Armin Ronacher 89c921d8b5 fix: harden handling of untrusted URLs, terminal text, and streamed data ... - ai: OAuth logins only accept http(s) URLs from servers (shared trustedHttpUrl, now also checked by Radius); pi-messages rejects contentIndex values that are not the next or an existing block; the CLI auth file is written with mode 0600 - ai: OpenCode DeepSeek V4.1 Flash (renamed from V4 Flash upstream) no longer sends prompt_cache_retention - tui: setTitle() replaces control characters; export replaceControlCharacters() - coding-agent: the login dialog only opens web URLs and never prints control characters from sign-in, device-code, or info URLs - durable: partial commits no longer merge a new __proto__ member into Object.prototype		2026-10-26 20:46:31 +01:00
..
agent	fix(ai,chord,durable,coding-agent): parse streamed tool-call arguments incrementally (fixes #9265)	2026-10-24 08:00:07 +00:00
ai	fix: harden handling of untrusted URLs, terminal text, and streamed data	2026-10-26 20:46:31 +01:00
chord	perf(chord): cheaper container copies in Delta's tracker and applyImmutable	2026-10-24 16:56:53 +00:00
codemode	fix: update deps for security advisories	2026-10-22 11:24:50 +02:00
coding-agent	fix: harden handling of untrusted URLs, terminal text, and streamed data	2026-10-26 20:46:31 +01:00
durable	fix: harden handling of untrusted URLs, terminal text, and streamed data	2026-10-26 20:46:31 +01:00
env	fix: update deps for security advisories	2026-10-22 11:24:50 +02:00
evals	fix(evals): drop autoevals dependency	2026-10-22 23:32:38 +02:00
mcp	fix(ai,chord,durable,coding-agent): parse streamed tool-call arguments incrementally (fixes #9265)	2026-10-24 08:00:07 +00:00
telemetry	fix: update deps for security advisories	2026-10-22 11:24:50 +02:00
tui	fix: harden handling of untrusted URLs, terminal text, and streamed data	2026-10-26 20:46:31 +01:00