Repository navigation
chore(release): v3.2.8 — Docker Auto-Update & Analytics Fixes - #755
Merged
Merged
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the project version to 3.2.8 across package.json, package-lock.json, and the OpenAPI documentation. It also updates the CHANGELOG.md to include details on new enhancements like the Docker Auto-Update UI and Cache Analytics, along with bug fixes for CLI tool detection on Windows and DeepSeek tag extraction. A review comment correctly identifies that the release date in the changelog is set to a future date and should be updated to reflect the actual release.
|
|
||
| --- | ||
|
|
||
| ## [3.2.8] - 2026-03-29 |
Contributor
There was a problem hiding this comment.
The release date 2026-03-29 is set to a future date. This seems to be a mistake and should be updated to the actual release date.
Code Review SummaryStatus: 3 Issues Found | Recommendation: Address before merge Overview
New Changes (Incremental Review)This review covers commits since Issues FoundWARNING
Previous Issues (Carried Forward / Resolved)
Files ReviewedMultiple files changed including:
SummaryFound 2 new issues with incorrect file references in the changelog (middleware.ts vs proxy.ts). The previous date issue is resolved. The package.json PR description issue from the initial review remains relevant. Fix Link |
Contributor
There was a problem hiding this comment.
Pull request overview
Release housekeeping for v3.2.8 by synchronizing version identifiers across the Node package metadata, OpenAPI spec, and changelog.
Changes:
- Bumped application version to
3.2.8inpackage.jsonandpackage-lock.json. - Updated the OpenAPI spec
info.versionto3.2.8. - Added a
3.2.8release entry toCHANGELOG.md.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Bumps app version to 3.2.8. |
| package-lock.json | Updates lockfile package version fields to 3.2.8. |
| docs/openapi.yaml | Updates OpenAPI info.version to 3.2.8. |
| CHANGELOG.md | Adds release notes section for 3.2.8. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
2
to
4
| "name": "omniroute", | ||
| "version": "3.2.7", | ||
| "version": "3.2.8", | ||
| "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.", |
There was a problem hiding this comment.
PR description calls out functional changes (Docker auto-update UI + cache analytics fixes), but the diff only bumps versions and updates the changelog. If the feature/code changes were intended to be part of this PR, they appear to be missing; otherwise, consider updating the PR description to reflect that this is a release/version bump only (with release notes).
- Remove in-memory metrics tracking (currentMetrics, trackCacheMetrics, updateCacheMetrics) - Cache metrics now computed on-the-fly from usage_history table (single source of truth) - Fixes CRITICAL issue from code review: concurrent requests overwriting metrics - Fixes WARNING: duplicate metric tracking logic in streaming/non-streaming paths Ref: PR #752 (merged before this fix was included)
…mbeddings/images routes (#757) * fix: handle allRateLimited credentials in embeddings and images routes When getProviderCredentials() returns an allRateLimited object (truthy, but without apiKey/accessToken), the embeddings and images routes incorrectly passed it to handlers as valid credentials. The handlers then sent upstream requests without Authorization headers, causing 401 errors from providers (e.g. NVIDIA NIM). This only manifested under concurrent requests: a chat/completions call could trigger rate limiting on a provider account, and a simultaneous embeddings request would receive the allRateLimited sentinel — but treat it as valid credentials. The chat pipeline already handled this case correctly. This commit adds the same allRateLimited guard to all affected routes: - POST /v1/embeddings - POST /v1/providers/{provider}/embeddings - POST /v1/images/generations - POST /v1/providers/{provider}/images/generations Also adds a defense-in-depth guard in the embeddings handler itself: if no auth token is available for a non-local provider, return 401 immediately instead of sending an unauthenticated request upstream. Made-with: Cursor * fix(embeddings): forward extra body keys to upstream providers The embeddings handler only forwarded model, input, dimensions, and encoding_format to upstream providers, silently dropping any additional fields. This broke asymmetric embedding APIs (e.g. NVIDIA NIM nv-embedqa-e5-v5) that require input_type, and other providers expecting user or truncate parameters. Add a KNOWN_FIELDS exclusion set and forward all unrecognized body keys to the upstream request, matching the passthrough pattern used by the chat pipeline's DefaultExecutor.transformRequest(). Made-with: Cursor
diegosouzapw
had a problem deploying
to
NPM_TOKEN
March 29, 2026 15:50 — with 
GitHub Actions
Failure
GitHub Actions
Failure
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
|
|
||
| ### 🐛 Bug Fixes | ||
|
|
||
| - **Authentication Logic** — Fixed a bug where saving dashboard settings or adding models failed with a 401 Unauthorized error when `requireLogin` was disabled. API endpoints now correctly evaluate the global authentication toggle. Resolved global redirection by reactivating `src/middleware.ts`. |
There was a problem hiding this comment.
