Repository navigation
Merge main back into nightly after v2026.10.01 - #385
Merged
Merged
Conversation
…-2026-10-01-iax78p # Conflicts: # config/config.js
…ear time Background: CodeQL flagged /\/+$/ on the Claude API URL as a polynomial regular expression: on a value made of many slashes it backtracks quadratically. The same pattern was added for the Claude OCR base URL. Changes: - createAnthropicClient() and MistralOcrService.apiBase (anthropic branch) use the existing stripTrailingSlashes() helper from serviceUtils, which scans once from the end. Testing: - node scripts/run-tests.js --all: 117 passed, 0 failed - ESLint and Prettier clean on both files Impact: Same result for every URL; no quadratic cost on crafted input. Upstream Status: Not applicable (fork-only provider). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012u2T47w6ynKbZ2rxoc4Gf4
Background: The settings AI and OCR test/model endpoints treat an empty key field as "use the stored key". For Claude they did so whatever URL the request named, so a signed-in caller could send apiUrl=https://some.host with an empty key and receive ANTHROPIC_API_KEY (or the Claude OCR_API_KEY) in the x-api-key header. The same file already refuses this for Quickstart (resolveSettingsQuickstartApiKey); Claude did not follow that rule. Changes: - anthropicSupport: isConfiguredAnthropicHost() accepts an empty URL, ANTHROPIC_API_URL (empty = api.anthropic.com) and, while Claude is the OCR provider, OCR_API_URL. - routes/setup.js: resolveSettingsAiToken() and resolveOcrApiKeyForProvider() withhold the stored Claude key from any other host. Typed keys are unchanged. - setupService.resolveAnthropicOcrConnection(): the ANTHROPIC_API_KEY fallback follows the same rule, which also covers the setup routes. - Tests: the stored-key case now configures its host; a new case checks that AI models, OCR models and the OCR connection get no stored key for an unconfigured host (fails without the fix). Testing: - node scripts/run-tests.js --all: 117 passed, 0 failed - ESLint and Prettier clean on changed files, no OpenAPI drift Impact: No change for the settings page, which sends the configured URL. Testing a new proxy URL now needs the key typed in, as with Quickstart. Upstream Status: Not applicable (fork-only provider). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012u2T47w6ynKbZ2rxoc4Gf4
Background: Release v2026.10.01 now ships everything on nightly, including single sign-on (contributed in #372), the regrouped settings page and the auth fixes that came with #372. The changelog block only listed the Anthropic work. Changes: - Add entries for OpenID Connect single sign-on (credited to @krauseerl, #372), SSO on the settings page, the regrouped settings page, the Claude model dropdown and the login, TOTP and health hardening. Testing: - node scripts/run-tests.js --all: 122 passed, 6 skipped, 0 failed - eslint and prettier on config/changelog.js clean; OpenAPI unchanged Impact: Changelog text only. Upstream Status: Not applicable (fork-specific release notes). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012u2T47w6ynKbZ2rxoc4Gf4
Background: CodeQL flagged the /\/+$/ regex in oidcService.stripTrailingSlash() as a polynomial regular expression on user-provided data (the issuer URL from the settings page and the SSO test endpoint). Changes: - stripTrailingSlash() delegates to stripTrailingSlashes() from services/serviceUtils.js, which walks back over '/' characters. Testing: - node scripts/run-tests.js --all: 122 passed, 6 skipped, 0 failed - eslint and prettier on services/oidcService.js clean Impact: Same result for every input, no backtracking. Upstream Status: Not applicable (OIDC exists only in this fork). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012u2T47w6ynKbZ2rxoc4Gf4
…10-01-iax78p Release v2026.10.01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before:
nightlyis missing three fixes that only went in through the release PR #384. Two are Anthropic fixes: a linear-time trailing-slash strip for the Claude API URL, and the stored Claude key is sent only to a configured host. The third is a linear-time trailing-slash strip for the OIDC issuer URL. The changelog entries for single sign-on are missing there too.After:
nightlymatchesmainand carries all of them.How: a plain merge of
mainintonightly, which goes through without conflicts.🤖 Generated with Claude Code
https://claude.ai/code/session_012u2T47w6ynKbZ2rxoc4Gf4
Generated by Claude Code