Skip to content

[WRONG BRANCH] promote dev onto main for v2.34.0 - #2760

Merged
lidge-jun merged 296 commits into
mainfrom
codex/promote-main-2340
Aug 27, 2026
Merged

[WRONG BRANCH] promote dev onto main for v2.34.0#2760
lidge-jun merged 296 commits into
mainfrom
codex/promote-main-2340

merge dev into main for the v2.34.0 release

e25b653
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Aug 27, 2026 in 3s

53 new alerts including 48 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 48 high
  • 5 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 37 in src/adapters/client-fingerprint.ts

See this annotation in the file changed.

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
an access to apiKey
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to apiKeyProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to apiKeyProvider
Loading
is hashed insecurely.
Password from
an access to oauthProvider
Loading
is hashed insecurely.
Password from
an access to apiKey
Loading
is hashed insecurely.

Check failure on line 828 in src/providers/quota.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
https://api.minimaxi.com
Loading
' may be followed by an arbitrary host name.

Check failure on line 872 in src/providers/quota.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
https://api.moonshot.cn
Loading
' may be followed by an arbitrary host name.

Check failure on line 896 in src/providers/quota.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
https://api.moonshot.cn
Loading
' may be followed by an arbitrary host name.

Check failure on line 2879 in src/providers/registry.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings with many repetitions of '/'.

Check failure on line 498 in src/routing/profile.ts

See this annotation in the file changed.

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from
a call to normalizeApiKeyIds
Loading
is hashed insecurely.
Password from a call to oauthConfig is hashed insecurely.
Password from a call to oauthConfig is hashed insecurely.
Password from a call to oauthConfig is hashed insecurely.

Check failure on line 157 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 188 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 240 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 264 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 280 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 298 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 324 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 348 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 381 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 416 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 452 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 479 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 507 in tests/agent-task-recovery.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
chatgpt.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 331 in tests/provider-quota.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
grok.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 332 in tests/provider-quota.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
anthropic.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 333 in tests/provider-quota.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
cloudcode-pa.googleapis.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 334 in tests/provider-quota.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
cloudcode-pa.googleapis.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 2531 in tests/provider-quota.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
grok.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Check failure on line 509 in tests/subagent-fallback-handle-responses.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
api.openai.com
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.