Skip to content

v1.4.536

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 21:56
· 19 commits to main since this release
v1.4.536
bd7a4ee

Changes

PR #2289 by pcbeingused333 and ksylvan: fix(plugins): refuse plaintext http to remote hosts for OpenAI, Exolab and Codex

  • Fixed a security issue where plaintext HTTP connections to remote hosts could expose API keys and prompts; OpenAI-compatible clients, Exolab, and Codex now require HTTPS.
  • Allowed HTTP only for localhost, loopback addresses, and *.localhost, leaving all built-in defaults unchanged.
  • Tightened server bind authentication by requiring API keys for binds using localhost subdomains.
  • Consolidated Codex authentication and API endpoint security checks, with shared loopback detection across endpoint validation and middleware.
  • Localized base URL validation errors across all supported locales.
  • If you use an http:// base URL to a host other than localhost, change it to https:// or use a local tunnel. Otherwise the vendor is not loaded. Run with --debug=3 to see the reason.
Assets 11
Loading