WARNING: Incorrect file reference - mentions src/middleware.ts but the file was renamed to src/proxy.ts. Should be updated to reflect the actual file name.
|
|
||
| ### 🐛 Bug Fixes | ||
|
|
||
| - **Authentication Logic** — Fixed a bug where saving dashboard settings or adding models failed with a 401 Unauthorized error when `requireLogin` was disabled. API endpoints now correctly evaluate the global authentication toggle. Resolved global redirection by reactivating `src/middleware.ts`. |
There was a problem hiding this comment.
WARNING: Incorrect file reference - mentions src/middleware.ts but the file was renamed to src/proxy.ts. Should be updated to reflect the actual file name.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3fb72b973a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+46
to
+47
| import { shouldPreserveCacheControl, recordCacheHit } from "../utils/cacheControlPolicy.ts"; | ||
| import { getCacheMetrics } from "@/lib/db/settings.ts"; |
There was a problem hiding this comment.
This import change removed the symbols that the non-streaming path still relies on: later in handleChatCore it calls updateCacheMetrics(currentMetrics) before returning. For any stream=false chat request, that now raises a ReferenceError after the upstream response is processed, turning successful non-stream completions into server errors. Please either remove the stale call or keep the metrics variable/import lifecycle consistent.
Useful? React with 👍 / 👎.
Comment on lines
+1614
to
+1618
| saveRequestUsage({ | ||
| provider: provider || "unknown", | ||
| model: model || "unknown", | ||
| tokens: streamUsage, | ||
| status: String(streamStatus || 200), |
There was a problem hiding this comment.
onStreamComplete now writes saveRequestUsage(...), but the stream pipeline already persists usage via logUsage(...) in open-sse/utils/stream.ts (both passthrough and translated modes). This causes each successful streamed request to be recorded twice in usage_history, which inflates analytics/cost tracking and can misfire quota/budget decisions that depend on usage totals.
Useful? React with 👍 / 👎.
diegosouzapw
added a commit
that referenced
this pull request
Jul 22, 2026
diegosouzapw
added a commit
to artickc/OmniRoute
that referenced
this pull request
Jul 25, 2026
…route refactor The edits-route extraction (test commit 62785e9) had accidentally reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix from cheaper-inference#8173 (CodeQL cheaper-inference#754/cheaper-inference#755/cheaper-inference#756). Restored the bounded quantifiers; behavior is unchanged (45/45 adobe-firefly tests still pass), only the backtracking bound is back in place. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
diegosouzapw
added a commit
that referenced
this pull request
Jul 26, 2026
…w-up #8006) (#8510) * feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up #8006) Upload source images to Firefly storage (POST /v2/storage/image) and attach them as referenceBlobs on generate-async, matching live firefly.adobe.com captures (usage:general for nano multi-ref; usage:subject for gpt-image). Also wire built-in adobe-firefly through OpenAI-compatible POST /v1/images/edits (multipart or JSON data URLs, up to 4 refs) so Media edit-with-references and Open WebUI image-edit hit the same path as image2image generate. Unit suite: tests/unit/adobe-firefly.test.ts 41/41. * test(api): add route-level coverage for Adobe Firefly /v1/images/edits + fix typecheck/file-size drift Covers the referenceBlobs upload path, the 4-reference cap error, and the credentials/rate-limit branches added to the /v1/images/edits route for adobe-firefly (#8510). Also fixes a Buffer/BodyInit typecheck mismatch in uploadAdobeFireflyImage and corrects the adobeFireflyClient.ts file-size baseline entry to match the gate's actual LOC count (it counts the trailing newline, so the frozen value is 2317, not 2316), plus a testFrozen entry for adobe-firefly.test.ts's own +159 line growth from this PR. Moves the handleAdobeFireflyImageGeneration re-export out of the middle of the import block in imageGeneration.ts for readability. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(security): restore bounded JWT regex quantifiers dropped by edit-route refactor The edits-route extraction (test commit 62785e9) had accidentally reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix from #8173 (CodeQL #754/#755/#756). Restored the bounded quantifiers; behavior is unchanged (45/45 adobe-firefly tests still pass), only the backtracking bound is back in place. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
HouMinXi
pushed a commit
to HouMinXi/OmniRoute
that referenced
this pull request
Aug 2, 2026
HouMinXi
pushed a commit
to HouMinXi/OmniRoute
that referenced
this pull request
Aug 2, 2026
