Ettore Di Giacinto 2de5ce7cae fix(addons): keep API keys off recovery mutations and same-site cookies ...

POST /api/addons/dispatch forwarded the recovery and update
mutations to the owner for any administrator key, which skipped the
browser-session rule of their own routes. Refuse those actions
there. Also apply the same-origin rule to the legacy token cookie,
not only the session cookie, because the global CSRF check lets
same-site requests through.

Do not fail the start of LocalAI when an add-on library cannot be
refreshed; log it and keep the installed add-ons up.

Assisted-by: Claude Code:claude-sonnet-5-5 go
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-20 20:54:43 +00:00

..

auth

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

endpoints

fix(addons): keep API keys off recovery mutations and same-site cookies

2026-10-20 20:54:43 +00:00

middleware

feat(config): let model aliases carry an opt-in profile block (system prompt, MCP, client tools) (#12661)

2026-10-19 23:42:40 +02:00

react-ui

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

routes

fix(gosec): tighten file modes and annotate false positives

2026-10-20 20:54:43 +00:00

static

fix(ui): omit empty system prompt so model default applies (#11838)

2026-09-02 11:58:23 +00:00

views

feat(realtime): WebRTC support (#8790)

2026-03-13 21:37:15 +01:00

admission_handler_test.go

fix: return correct HTTP status codes for saturation and no-nodes-available (#12113)

2026-09-28 00:11:51 +02:00

app_test.go

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

app.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

body_limit_test.go

feat: Add 3d generation UI/API and trellis2cpp backend (#10979)

2026-07-29 16:15:04 +02:00

csrf_multipart_test.go

fix(auth): require validated header credentials for CSRF exemption (#12185)

2026-09-22 04:35:09 +01:00

diagnostics_test.go

test: fix lint failures after ESRGAN merge (#12623)

2026-10-11 00:53:06 +02:00

embeddings_pooling_test.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

explorer.go

chore(refactor): move logging to common package based on slog (#7668)

2025-12-21 19:33:13 +01:00

http_suite_test.go

refactor(tests): split app_test.go, move real-backend coverage to e2e-backends

2026-04-27 23:09:20 +00:00

model_loading_held_test.go

fix(distributed): bound, stop and cancel model loads with leases and worker operations (#12524)

2026-10-07 16:59:56 +02:00

openresponses_test.go

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

render.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

route_coverage_test.go

fix(ci): capture and surface ginkgo errors in run-coverage.sh (#12765)

2026-10-19 08:09:26 +02:00

static_cache_test.go

perf(http): gzip responses, cache hashed assets, bound the trace endpoints (#11056)

2026-07-22 22:51:25 +02:00

testport_test.go

chore: remove local pre-commit gates (#11116)

2026-07-25 01:19:32 +02:00