Release v3.8.25

.env.example

@@ -543,6 +543,12 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Default: <repo>/src/lib/db/migrations.
 #OMNIROUTE_MIGRATIONS_DIR=
 
+# Mass-pending-migrations safety threshold (#3416). If more than this many
+# migrations are pending on an existing DB, startup aborts (a wiped tracking
+# table could cause data loss). Raise it to restore an older backup; set to 0
+# to disable the check. Used by: src/lib/db/migrationRunner.ts.  Default: 50.
+#OMNIROUTE_MAX_PENDING_MIGRATIONS=50
+
 # Trust user-managed RTK project filter rules without strict signature checks.
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0

.github/workflows/build-fork.yml

@@ -7,9 +7,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+# Least-privilege default: read-only at the top level; the build job that pushes to
+# GHCR grants packages: write itself (Scorecard TokenPermissions).
 permissions:
   contents: read
-  packages: write
 
 env:
   IMAGE_NAME: ghcr.io/kang-heewon/omniroute
@@ -19,6 +20,9 @@ jobs:
     name: Build and Push Fork Image
     if: github.repository == 'kang-heewon/OmniRoute'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/claude.yml

@@ -10,6 +10,10 @@ on:
   pull_request_review:
     types: [submitted]
 
+# Least-privilege default: no token permissions at the top level; the `claude` job
+# grants exactly what it needs below (Scorecard TokenPermissions).
+permissions: {}
+
 jobs:
   claude:
     if: |

.github/workflows/docker-publish.yml

@@ -25,9 +25,10 @@ on:
         type: boolean
         default: false
 
+# Least-privilege default: read-only at the top level; the build and merge jobs that
+# push to GHCR grant packages: write themselves (Scorecard TokenPermissions).
 permissions:
   contents: read
-  packages: write
 
 jobs:
   prepare:
@@ -123,6 +124,9 @@ jobs:
     needs: prepare
     if: needs.prepare.outputs.skip != 'true'
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -344,7 +348,7 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: HIGH,CRITICAL
-          exit-code: '0'
+          exit-code: "0"
 
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'

.github/workflows/electron-release.yml

@@ -11,15 +11,18 @@ on:
         required: true
         type: string
 
+# Least-privilege default: read-only at the top level; each job grants the writes it
+# needs (build/release upload assets, publish-npm forwards npm provenance / packages
+# to the reusable workflow) — Scorecard TokenPermissions.
 permissions:
-  contents: write
-  id-token: write
-  packages: write
+  contents: read
 
 jobs:
   validate:
     name: Validate version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.validate.outputs.version }}
     steps:
@@ -48,6 +51,8 @@ jobs:
     name: Build Electron (${{ matrix.platform }})
     needs: validate
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: write # electron-builder may publish artifacts with GH_TOKEN
     strategy:
       fail-fast: false
       matrix:
@@ -192,6 +197,8 @@ jobs:
     name: Create Release
     needs: [validate, build]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # softprops/action-gh-release creates the GitHub Release
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -242,6 +249,10 @@ jobs:
   publish-npm:
     name: Publish to npm
     needs: [validate, release]
+    permissions:
+      contents: read
+      id-token: write # npm provenance (forwarded to the reusable workflow)
+      packages: write # publish to npm.pkg.github.com
     uses: ./.github/workflows/npm-publish.yml
     with:
       version: ${{ needs.validate.outputs.version }}

.github/workflows/npm-publish.yml

@@ -37,17 +37,22 @@ on:
       NPM_TOKEN:
         required: true
 
+# Least-privilege default: read-only at the top level; each publish job grants the
+# id-token (npm provenance) / packages (GitHub Packages) writes it needs (Scorecard
+# TokenPermissions).
 permissions:
   contents: read
-  id-token: write
-  packages: write
 
 env:
   NPM_PUBLISH_NODE_VERSION: "24"
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm provenance
+      packages: write # publish to npm.pkg.github.com
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -191,6 +196,9 @@ jobs:
 
   publish-opencode-plugin:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm provenance
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/scorecard.yml

@@ -13,7 +13,10 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
+      # security-events: write removed — Scorecard findings are advisory and no longer
+      # uploaded to the code-scanning Security tab (they are supply-chain/posture scores,
+      # not code vulnerabilities, and drowned out real CodeQL alerts). The run still
+      # produces the OpenSSF badge (publish_results) and a downloadable SARIF artifact.
       id-token: write
       contents: read
     steps:
@@ -35,9 +38,3 @@ jobs:
           name: SARIF file
           path: results.sarif
           retention-days: 5
-
-      - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: results.sarif
-          category: scorecard