From 1eae976b28f38b7ad972680468aae75f7c178556 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Tue, 7 Jul 2026 15:45:14 -0300 Subject: [PATCH] =?UTF-8?q?fix(release):=20v3.8.46=20closing=20=E2=80=94?= =?UTF-8?q?=20proxy=20random=20via=20crypto.randomInt=20(CodeQL=20#698/#69?= =?UTF-8?q?9)=20+=20date=20[3.8.46]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Post-release closing fixes: crypto.randomInt for proxy-pool random rotation (silences CodeQL js/insecure-randomness #698/#699) + date the [3.8.46] CHANGELOG section. See PR #6580. --- CHANGELOG.md | 3 ++- config/quality/file-size-baseline.json | 3 ++- docs/i18n/ar/CHANGELOG.md | 2 +- docs/i18n/az/CHANGELOG.md | 2 +- docs/i18n/bg/CHANGELOG.md | 2 +- docs/i18n/bn/CHANGELOG.md | 2 +- docs/i18n/cs/CHANGELOG.md | 2 +- docs/i18n/da/CHANGELOG.md | 2 +- docs/i18n/de/CHANGELOG.md | 2 +- docs/i18n/es/CHANGELOG.md | 2 +- docs/i18n/fa/CHANGELOG.md | 2 +- docs/i18n/fi/CHANGELOG.md | 2 +- docs/i18n/fr/CHANGELOG.md | 2 +- docs/i18n/gu/CHANGELOG.md | 2 +- docs/i18n/he/CHANGELOG.md | 2 +- docs/i18n/hi/CHANGELOG.md | 2 +- docs/i18n/hu/CHANGELOG.md | 2 +- docs/i18n/id/CHANGELOG.md | 2 +- docs/i18n/in/CHANGELOG.md | 2 +- docs/i18n/it/CHANGELOG.md | 2 +- docs/i18n/ja/CHANGELOG.md | 2 +- docs/i18n/ko/CHANGELOG.md | 2 +- docs/i18n/mr/CHANGELOG.md | 2 +- docs/i18n/ms/CHANGELOG.md | 2 +- docs/i18n/nl/CHANGELOG.md | 2 +- docs/i18n/no/CHANGELOG.md | 2 +- docs/i18n/phi/CHANGELOG.md | 2 +- docs/i18n/pl/CHANGELOG.md | 2 +- docs/i18n/pt-BR/CHANGELOG.md | 2 +- docs/i18n/pt/CHANGELOG.md | 2 +- docs/i18n/ro/CHANGELOG.md | 2 +- docs/i18n/ru/CHANGELOG.md | 2 +- docs/i18n/sk/CHANGELOG.md | 2 +- docs/i18n/sv/CHANGELOG.md | 2 +- docs/i18n/sw/CHANGELOG.md | 2 +- docs/i18n/ta/CHANGELOG.md | 2 +- docs/i18n/te/CHANGELOG.md | 2 +- docs/i18n/th/CHANGELOG.md | 2 +- docs/i18n/tr/CHANGELOG.md | 2 +- docs/i18n/uk-UA/CHANGELOG.md | 2 +- docs/i18n/ur/CHANGELOG.md | 2 +- docs/i18n/vi/CHANGELOG.md | 2 +- docs/i18n/zh-CN/CHANGELOG.md | 2 +- docs/i18n/zh-TW/CHANGELOG.md | 2 +- src/lib/db/proxies.ts | 10 +++++++--- tests/unit/proxy-pool-rotation-6365.test.ts | 6 ++++++ 46 files changed, 59 insertions(+), 47 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e2b0bfa5..bc306bc1a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ --- -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features @@ -142,6 +142,7 @@ - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA. - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186). - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware. +- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` β€” silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up). ### πŸ“ Maintenance diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json index bb479ec3a..4f9b33478 100644 --- a/config/quality/file-size-baseline.json +++ b/config/quality/file-size-baseline.json @@ -1,4 +1,5 @@ { + "_rebaseline_2026_07_07_v3846_proxy_insecure_random": "PR #6580 (v3.8.46 post-release closing fix): proxies.ts 1173->1177 (+4) β€” o fix de seguranΓ§a CodeQL #698/#699 troca Math.random por crypto.randomInt no random rotation strategy (#6365) e adiciona 4 linhas de comentΓ‘rio explicando por que (a seleção flui para credenciais do proxy). Crescimento