yucheng 9a365d2021 feat(proxy): hard-block throttled Admin UI sign-ins with no credential bypass ... A blocked source, or source and username pair, is now refused with 429 before the database lookup and password check, in place of the soft block that held wrong guesses for 30 seconds and let a correct password through. The env admin credentials and the master key typed into the login form are refused like any other credential while blocked; recovery is the master key as an API bearer token, which never goes through the sign-in path trusted_proxy_ranges: [] now means clients connect directly, so the peer address is the source and the per-source limit stays on. Only an unset or malformed value leaves the topology unknown, warns at startup and turns the per-source limit off Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-09-17 16:10:23 +00:00
..
litellm-dashboard	feat(proxy): hard-block throttled Admin UI sign-ins with no credential bypass	2026-09-17 16:10:23 +00:00
Dockerfile	fix(docker): bump nginx runtime to 1.31.5-alpine3.24 and pin digest to resolve critical CVEs (#39561)	2026-09-03 08:46:07 -07:00
nginx.conf	fix(ui): boot the UI image as an arbitrary uid by anchoring nginx writes under /tmp (#37982)	2026-08-24 11:57:36 -07:00