Skip to content

v2.18.0 — AI Model Migration & Security Hardening

Choose a tag to compare

View all tags
@gitayam gitayam released this 16 Apr 22:57
· 815 commits to main since this release
v2.18.0
c33e26c

Summary

Complete migration from deprecated gpt-4o-mini to gpt-5.4-mini across the entire codebase (62 files), plus security fixes and frontend error handling improvements.

Security Fixes

  • IDOR on analysis status endpoint — scoped queries to authenticated user, preventing cross-user data access
  • Missing auth on status endpoint — added authentication check
  • Broken AI gateway call — fixed wrong function signature in extract-claim-entities.ts that was silently failing
  • 401 error handling — 8 frontend pages now show "Please log in" instead of generic errors (27+ fetch calls)

AI Model Migration (62 files)

  • All 40+ API endpoints migrated from gpt-4o-mini → gpt-5.4-mini
  • Config & types updated from gpt-5-mini/gpt-5-nano → gpt-5.4-mini/gpt-5.4-nano
  • reasoning_effort: 'none' added wherever temperature is used (required for gpt-5.4-*)
  • max_tokens → max_completion_tokens in all API calls (deprecated param)
  • verbosity removed from Chat Completions calls (Responses API only)
  • Pricing updated to actual gpt-5.4-* rates ($0.75/$4.50 mini, $0.20/$1.25 nano, $2.50/$15.00 full)
  • KV config migration — old model names auto-normalized on settings load
  • AIPreferences crash guard — null guard for unknown model values from KV

Other Improvements

  • CSP updated to allow Cloudflare Web Analytics (static.cloudflareinsights.com)
  • Research API documentation expanded from 4 to 15 endpoints
  • Config validation error messages corrected
  • Stale model references in UI text updated

🤖 Generated with Claude Code

Assets 2
Loading