Ettore Di Giacinto 2009506233 fix(addons): read the loopback port file through os.Root ...

The persisted port file was read with a path built from the add-on
root, which gosec reports as a file inclusion through a variable. Open
it through os.Root so the name cannot leave the root, even by a
symbolic link, and require a regular file with no group or other
access. A looser file now fails closed instead of being trusted.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-20 21:40:01 +00:00

..

addons

fix(addons): read the loopback port file through os.Root

2026-10-20 21:40:01 +00:00

advisorylock

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

agentpool

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

agents

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

chathistory

feat(chat-history): server-side chat history with tombstones (follow-up to #9902) (#12663)

2026-10-19 22:52:07 +02:00

cloudproxy

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

compression

feat(chat): add end-to-end context compression (#11556)

2026-08-18 11:31:03 +00:00

dbutil

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

distributed

feat(ui): replace the stacked operations bar with a one-line strip and an Activity page (#11163)

2026-07-28 19:33:48 +02:00

facerecognition

feat(faces): replay saved face enrollments (#11908)

2026-09-07 17:40:27 +02:00

failover

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

finetune

fix(gosec): tighten file modes and annotate false positives

2026-10-20 20:54:43 +00:00

galleryop

fix: stop listing the models directory on request paths and cache GGUF header reads (#12683)

2026-10-14 01:06:14 +02:00

jobs

chore: fix some function names in comment (#12517)

2026-10-06 17:26:03 +02:00

mcp

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00

messaging

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

modeladmin

feat(diagnostics): add opt-in profiling (#12610)

2026-10-10 20:27:28 +02:00

monitoring

feat(ui): show running models and host gauges on single-node installs (#12189)

2026-09-21 19:12:35 +02:00

nodes

feat(tts): stream Qwen text and add assistant preset (#12770)

2026-10-19 12:30:52 +02:00

quantization

fix(gosec): tighten file modes and annotate false positives

2026-10-20 20:54:43 +00:00

routing

feat(pii): apply PII middleware to the Open Responses API (#12708)

2026-10-19 23:39:56 +02:00

skills

refactor(agents): bump skillserver, drop redundant Name from list_skills output (#9916)

2026-05-21 14:45:53 +02:00

storage

feat: track files being staged (#9275)

2026-04-08 14:33:58 +02:00

syncstate

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00

testutil

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00

voiceprofile

feat(tts): support multi-reference personalities

2026-09-11 21:56:08 +00:00

voicerecognition

feat(voice-detect): report the encoder family so audio-registered voices are fingerprinted (#12499)

2026-10-08 19:26:11 +02:00

worker

fix(backends): prefer installed development builds (#12782)

2026-10-19 22:58:38 +02:00

workerctl

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00