Each new README places the crate inside the anyllm-proxy workspace and
includes verified library-use examples for downstream consumers.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Fixes RUSTSEC-2026-0098 (URI name constraint bypass) and
RUSTSEC-2026-0099 (wildcard name constraint bypass).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New providers: assemblyai, baidu, blackboxai, brave, cartesia, deepgram,
elevenlabs, exa, iflytek, lmsys, playht, pollinations, serper, siliconflow,
stability, tavily. Registered in mod.rs and registry.rs.
Adds a Providers tab to the admin UI with a ProviderIcon component and
catalog route. Updates backend, streaming, config, and test infrastructure
to align with the expanded provider set. Bumps all crate versions to 0.9.0.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Copy crates/providers (anyllm_providers) into worktree and add to workspace + proxy deps
- Implement row_to_backend_config() in admin/routes/managed_backends.rs: converts ManagedBackendRow + ProviderDef into BackendConfig by mapping ProviderProtocol to BackendKind and AuthKind to BackendAuth; Custom protocol returns None (unsupported)
- Add managed_backends field to SharedState (Arc<RwLock<HashMap<String, (ManagedBackendRow, BackendClient)>>>)
- Load managed backends from SQLite at startup in async_main: list_managed_backends -> get_provider -> row_to_backend_config -> BackendClient::from_backend_config
- Fix cost/mod.rs test SharedState initializer to include new field
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1. CSRF token store: replace unbounded DashMap with moka::sync::Cache
(max 1,000 entries, 24h TTL) to prevent memory exhaustion.
2. Cloud metadata SSRF: warn at startup if QDRANT_URL/REDIS_URL points
at 169.254.169.254 or metadata.google.internal.
3. TLS P12 password: wrap in zeroize::Zeroizing<String> so it is zeroed
from heap on drop, preventing extraction from core dumps.
4. CSP nonce: replace unsafe-inline with per-request 128-bit nonce on
admin SPA script/style tags.
Also includes: batch/bedrock model allowlist enforcement, litellm
master_key extraction moved to single-threaded fn main().
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolves conflicts: take HEAD (security audit) for mcp.rs imports,
register_server_blocking error handling, and maybe_execute_tools loop.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add anyllm_batch_engine dependency to proxy Cargo.toml
- Add batch_engine field to AppState (Option<Arc<BatchEngine<...>>>)
- Add POST /v1/batches/{batch_id}/cancel route and handler
- cancel_batch handler uses BatchEngine when available, falls back to not_implemented
whit3rabbit
