hamsa0x7 d8c2298d07 fix(security): patch 5 vulnerabilities from security audit ...

- mask API keys in usage stats/history responses (apiKeyMasked)
- validate proxy URL scheme + reject shell metachars before env write
- escape HTML in OAuth callback page to prevent XSS
- atomic O_EXCL lock file to prevent TOCTOU race in MITM startServer
- set mitmIsRestarting guard synchronously before any await

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-06-26 11:04:51 +07:00

..

auth

fix(security): re-auth on DB export/import + SSRF guard on web fetch

2026-06-13 11:40:35 +07:00

db

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

headroom

fix(headroom): support Docker sidecar proxy

2026-06-21 17:45:27 +07:00

mcp

feat(cowork): re-enable Claude Cowork with preset-only stdio MCP

2026-06-08 15:35:37 +07:00

network

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

oauth

fix(security): patch 5 vulnerabilities from security audit

2026-06-26 11:04:51 +07:00

qoder

refactor(open-sse): registry consolidation + DRY media/oauth/adhoc cleanup

2026-06-14 13:15:48 +07:00

tunnel

fix(auth): real client IP rate-limiting + remote default-password guard

2026-06-08 12:10:02 +07:00

updater

chore: release v0.4.27

2026-05-09 22:48:07 +07:00

appUpdater.js

# v0.4.29 (2026-05-10)

2026-05-10 21:56:40 +07:00

consoleLogBuffer.js

Fix usage logging dedupe and reduce stats churn

2026-06-26 10:22:20 +07:00

dataDir.js

fix(mitm): update Kiro API endpoint to runtime.us-east-1.kiro.dev

2026-06-08 09:43:45 +07:00

disabledModelsDb.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

localDb.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

mitmAliasCache.js

# v0.4.29 (2026-05-10)

2026-05-10 21:56:40 +07:00

providerNormalization.js

feat(xai): add xAI Grok provider with OAuth + API key auth + image

2026-05-21 11:33:18 +07:00

requestDetailsDb.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00

usageDb.js

feat(db): migrate from lowdb to SQLite with repos pattern

2026-05-09 17:48:20 +07:00