Merge origin/main into release/v3.8.38

Browse source

Reconcile the security hotfix #5129 (exact-host Anthropic baseUrl check,
CodeQL js/incomplete-url-substring-sanitization #674) landed on main into
the active release branch.

Only conflict: open-sse/executors/default.ts import block. Resolved to the
release superset — release already independently carries the #5129 logic
(isOfficialAnthropicBaseUrl import + exact-host check, auto-merged) and adds
normalizeAnthropicHeaderVariants on top, so both imports are kept. No
security change is dropped; anthropicHost.ts and its test are byte-identical
on both branches.

...

This commit is contained in:

Diego Rodrigues de Sa e Souza 2026-06-27 08:22:13 -03:00

parent 16449d4874 b3207ab010

commit ae6e2342d1

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

Diff content is not available