ryan 8a1c6e49fb feat(auth): only allow password-login dashboard sessions to call /user/password/change ... Password login now stamps login_method=username_password into the UI session key metadata, and change_password rejects any caller that is not a litellm-dashboard key carrying that marker with 403 before the user row is read. SSO sessions and user-associated virtual keys can no longer use the endpoint as a current_password guessing oracle. The forced-reset session is still minted by the password login path, so it keeps access to the endpoint Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-09-21 22:22:12 +00:00
..
litellm-dashboard	feat(auth): only allow password-login dashboard sessions to call /user/password/change	2026-09-21 22:22:12 +00:00
Dockerfile	fix(docker): bump nginx runtime to 1.31.5-alpine3.24 and pin digest to resolve critical CVEs (#39561)	2026-09-03 08:46:07 -07:00
nginx.conf	fix(ui): boot the UI image as an arbitrary uid by anchoring nginx writes under /tmp (#37982)	2026-08-24 11:57:36 -07:00