fix(security): pin resolved IP in WebClient to eliminate DNS rebinding #964

Open

theonlychant wants to merge 15 commits intoamd:feature/chat-agent-file-navigationfrom

theonlychant:fix/dns-rebinding-ssrf

Commits on May 5, 2026

Feat/optional governance layer (#921)

authored and
theonlychant
committed
feat(ui): friendly ngrok tunnel diagnostics + cookie auth for mobile (#872)

kovtcharov
authored and
theonlychant
committed
docs(deployment): remove RAUX/Open-WebUI references from docs (#931)

itomek
authored and
theonlychant
committed
docs(contributing): refresh issue/PR templates and contributing guide (#930)

itomek
authored and
theonlychant
committed
fix(webui): fix fresh-install crash on first launch (#934) (#935)

authored and
theonlychant
committed
chore(release): v0.17.5 (#940)

authored and
theonlychant
committed
release: v0.17.5 notes + bump to 0.17.6 for development

github-actions[bot]
authored and
theonlychant
committed
fix(installer): resolve default model falling back to Qwen on Windows (#949)
theonlychant
committed
feat(connections): OAuth PKCE for Google (#915, baseline for connectors framework) (#926)

itomek
authored and
theonlychant
committed
chore(github): add internal-task issue template for agent-assignable work (#906)

kovtcharov
authored and
theonlychant
committed
docs(claude): sharpen PR description guidance (#947)

kovtcharov
authored and
theonlychant
committed
fix(security): pin resolved IP in WebClient to eliminate DNS rebinding TOCTOU
theonlychant
committed
chore: add src/gaia/web to package setup
theonlychant
committed

Commits on May 6, 2026