LocalAI

0 Fork 0

mirror of https://github.com/mudler/LocalAI.git synced 2026-09-21 05:34:56 -04:00

Files

T

Ettore Di Giacinto 4398369864 fix(security): justify the last two gosec findings in new code

The frame length conversion is already bounded by the guard three lines
above it, which caps a payload at 1024 bytes and so cannot truncate a
uint16. The agent pick spreads work across workers that are equivalent by
construction, and predicting it buys an attacker nothing.

Both carry a #nosec naming the rule and the reason rather than a silent
suppression, matching the rest of the tree.

Assisted-by: Claude Opus 5 [claude-code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-09-20 03:05:35 +00:00

application

fix(distributed): preserve async staging state

2026-09-20 03:05:35 +00:00

backend

test(distributed): cover binary backend routes

2026-09-20 03:05:35 +00:00

cli

fix(distributed): prove agent worker credentials

2026-09-20 03:05:35 +00:00

clients

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087 )