irreducivel do proprio fix; frozen so encolhe daqui.", "_rebaseline_2026_07_07_v3846_release_close": "Release v3.8.46 Phase 0 (generate-release) β€” drift de ciclo absorvido no fechamento (fast-gates PR->release nao rodam check:file-size). PROD god-files crescidos por merges do ciclo (nao meus; DECOMPOR idealmente, debt #3501): proxies.ts 1060->1173, chat.ts 1681->1751, ApiManagerPageClient.tsx 3058->3120, ProxyRegistryManager.tsx 1125->1437 (feature de proxy). TEST frozen: models-catalog-route.test.ts 1600->1605 (+5 do fix#2 do captain, #6408 catalogo cache), vscode-token-routes.test.ts 1212->1285 (cycle drift + os asserts effort_tiers/supportsThinking do #6241 alinhados no release-PR-CI base-red), que adiciona o import + 2 chamadas do hook __resetCatalogBuilderRunsForTest existente no setup (harness, sem asserts). Shrink estrutural rastreado no roadmap #3501.", "_rebaseline_2026_07_04_v3844_release_close": "Release v3.8.44 Phase 0 (generate-release): drift de ciclo absorvido no fechamento, medido no tip 415d159c8 (fast-gates PR->release nao rodam check:file-size). oauth/[provider]/[action]/route.ts 924->960 (#6054 zed keychain-import 400 gracioso; PR #6158 aberto extrai o guard e restaura o freeze β€” quando mergear, o frozen so encolhe), providerLimits.ts 982->998 (#6139 TOCTOU quota recovery + #6128), chat.ts 1647->1662 (#6057 per-request Auto-Combo X-OmniRoute-Mode/Budget + #6097), auth.ts 2405->2426 (#6139 + #6090 quota preflight lockouts + #5943 codex session affinity). Crescimento irreducivel em chokepoints existentes, coberto por testes por-PR; shrink estrutural rastreado no roadmap #3501.", "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "testFrozen bumps: models-catalog-route 1507->1600, perplexity-web 959->999, route-edge-coverage 1234->1241 (last is my #5975 comment +7). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.", @@ -234,7 +235,7 @@ "src/lib/db/migrationRunner.ts": 1125, "src/lib/db/models.ts": 1259, "src/lib/db/providers.ts": 1107, - "src/lib/db/proxies.ts": 1173, + "src/lib/db/proxies.ts": 1177, "src/lib/db/settings.ts": 1155, "src/lib/db/usageAnalytics.ts": 925, "src/lib/evals/evalRunner.ts": 961, diff --git a/docs/i18n/ar/CHANGELOG.md b/docs/i18n/ar/CHANGELOG.md index 7cb291171..a797adc55 100644 --- a/docs/i18n/ar/CHANGELOG.md +++ b/docs/i18n/ar/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/az/CHANGELOG.md b/docs/i18n/az/CHANGELOG.md index 6991fffe5..9221f2516 100644 --- a/docs/i18n/az/CHANGELOG.md +++ b/docs/i18n/az/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/bg/CHANGELOG.md b/docs/i18n/bg/CHANGELOG.md index 6991fffe5..9221f2516 100644 --- a/docs/i18n/bg/CHANGELOG.md +++ b/docs/i18n/bg/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/bn/CHANGELOG.md b/docs/i18n/bn/CHANGELOG.md index 70130c46c..83d179194 100644 --- a/docs/i18n/bn/CHANGELOG.md +++ b/docs/i18n/bn/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/cs/CHANGELOG.md b/docs/i18n/cs/CHANGELOG.md index a7b11c983..96e0ae32d 100644 --- a/docs/i18n/cs/CHANGELOG.md +++ b/docs/i18n/cs/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/da/CHANGELOG.md b/docs/i18n/da/CHANGELOG.md index 1c786e9ab..d37fd85c1 100644 --- a/docs/i18n/da/CHANGELOG.md +++ b/docs/i18n/da/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/de/CHANGELOG.md b/docs/i18n/de/CHANGELOG.md index d73834699..2191b07fd 100644 --- a/docs/i18n/de/CHANGELOG.md +++ b/docs/i18n/de/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/es/CHANGELOG.md b/docs/i18n/es/CHANGELOG.md index d80050837..bf42c8136 100644 --- a/docs/i18n/es/CHANGELOG.md +++ b/docs/i18n/es/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/fa/CHANGELOG.md b/docs/i18n/fa/CHANGELOG.md index 3ab888be4..fd48c4ec3 100644 --- a/docs/i18n/fa/CHANGELOG.md +++ b/docs/i18n/fa/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/fi/CHANGELOG.md b/docs/i18n/fi/CHANGELOG.md index f8ffb628f..15d5e6abf 100644 --- a/docs/i18n/fi/CHANGELOG.md +++ b/docs/i18n/fi/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/fr/CHANGELOG.md b/docs/i18n/fr/CHANGELOG.md index 92e48e1a9..6542d7fd2 100644 --- a/docs/i18n/fr/CHANGELOG.md +++ b/docs/i18n/fr/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/gu/CHANGELOG.md b/docs/i18n/gu/CHANGELOG.md index 81dae1aa2..f13b630a3 100644 --- a/docs/i18n/gu/CHANGELOG.md +++ b/docs/i18n/gu/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/he/CHANGELOG.md b/docs/i18n/he/CHANGELOG.md index 9b4f5ae70..8bd9c31f4 100644 --- a/docs/i18n/he/CHANGELOG.md +++ b/docs/i18n/he/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/hi/CHANGELOG.md b/docs/i18n/hi/CHANGELOG.md index 6761fd81c..2fedc88fe 100644 --- a/docs/i18n/hi/CHANGELOG.md +++ b/docs/i18n/hi/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/hu/CHANGELOG.md b/docs/i18n/hu/CHANGELOG.md index 696d3b61f..2d5496de6 100644 --- a/docs/i18n/hu/CHANGELOG.md +++ b/docs/i18n/hu/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/id/CHANGELOG.md b/docs/i18n/id/CHANGELOG.md index 40f9f02d0..803d94c22 100644 --- a/docs/i18n/id/CHANGELOG.md +++ b/docs/i18n/id/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/in/CHANGELOG.md b/docs/i18n/in/CHANGELOG.md index dc3bd5d10..9c5ec35b8 100644 --- a/docs/i18n/in/CHANGELOG.md +++ b/docs/i18n/in/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/it/CHANGELOG.md b/docs/i18n/it/CHANGELOG.md index c3115a6be..7f97d3f40 100644 --- a/docs/i18n/it/CHANGELOG.md +++ b/docs/i18n/it/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ja/CHANGELOG.md b/docs/i18n/ja/CHANGELOG.md index 5e0193d2c..415027a22 100644 --- a/docs/i18n/ja/CHANGELOG.md +++ b/docs/i18n/ja/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ko/CHANGELOG.md b/docs/i18n/ko/CHANGELOG.md index 36d3d1771..a06e0636a 100644 --- a/docs/i18n/ko/CHANGELOG.md +++ b/docs/i18n/ko/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/mr/CHANGELOG.md b/docs/i18n/mr/CHANGELOG.md index 1c8e4bbc4..af7da74a4 100644 --- a/docs/i18n/mr/CHANGELOG.md +++ b/docs/i18n/mr/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ms/CHANGELOG.md b/docs/i18n/ms/CHANGELOG.md index d0e96f6ad..065594687 100644 --- a/docs/i18n/ms/CHANGELOG.md +++ b/docs/i18n/ms/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/nl/CHANGELOG.md b/docs/i18n/nl/CHANGELOG.md index 894545551..64de2d608 100644 --- a/docs/i18n/nl/CHANGELOG.md +++ b/docs/i18n/nl/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/no/CHANGELOG.md b/docs/i18n/no/CHANGELOG.md index 71b7db3a5..d30f6e40a 100644 --- a/docs/i18n/no/CHANGELOG.md +++ b/docs/i18n/no/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/phi/CHANGELOG.md b/docs/i18n/phi/CHANGELOG.md index eed25a0c4..af64a2173 100644 --- a/docs/i18n/phi/CHANGELOG.md +++ b/docs/i18n/phi/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/pl/CHANGELOG.md b/docs/i18n/pl/CHANGELOG.md index ab2a3a286..04d0beb10 100644 --- a/docs/i18n/pl/CHANGELOG.md +++ b/docs/i18n/pl/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/pt-BR/CHANGELOG.md b/docs/i18n/pt-BR/CHANGELOG.md index 9f7f39f88..f6671c935 100644 --- a/docs/i18n/pt-BR/CHANGELOG.md +++ b/docs/i18n/pt-BR/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/pt/CHANGELOG.md b/docs/i18n/pt/CHANGELOG.md index 2f1c44c56..59749572c 100644 --- a/docs/i18n/pt/CHANGELOG.md +++ b/docs/i18n/pt/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ro/CHANGELOG.md b/docs/i18n/ro/CHANGELOG.md index 9e250b728..e5ea8952e 100644 --- a/docs/i18n/ro/CHANGELOG.md +++ b/docs/i18n/ro/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ru/CHANGELOG.md b/docs/i18n/ru/CHANGELOG.md index ff581c53a..3c57e6f19 100644 --- a/docs/i18n/ru/CHANGELOG.md +++ b/docs/i18n/ru/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/sk/CHANGELOG.md b/docs/i18n/sk/CHANGELOG.md index 261b7b914..e7ccac3df 100644 --- a/docs/i18n/sk/CHANGELOG.md +++ b/docs/i18n/sk/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/sv/CHANGELOG.md b/docs/i18n/sv/CHANGELOG.md index 875d74ed6..5133caee0 100644 --- a/docs/i18n/sv/CHANGELOG.md +++ b/docs/i18n/sv/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/sw/CHANGELOG.md b/docs/i18n/sw/CHANGELOG.md index 8e46f2f4d..00220fa69 100644 --- a/docs/i18n/sw/CHANGELOG.md +++ b/docs/i18n/sw/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ta/CHANGELOG.md b/docs/i18n/ta/CHANGELOG.md index e6bf98236..101e8390c 100644 --- a/docs/i18n/ta/CHANGELOG.md +++ b/docs/i18n/ta/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/te/CHANGELOG.md b/docs/i18n/te/CHANGELOG.md index e373a85c9..2ec1d797d 100644 --- a/docs/i18n/te/CHANGELOG.md +++ b/docs/i18n/te/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/th/CHANGELOG.md b/docs/i18n/th/CHANGELOG.md index 098e97d9f..f2c856334 100644 --- a/docs/i18n/th/CHANGELOG.md +++ b/docs/i18n/th/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/tr/CHANGELOG.md b/docs/i18n/tr/CHANGELOG.md index 02c308842..b2191034c 100644 --- a/docs/i18n/tr/CHANGELOG.md +++ b/docs/i18n/tr/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/uk-UA/CHANGELOG.md b/docs/i18n/uk-UA/CHANGELOG.md index 08dd3f977..1f7ea3a26 100644 --- a/docs/i18n/uk-UA/CHANGELOG.md +++ b/docs/i18n/uk-UA/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/ur/CHANGELOG.md b/docs/i18n/ur/CHANGELOG.md index 458001953..bfdea4949 100644 --- a/docs/i18n/ur/CHANGELOG.md +++ b/docs/i18n/ur/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/vi/CHANGELOG.md b/docs/i18n/vi/CHANGELOG.md index b6fbd633b..31107e4de 100644 --- a/docs/i18n/vi/CHANGELOG.md +++ b/docs/i18n/vi/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/zh-CN/CHANGELOG.md b/docs/i18n/zh-CN/CHANGELOG.md index 3688ceceb..49ec2c3b6 100644 --- a/docs/i18n/zh-CN/CHANGELOG.md +++ b/docs/i18n/zh-CN/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/docs/i18n/zh-TW/CHANGELOG.md