LocalAI

0 Fork 0

mirror of https://github.com/mudler/LocalAI.git synced 2026-09-21 05:34:56 -04:00

Files

T

Ettore Di Giacinto e7a8ebe531 feat(gallery): resolve entry urls relative to the gallery root

A gallery published as a self-contained tree, which is what an OCI
gallery is, names its base configs by their place in that tree. Such a
url reached the HTTP client verbatim and no entry of the gallery could
be installed.

A scheme-less entry url now resolves against the root the index came
from: the unpacked artifact for an oci:// gallery, and the directory of
the index URL otherwise. The relative path may not climb out of that
root, reusing the guard the artifact puller already applies to layer
titles, and an entry that does is dropped from the listing rather than
failing the whole gallery. An entry that names its own scheme is
untouched, so .ref indirection and local github: resolution behave as
before.

Reading an entry of an OCI gallery also needs the unpacked artifact
directory as its trusted root, since the cache is deliberately a sibling
of the models directory the downloader otherwise confines a file read
to.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]

2026-09-20 22:17:17 +00:00

application

fix(distributed): exclude pinned models from cluster eviction and idle scale-down

2026-09-11 23:08:26 +00:00

backend

feat(kimodocpp): track usage through generic backend metadata (#12162 )

2026-09-20 19:39:06 +01:00

cli

feat(gallery): fetch and verify galleries published as OCI artifacts

2026-09-20 22:04:28 +00:00

clients

security(http): refuse redirects on outbound clients via hardened pkg/httpclient (#10087 )