Skip to content

v3.6.3

Choose a tag to compare

View all tags
@diegosouzapw diegosouzapw released this 11 Apr 21:56
· 2820 commits to main since this release
v3.6.3
6b64702
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

✨ New Features

  • feat(docs): integrate multi-page documentation into OmniRoute dashboard (#1969)

  • feat(settings): add request body limit setting (#1968)

  • feat(auth): add Gemini CLI OAuth client secret default (#1974)

  • feat(models): expose models.dev context windows in /v1/models (#1972)

  • fix(db): resolve legacy encryption fallback causing re-encryption loops (#1941)

  • fix(auth): fix Codex assistant final_answer response sanitization (#1965)

  • feat(providers): Implement Image Generation and Editing capabilities for ChatGPT Web, including in-band chat image generation and caching (#1606).

  • feat(ui): Integrate OpenCode Zen/Go API tool logo SVG and polish API key copy-to-clipboard interactions (#1607).

  • feat(providers): Integrate AgentRouter as a new OpenAI-compatible passthrough provider with $200 free credits via sign-up (Issue #1572).

  • feat(ui): Implement on-demand per-model testing in the provider dashboard, allowing single-token diagnostic checks without triggering rate-limits (Issue #1532).

  • OpenAI-Compatible Loose Validation: Empty API keys can now be naturally submitted and saved for any openai-compatible-* providers (e.g. Pollinations, localized routes) directly in the UI instead of blocking save actions (#1152)

  • Cloudflare Configuration: Updated the provider schema and UI integration for Cloudflare AI to officially expose and support the backend accountId field securely without overrides (#1150)

🐛 Bug Fixes

  • fix(mitm): Compile MITM utilities as NodeNext ESM during prepublish, copy the CommonJS MITM server into the standalone artifact, and resolve MITM data paths without relying on Next.js aliases in packaged runtime.

  • fix(build): Move the local .tmp/wine32 Wine prefix out of the isolated Next.js build path so Windows Electron packaging artifacts cannot trigger EACCES scans during Node 24 builds.

  • fix(build): Copy the wreq-js native runtime directory into the isolated Next.js standalone output so packaged Playwright/E2E starts can load the instrumentation hook on Linux.

  • fix(api): Validate the Codex Responses websocket bridge and /v1/batches JSON payloads with Zod before use, keeping request.json() route validation green and returning explicit 400 responses for invalid bodies.

  • fix(providers): Add explicit typing to provider alias and category helpers so the strict typecheck:noimplicit:core CI gate passes.

  • fix(ui): Keep the upstream proxy provider detail page labeled with a fallback "Managed via Upstream Proxy Settings" management surface when translations are unavailable.

  • fix(electron): Harden the production desktop CSP by removing unsafe-eval outside development and adding object, base URI, form action, frame ancestor, and worker restrictions.

  • fix(cli): Replace shell-interpolated setup and privileged command execution paths with argument-based spawn/execFile helpers for database setup, Tailscale sudo commands, MITM DNS edits, and certificate install/uninstall flows.

  • fix(ui): Keep provider icons resilient by using direct @lobehub/icons components first, then local PNG/SVG fallbacks, avoiding the @lobehub/ui peer runtime in the dashboard.

  • Vertex JSON Validation Crash: Prevented invalid character in header crashes inside the /validate endpoint by creating a native authentication parser that correctly handles Google Identity Service Account JSON flows prior to pinging endpoints (#1153)

  • Extraneous Payload Rejection: Globally prevented upstream 400 Bad Request execution crashes by stripping the non-standard prompt_cache_retention attribute forcibly attached by Cursor/Cline IDE engines when targeting strict OpenAI/Anthropic routes (#1154)

  • Reasoning Content Drop: Prevented pure reasoning packets, common in advanced fallback models like DeepSeek, from being aborted mid-stream by explicitly adjusting the Empty Content (502) circuit breakers to acknowledge reasoning_content states as valid (#1155)

  • Desktop Windows Build Crash: Fixed better_sqlite3.node is not a valid Win32 application preventing OmniRoute Desktop from launching on Windows by properly removing the ABI-mismatched sqlite cache from Next.js standalone and falling back to the cross-compiled Electron equivalent during packager build steps (#1163)

  • Login Visual Security: Removed the raw fallback hash dump that artificially rendered underneath the login modal in Docker instances missing OMNIROUTE_API_KEY_BASE64 flags (#1148)

🔧 Maintenance & Dependencies

  • Dependabot Updates: Safely bumped GitHub Actions docker/build-push-action to v7 and actions/download-artifact to v8
  • Electron Updates: Upgraded desktop wrapper core to Electron 41.2.0 and electron-builder to 26.8.1, incorporating essential V8/Chromium security patches
  • NPM Package Groups: Updated production and development NPM groups to securely handle minor audit warnings and keep toolchains modern
  • CI/CD Reliability: Fixed persistent Snyk token-absence failures on automated pull requests by appropriately bypassing on dependabot actions
Assets 12
Loading