Ettore Di Giacinto 66e5407c88 fix(addons): accept same-host browser requests that carry no fetch metadata ...

Browsers do not send Sec-Fetch-* headers over plain HTTP on an address
that is not localhost, so every add-on request from a LAN address was
refused as cross-site. Keep refusing a Sec-Fetch-Site value other than
same-origin. When the header is absent, accept the request only if its
Origin, or failing that its Referer, names the same host and port as
the request.

Assisted-by: Claude Code:claude-sonnet-5-5 go
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-20 20:54:44 +00:00

..

addons

fix(addons): accept same-host browser requests that carry no fetch metadata

2026-10-20 20:54:44 +00:00

anthropic

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

elevenlabs

fix(sound): enumerate expansion keys (#12787)

2026-10-20 13:14:49 +02:00

explorer

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

jina

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

localai

fix(gosec): tighten file modes and annotate false positives

2026-10-20 20:54:43 +00:00

mcp

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

ollama

fix(ollama): report on-disk size for /api/tags and /api/ps (#11989)

2026-09-28 00:11:41 +02:00

openai

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

openresponses

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00