Unit Tests: Proxy DB Operations / proxy-db (auth-checks, tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py, 20, 8) (push) Waiting to run
Unit Tests: Proxy DB Operations / proxy-db (remaining, tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py, 20, 8) (push) Waiting to run
Prevents Anthropic 400 invalid_request_error on follow-up turns where
the caller has removed the advisor tool but message history still contains
server_tool_use(advisor) + advisor_tool_result blocks.
Add advisor-tool-2026-03-01 to anthropic_beta_headers_config.json so the
beta headers manager forwards it to Anthropic (was being silently dropped).
Mark as null for all non-native providers.
Filter all explicitly-passed keys from remaining_kwargs before
spreading into async_responses_websocket(). The router now injects
custom_llm_provider into kwargs (via #25334), which collides with
the explicit custom_llm_provider= argument.
Align with aget_agent_card and the DEFAULT_A2A_AGENT_TIMEOUT env var so
A2A message/send uses the same default as agent card fetch instead of a
hardcoded 60s HTTP read timeout.
Also correct aget_agent_card docstring for the timeout parameter.
Made-with: Cursor
Tremor's internal Tooltip component sets a setTimeout that fires after
the jsdom test environment tears down, causing a ReferenceError. Add
afterEach that flushes pending timers before cleanup.
Raise vitest testTimeout from 10s to 30s and drop per-test timeout overrides
across UI unit tests. Group CreateUserButton and TeamInfo tests under nested
describe blocks to make the most flaky suites easier to scan.
Remove the silent try/catch from setSecureItem so OAuth hooks can
surface actionable "enable storage" guidance instead of a cryptic
"state lost" error after the round-trip. Add a local try/catch in
ChatUI where the storage write is non-critical.
- Dockerfile.health_check: HEALTHCHECK now verifies the script is intact
instead of unconditionally exiting 0
- secureStorage.ts: replace deprecated escape/unescape with
encodeURIComponent/decodeURIComponent; don't delete legacy values on
decode failure so in-flight flows can time out naturally
- OAuth callback: add same-origin check before redirecting to stored
return URL
Port security fixes from litellm_v1.82.3.dev.6:
- Use secureStorage (sessionStorage wrapper) instead of raw storage for tokens
- Add URL validation for stored worker URLs to prevent open redirects
- Add same-origin checks before redirecting to stored return URLs
- Harden Dockerfile.health_check with non-root user and exec-form HEALTHCHECK