b/docs/i18n/zh-TW/CHANGELOG.md index f065bf3fb..0c0d2726c 100644 --- a/docs/i18n/zh-TW/CHANGELOG.md +++ b/docs/i18n/zh-TW/CHANGELOG.md @@ -6,7 +6,7 @@ ## [3.8.31] β€” 2026-06-20 -## [3.8.46] β€” TBD +## [3.8.46] β€” 2026-07-07 ### ✨ New Features diff --git a/src/lib/db/proxies.ts b/src/lib/db/proxies.ts index 6806e3a86..220725d08 100755 --- a/src/lib/db/proxies.ts +++ b/src/lib/db/proxies.ts @@ -3,7 +3,7 @@ // (Vercel Edge, Deno Deploy, or Cloudflare Workers) instead of an undici ProxyAgent. All relay // types share the exact same x-relay-target / x-relay-path / x-relay-auth header spec; only the // deployment surface differs. -import { randomUUID } from "crypto"; +import { randomUUID, randomInt } from "crypto"; import { getDbInstance } from "./core"; import { backupDbFile } from "./backup"; import type { @@ -722,7 +722,7 @@ function getOrCreateRotationRow( /** * Pick one member from an already-alive candidate list according to the scope's * rotation strategy. Assumes `candidates` is non-empty and ordered by position. - * Round-robin uses (and persists) a monotonic cursor; random uses Math.random; + * Round-robin uses (and persists) a monotonic cursor; random uses crypto.randomInt; * sticky holds the current member until its window elapses, then advances. */ function pickFromCandidates( @@ -736,7 +736,11 @@ function pickFromCandidates( const state = getOrCreateRotationRow(db, normalizedScope, rotationScopeId); if (state.strategy === "random") { - return candidates[Math.floor(Math.random() * candidates.length)]; + // crypto.randomInt (unbiased, uniform in [0, length)) instead of Math.random β€” + // CodeQL js/insecure-randomness flags Math.random flowing into the selected proxy's + // credentials (a "security context"). Load-balancing selection is not a secret, but + // crypto.randomInt silences the alert at the source and is unbiased (#6365 follow-up). + return candidates[randomInt(candidates.length)]; } if (state.strategy === "sticky") { diff --git a/tests/unit/proxy-pool-rotation-6365.test.ts b/tests/unit/proxy-pool-rotation-6365.test.ts index 3041c3b3c..02c21457a 100644 --- a/tests/unit/proxy-pool-rotation-6365.test.ts +++ b/tests/unit/proxy-pool-rotation-6365.test.ts @@ -166,11 +166,17 @@ test("random strategy always returns a member of the alive set", async () => { await proxiesDb.setScopeRotationStrategy("provider", "mistral", "random"); const aliveHosts = new Set([a.host, b.host, c.host]); + const seen = new Set(); for (let i = 0; i < 30; i++) { const r = await proxiesDb.resolveProxyForScopeFromRegistry("provider", "mistral"); const host = (r as { proxy: { host: string } }).proxy.host; assert.ok(aliveHosts.has(host), `random pick ${host} must be an alive pool member`); + seen.add(host); } + // The random strategy uses crypto.randomInt (not Math.random β€” CodeQL js/insecure-randomness). + // Over 30 picks from a 3-member alive pool it must vary, not stick on one member + // (P(all 30 identical) β‰ˆ (1/3)^29 β‰ˆ 0). Guards that randomInt selection is uniform-ish. + assert.ok(seen.size >= 2, `random strategy must vary its pick (saw only: ${[...seen].join(", ")})`); }); test("setScopeRotationStrategy round-trips via getScopeRotationStrategy", async () => {