Ettore Di Giacinto 2de5ce7cae fix(addons): keep API keys off recovery mutations and same-site cookies ...

POST /api/addons/dispatch forwarded the recovery and update
mutations to the owner for any administrator key, which skipped the
browser-session rule of their own routes. Refuse those actions
there. Also apply the same-origin rule to the legacy token cookie,
not only the session cookie, because the global CSRF check lets
same-site requests through.

Do not fail the start of LocalAI when an add-on library cannot be
refreshed; log it and keep the installed add-ons up.

Assisted-by: Claude Code:claude-sonnet-5-5 go
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-20 20:54:43 +00:00

..

addon_admin_auth_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_admin_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_engine_jobs_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_gateway.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_host_ops_auth_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_host_ops_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_pin_store_internal_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_pin_sweep_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_pins_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addon_pins.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addons_auth_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addons_other_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

addons_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

agent_jobs.go

feat(distributed): SyncedMap component + migrate finetune/quant/agent-tasks to cross-replica state (#10542)

2026-06-27 23:23:51 +02:00

agent_pool_options_test.go

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00

application_suite_test.go

feat(branding): admin-configurable instance name, tagline, and assets (#9635)

2026-05-02 15:51:36 +02:00

application.go

fix(addons): keep API keys off recovery mutations and same-site cookies

2026-10-20 20:54:43 +00:00

chat_history_store_test.go

fix(chat-history): create the store after the auth database is opened (#12788)

2026-10-20 18:09:02 +02:00

config_file_watcher.go

fix(gallery): verification follow-ups for oci:// galleries (#12243)

2026-09-24 21:20:21 +02:00

decision_runner.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

development_preference_test.go

fix(backends): prefer installed development builds (#12782)

2026-10-19 22:58:38 +02:00

distributed.go

fix: stop listing the models directory on request paths and cache GGUF header reads (#12683)

2026-10-14 01:06:14 +02:00

failover_distributed_test.go

fix(failover): keep the probe leader until its session ends

2026-09-27 07:42:20 +00:00

failover_distributed.go

fix(failover): free the leader lock soon after the leader's host dies

2026-09-27 07:42:20 +00:00

failover_test.go

fix(failover): never load a warm target inside a probe

2026-09-27 07:42:20 +00:00

failover.go

feat(failover): run one prober per cluster and pin warm targets on workers

2026-09-27 07:42:20 +00:00

mitm_test.go

fix(router): production-ready request router + auto-size batch for embedding/rerank (#10104)

2026-06-12 16:21:15 +02:00

mitm.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

model_artifact_materializer_test.go

feat: materialize Hugging Face model artifacts (#10825)

2026-07-15 01:09:33 +02:00

model_files_test.go

fix(distributed): stage the files a model install declares (#12309)

2026-09-28 08:34:56 +02:00

model_files.go

fix(distributed): stage the files a model install declares (#12309)

2026-09-28 08:34:56 +02:00

optional_services_test.go

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

p2p.go

fix(p2p): serialize access to p2pCtx/p2pCancel (#10839) (#10861)

2026-07-17 09:02:05 +02:00

pii_policy_test.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

readiness_test.go

fix(http): make /readyz reflect startup readiness, plus gitignore and coverage-ratchet fixes (#10989)

2026-07-20 21:45:27 +02:00

router_factories_test.go

fix(routing): keep embedder fingerprint stable across probed reasoning

2026-10-13 08:06:49 +00:00

router_factories.go

fix(routing): keep embedder fingerprint stable across probed reasoning

2026-10-13 08:06:49 +00:00

runtime_settings_branding_test.go

refactor(settings): single declarative registry for runtime settings (fixes the #10845 bug class) (#10864)

2026-07-16 22:39:59 +02:00

runtime_settings_galleries_test.go

fix(gallery): verification follow-ups for oci:// galleries (#12243)

2026-09-24 21:20:21 +02:00

startup_auth_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

startup.go

fix(gosec): tighten file modes and annotate false positives

2026-10-20 20:54:43 +00:00

upgrade_checker.go

fix(distributed): make per-node backend upgrade actually upgrade (#10838)

2026-07-15 09:16:55 +02:00

watchdog_test.go

fix(watchdog): guard StopWatchdog with watchdogMutex to prevent double close (#10841) (#10859)

2026-07-16 09:40:29 +02:00

watchdog.go

feat(failover): run the chain manager and keep warm targets loaded

2026-09-27 07:42:20 +00:00