh current model catalog (#10637)

2026-08-20 11:31:48 -03:00

store

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

types

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

instrumentation-node.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

instrumentation.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

proxy.ts

fix(db): prevent Windows native-driver hang from stalling requests (#10627) (#10709)

2026-08-20 06:28:33 -03:00