Skip to content

v2.2.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 22:59
· 127 commits to main since this release
v2.2.8
680ebfa

Security

  • Claude sign-in tokens go only to Anthropic. On OpenCode 1 and OpenCode 2, a Claude sign-in (OAuth) request was sent to whatever server the provider's baseURL named, and a project's opencode.json can set that. Opening such a repository could send your access token to another server. OpenCode now sends OAuth requests only to https://api.anthropic.com, including the address inside relay requests, and refuses anything else locally before the token is used. Pi already worked this way. (#474)

Changed

  • ANTHROPIC_BASE_URL now applies to API-key routes only. It no longer moves Claude sign-in (OAuth) requests. If it points anywhere other than https://api.anthropic.com, OAuth requests are refused, with a message saying why. API-key routes still use it, and their configured baseURL, as before.

To upgrade, quit OpenCode and Pi and run npx @cortexkit/opencode-anthropic-auth setup, or change the version in your OpenCode config.

Assets 2
Loading