v0.11.1

Highlights

A hardening release carrying the fixes from the extension-wide code review.

The setup wizard now goes through the vault's secure HTTP client. Model
discovery and configuration generation dispatch via nr-vault's SSRF-guarded
client with an explicit host pre-check, so a malicious or mistyped endpoint
URL can no longer point the wizard at private networks or cloud metadata
addresses.

Streaming failures surface instead of vanishing. All seven provider
adapters validate the streaming response: client errors raise a typed,
credential-sanitized provider exception and other failures a connection
exception — previously a failed stream could surface as an empty response.
Error sanitization is consistent across adapters (credential query parameters
are always redacted; testConnection() keeps details server-side).

Text and config edge cases. Over-limit TTS text is hard-split
multibyte-safely (no more UTF-8 sequences cut mid-character), FAL polling
clamps a zero poll interval instead of busy-looping, and Whisper configuration
values are type-guarded with a proper default base URL.

Installation

composer require netresearch/nr-llm

Publication status

• TER: extensions.typo3.org/extension/nr_llm — 0.11.1 verified
• Packagist: packagist.org/packages/netresearch/nr-llm — 0.11.1 verified
• Documentation: docs.typo3.org/p/netresearch/nr-llm/0.11/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-llm-0.11.1.zip.bundle \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-llm-0.11.1.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.