fix(security): empty whitelist allows through to prevent admin lockout - #13534

Merged

diegosouzapw merged 33 commits into

diegosouzapw:release/v3.8.51from

KooshaPari:pr/13176-ip-whitelist-empty

Sep 15, 2026

Commits on Sep 13, 2026

fix: chain serial quarantine step in npm test script (fixes #13286)
Koosha Pari
committed
a16dad6
fix(security): allow through when whitelist is empty to prevent admin lockout (#13176)
Koosha Pari
committed
c07a5db

Commits on Sep 14, 2026

chore(tests): revive 51 vitest files parked behind a closed tracker (#13204) (#13233)
diegosouzapw
authored
f7dbfc8
fix(nvidia): fail open when a synced model catalog goes stale (#12849) (#13248)
diegosouzapw
authored
30bf6af
fix(ci): clear three base-reds on release/v3.8.51 — open-sse typecheck, docs provider count, agent-skills sync (#13216)
diegosouzapw
authored
963d3c4
feat(i18n): 8 new locales — Kannada, Malayalam, Odia, Punjabi, Nepali, Sinhala, Burmese, Khmer (59 locales) (#13660)
diegosouzapw
authored
0d13ef4
docs(i18n): sync provider and migration counts in the eight new llm.txt mirrors (#13674)
diegosouzapw
authored
8f36211
fix(ci): clear the orphan base-reds on release/v3.8.51 — the #12867 pipeline extraction, a legacy-DB boot abort and the catalog readers (#13349)
diegosouzapw
authored
8786c17
fix(ci): clear the base-reds on release/v3.8.51 — doc counts, catalog test flake, pack provenance + pack policy (#12959)
diegosouzapw
authored
895dda3
fix(api): scope batch bulk-delete to the calling API key (#12969)
diegosouzapw
authored
5ca724d

Navigation Menu

Uh oh!

fix(security): empty whitelist allows through to prevent admin lockout - #13534

fix(security): empty whitelist allows through to prevent admin lockout#13534
diegosouzapw merged 33 commits into
diegosouzapw:release/v3.8.51from
KooshaPari:pr/13176-ip-whitelist-empty

Commits on Sep 13, 2026

fix: chain serial quarantine step in npm test script (fixes #13286)

fix(security): allow through when whitelist is empty to prevent admin lockout (#13176)

Commits on Sep 14, 2026

chore(tests): revive 51 vitest files parked behind a closed tracker (#13204) (#13233)

fix(nvidia): fail open when a synced model catalog goes stale (#12849) (#13248)

fix(ci): clear three base-reds on release/v3.8.51 — open-sse typecheck, docs provider count, agent-skills sync (#13216)

feat(i18n): 8 new locales — Kannada, Malayalam, Odia, Punjabi, Nepali, Sinhala, Burmese, Khmer (59 locales) (#13660)

docs(i18n): sync provider and migration counts in the eight new llm.txt mirrors (#13674)

fix(ci): clear the orphan base-reds on release/v3.8.51 — the #12867 pipeline extraction, a legacy-DB boot abort and the catalog readers (#13349)

fix(ci): clear the base-reds on release/v3.8.51 — doc counts, catalog test flake, pack provenance + pack policy (#12959)

fix(api): scope batch bulk-delete to the calling API key (#12969)

Commits on Sep 15, 2026

fix: chain serial quarantine step in npm test script (fixes #13286) (#13418)

fix(logging): mask *-api-key headers in request-log pipeline (#13273) (#13401)

fix(tests): correct stale Jina catalog prefix in custom-models test (#13403)

fix(backend): prune old backups after health-check-repair snapshots (#13308) (#13404)

feat(mcp): carry context_length through MCP list_models_catalog projection (#12776) (#13406)

fix: skip non-chat generation models in Test all models (#13409)

fix(resilience): add CJK quota-exhaustion patterns to 429 classifier (#13412)

fix(backend): eval runner: failed calls no longer score as passed + dotAll regex (#13413)

fix(backend): eval runner opts out of output-style and memory injection (#13414)

fix(dashboard): send provider in body for mini-playground web search (#13411)

fix(providers): de-duplicate agy and antigravity model catalogs (#13410)

fix(memory): merge memory into top-level system field instead of unshifting at messages[0] (#13425) (#13427)

feat(cli): make startup readiness budget configurable (#13369) (#13433)

docs(providers): add Microsoft 365 Copilot (BizChat) provider guide (#12779) (#13340)

fix(tests): add DISABLE_IOREG_STRATEGY env var for macOS test compatibility (fixes #13467) (#13539)

fix(combo): use traceId for call log id to prevent UNIQUE constraint failure (#13546)

fix(auth): check model lockout before returning synthetic noauth connection (#13547)

fix(compression): preserve instruction blocks from lossy engines (#13523)

fix(compression): preserve polarity words and newlines in ultra heuristic (#13524)

fix(compression): run user preservePatterns before built-in patterns (#13457) (#13525)

fix(resilience): increase requestQueue.maxWaitMs default from 15s to 30s (#13553)

Merge release/v3.8.51 into #13534

test(security): align whitelist dynamic-update contract with empty-list fail-open (#13176)