yucheng e8cee19bee feat(proxy): default at-rest encryption to AES-256-GCM with HKDF v3 and make PyNaCl optional ... New writes use v3:gcm: (AES-256-GCM under HKDF-SHA256). v2:gcm: and unprefixed XSalsa20 values stay readable under the raw SHA-256 derivation they were written with. xsalsa20-poly1305 remains an explicit opt-in and is refused under LITELLM_FIPS_MODE. PyNaCl imports are lazy and a missing PyNaCl on legacy ciphertext raises one error naming the legacy-encryption extra and the re-encrypt path. pynacl moves from the proxy extra to legacy-encryption, which the standard Dockerfiles install Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-09-24 08:32:05 +00:00
..
routes	fix(gateway): expose /api/event_logging/batch on the gateway allowlist (#42572)	2026-09-22 14:09:40 -07:00
Dockerfile	feat(proxy): default at-rest encryption to AES-256-GCM with HKDF v3 and make PyNaCl optional	2026-09-24 08:32:05 +00:00
launch.py	feat(proxy): let the in-container pgbouncer follow rotating RDS IAM and Azure Entra tokens (#40623)	2026-09-10 16:18:00 -07:00
main.py	fix(gateway): keep the Prometheus /metrics Mount in the gateway route trim (#32317)	2026-07-07 18:36:38 +03:00