santosraju99-hub faebf6de5f fix(shared): block cloud-metadata hosts under default remote-image guard (#11755) ...

Boarded in a combined worktree: typecheck:core, check:dashboard-typecheck, check:file-size, check:changelog-integrity, check:complexity, check:cognitive-complexity, check:cycles, check-deps all green; 10/10 focused tests pass. Real SSRF gap confirmed — the default "block-metadata" guard mode fell through to the unchecked parseOutboundUrl() while 3 other call sites of the same guard mode already routed through parseAndValidateNonMetadataUrl(). Good catch that the existing test suite only ever exercised "public-only" explicitly. Retargeted from the stale release/v3.8.50 base to release/v3.8.51. Thanks for closing a real cloud-metadata SSRF exposure.

2026-08-30 04:07:18 -03:00

..

_helpers

…

_setup

test(infra): retry recursive temp-dir removal instead of failing a shard on ENOTEMPTY (#11966) (#11968)

2026-08-29 01:17:40 -03:00

benchmarks

…

boundary

…

e2e

test(infra): retry recursive temp-dir removal instead of failing a shard on ENOTEMPTY (#11966) (#11968)

2026-08-29 01:17:40 -03:00

fixtures

Release v3.8.50

2026-08-26 14:25:01 -03:00

golden-set

…

helpers

…

homolog

…

integration

fix(barrel): delete the @/lib/localDb barrel — every consumer migrated (#11795 Phase 5) (#12055)

2026-08-30 02:36:26 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

fix(providers): retire common ChatGPT Web provider (#11754)

2026-08-28 06:52:46 -03:00

translator

…

unit

fix(shared): block cloud-metadata hosts under default remote-image guard (#11755)

2026-08-30 04:07:18 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…