…w-up cheaper-inference#8006) (cheaper-inference#8510) * feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up cheaper-inference#8006) Upload source images to Firefly storage (POST /v2/storage/image) and attach them as referenceBlobs on generate-async, matching live firefly.adobe.com captures (usage:general for nano multi-ref; usage:subject for gpt-image). Also wire built-in adobe-firefly through OpenAI-compatible POST /v1/images/edits (multipart or JSON data URLs, up to 4 refs) so Media edit-with-references and Open WebUI image-edit hit the same path as image2image generate. Unit suite: tests/unit/adobe-firefly.test.ts 41/41. * test(api): add route-level coverage for Adobe Firefly /v1/images/edits + fix typecheck/file-size drift Covers the referenceBlobs upload path, the 4-reference cap error, and the credentials/rate-limit branches added to the /v1/images/edits route for adobe-firefly (cheaper-inference#8510). Also fixes a Buffer/BodyInit typecheck mismatch in uploadAdobeFireflyImage and corrects the adobeFireflyClient.ts file-size baseline entry to match the gate's actual LOC count (it counts the trailing newline, so the frozen value is 2317, not 2316), plus a testFrozen entry for adobe-firefly.test.ts's own +159 line growth from this PR. Moves the handleAdobeFireflyImageGeneration re-export out of the middle of the import block in imageGeneration.ts for readability. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(security): restore bounded JWT regex quantifiers dropped by edit-route refactor The edits-route extraction (test commit 62785e9) had accidentally reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix from cheaper-inference#8173 (CodeQL cheaper-inference#754/cheaper-inference#755/cheaper-inference#756). Restored the bounded quantifiers; behavior is unchanged (45/45 adobe-firefly tests still pass), only the backtracking bound is back in place. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Poid-ZA
pushed a commit
to Poid-ZA/OmniRoute
that referenced
this pull request
Aug 5, 2026
…r-inference#755) * chore(release): v3.2.8 — Docker auto-update UI and cache analytics fixes * fix(sse): remove race condition in cache metrics tracking (cheaper-inference#758) - Remove in-memory metrics tracking (currentMetrics, trackCacheMetrics, updateCacheMetrics) - Cache metrics now computed on-the-fly from usage_history table (single source of truth) - Fixes CRITICAL issue from code review: concurrent requests overwriting metrics - Fixes WARNING: duplicate metric tracking logic in streaming/non-streaming paths Ref: PR cheaper-inference#752 (merged before this fix was included) * fix: handle allRateLimited credentials & forward extra body keys in embeddings/images routes (cheaper-inference#757) * fix: handle allRateLimited credentials in embeddings and images routes When getProviderCredentials() returns an allRateLimited object (truthy, but without apiKey/accessToken), the embeddings and images routes incorrectly passed it to handlers as valid credentials. The handlers then sent upstream requests without Authorization headers, causing 401 errors from providers (e.g. NVIDIA NIM). This only manifested under concurrent requests: a chat/completions call could trigger rate limiting on a provider account, and a simultaneous embeddings request would receive the allRateLimited sentinel — but treat it as valid credentials. The chat pipeline already handled this case correctly. This commit adds the same allRateLimited guard to all affected routes: - POST /v1/embeddings - POST /v1/providers/{provider}/embeddings - POST /v1/images/generations - POST /v1/providers/{provider}/images/generations Also adds a defense-in-depth guard in the embeddings handler itself: if no auth token is available for a non-local provider, return 401 immediately instead of sending an unauthenticated request upstream. Made-with: Cursor * fix(embeddings): forward extra body keys to upstream providers The embeddings handler only forwarded model, input, dimensions, and encoding_format to upstream providers, silently dropping any additional fields. This broke asymmetric embedding APIs (e.g. NVIDIA NIM nv-embedqa-e5-v5) that require input_type, and other providers expecting user or truncate parameters. Add a KNOWN_FIELDS exclusion set and forward all unrecognized body keys to the upstream request, matching the passthrough pattern used by the chat pipeline's DefaultExecutor.transformRequest(). Made-with: Cursor * fix(auth): redirect and unconditional 401 on disabled requireLogin + fix test cases * fix(build): remove legacy proxy.ts causing Next.js build collision * fix(build): revert middleware.ts rename to proxy.ts because of Next.js Edge constraints --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: tombii <tombii@users.noreply.github.com> Co-authored-by: Gorchakov-Pressure <117600961+Gorchakov-Pressure@users.noreply.github.com>
