yucheng aa7f1e16b8 feat(proxy): throttle failed Admin UI sign-ins per source and source/username ... Replace the username-global lockout with counters keyed by source address and by source/username pair. Each has a fixed counting window (60s) and a separate block TTL (300s). Blocks are soft: a correct password still signs in, wrong passwords from a blocked key take one of 5 held slots per worker and are held 30s before a 429. Once a pair is blocked its failures stop counting against the source. The source scope runs only when trusted_proxy_ranges is set, IPv6 is grouped by /64, and per-source limits accept IP and CIDR overrides with longest-prefix matching. Redis is authoritative through one Lua script per failure, with bounded per-worker fallback when Redis raises. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-09-15 23:53:14 +00:00
..
litellm-dashboard	feat(proxy): throttle failed Admin UI sign-ins per source and source/username	2026-09-15 23:53:14 +00:00
Dockerfile	fix(docker): bump nginx runtime to 1.31.5-alpine3.24 and pin digest to resolve critical CVEs (#39561)	2026-09-03 08:46:07 -07:00
nginx.conf	fix(ui): boot the UI image as an arbitrary uid by anchoring nginx writes under /tmp (#37982)	2026-08-24 11:57:36 -07:00