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…r-inference#755) * chore(release): v3.2.8 — Docker auto-update UI and cache analytics fixes * fix(sse): remove race condition in cache metrics tracking (cheaper-inference#758) - Remove in-memory metrics tracking (currentMetrics, trackCacheMetrics, updateCacheMetrics) - Cache metrics now computed on-the-fly from usage_history table (single source of truth) - Fixes CRITICAL issue from code review: concurrent requests overwriting metrics - Fixes WARNING: duplicate metric tracking logic in streaming/non-streaming paths Ref: PR cheaper-inference#752 (merged before this fix was included) * fix: handle allRateLimited credentials & forward extra body keys in embeddings/images routes (cheaper-inference#757) * fix: handle allRateLimited credentials in embeddings and images routes When getProviderCredentials() returns an allRateLimited object (truthy, but without apiKey/accessToken), the embeddings and images routes incorrectly passed it to handlers as valid credentials. The handlers then sent upstream requests without Authorization headers, causing 401 errors from providers (e.g. NVIDIA NIM). This only manifested under concurrent requests: a chat/completions call could trigger rate limiting on a provider account, and a simultaneous embeddings request would receive the allRateLimited sentinel — but treat it as valid credentials. The chat pipeline already handled this case correctly. This commit adds the same allRateLimited guard to all affected routes: - POST /v1/embeddings - POST /v1/providers/{provider}/embeddings - POST /v1/images/generations - POST /v1/providers/{provider}/images/generations Also adds a defense-in-depth guard in the embeddings handler itself: if no auth token is available for a non-local provider, return 401 immediately instead of sending an unauthenticated request upstream. Made-with: Cursor * fix(embeddings): forward extra body keys to upstream providers The embeddings handler only forwarded model, input, dimensions, and encoding_format to upstream providers, silently dropping any additional fields. This broke asymmetric embedding APIs (e.g. NVIDIA NIM nv-embedqa-e5-v5) that require input_type, and other providers expecting user or truncate parameters. Add a KNOWN_FIELDS exclusion set and forward all unrecognized body keys to the upstream request, matching the passthrough pattern used by the chat pipeline's DefaultExecutor.transformRequest(). Made-with: Cursor * fix(auth): redirect and unconditional 401 on disabled requireLogin + fix test cases * fix(build): remove legacy proxy.ts causing Next.js build collision * fix(build): revert middleware.ts rename to proxy.ts because of Next.js Edge constraints --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: tombii <tombii@users.noreply.github.com> Co-authored-by: Gorchakov-Pressure <117600961+Gorchakov-Pressure@users.noreply.github.com>
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…w-up cheaper-inference#8006) (cheaper-inference#8510) * feat(adobe-firefly): reference image attach + /v1/images/edits (follow-up cheaper-inference#8006) Upload source images to Firefly storage (POST /v2/storage/image) and attach them as referenceBlobs on generate-async, matching live firefly.adobe.com captures (usage:general for nano multi-ref; usage:subject for gpt-image). Also wire built-in adobe-firefly through OpenAI-compatible POST /v1/images/edits (multipart or JSON data URLs, up to 4 refs) so Media edit-with-references and Open WebUI image-edit hit the same path as image2image generate. Unit suite: tests/unit/adobe-firefly.test.ts 41/41. * test(api): add route-level coverage for Adobe Firefly /v1/images/edits + fix typecheck/file-size drift Covers the referenceBlobs upload path, the 4-reference cap error, and the credentials/rate-limit branches added to the /v1/images/edits route for adobe-firefly (cheaper-inference#8510). Also fixes a Buffer/BodyInit typecheck mismatch in uploadAdobeFireflyImage and corrects the adobeFireflyClient.ts file-size baseline entry to match the gate's actual LOC count (it counts the trailing newline, so the frozen value is 2317, not 2316), plus a testFrozen entry for adobe-firefly.test.ts's own +159 line growth from this PR. Moves the handleAdobeFireflyImageGeneration re-export out of the middle of the import block in imageGeneration.ts for readability. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(security): restore bounded JWT regex quantifiers dropped by edit-route refactor The edits-route extraction (test commit 62785e9) had accidentally reverted 4 JWT-extraction regexes in adobeFireflyClient.ts from the bounded {1,4096} quantifier back to unbounded +, undoing the ReDoS fix from cheaper-inference#8173 (CodeQL cheaper-inference#754/cheaper-inference#755/cheaper-inference#756). Restored the bounded quantifiers; behavior is unchanged (45/45 adobe-firefly tests still pass), only the backtracking bound is back in place. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com> --------- Co-authored-by: ikelvingo <im.kelvinwong@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Release v3.2.8
Changes
Tests