v3.4.7 v3.4.8
cheaper-inference/OmniRouteApr 3, 2026 → Apr 3, 20260 days between releases
What's New
Security patch addressing CodeQL alerts and replacing Math.random with crypto.randomUUID.
Breaking Changes
- Replaced Math.random with crypto.randomUUID(), which returns a string instead of a number
New Features
- Replaced Math.random with crypto.randomUUID() for secure randomness
- Fixed catastrophic backtracking RegEx patterns in chat/translation pipelines
- Enhanced output sanitization controls in React UI and SSE components
- Hardened shell commands against string injection
- Remediated all Github Advanced Security (CodeQL) findings
Improvements
- Hardened shell commands and regex parsing
- Enhanced output sanitization controls inside React UI components and Server Sent Events
- Remediated all outstanding Github Advanced Security findings
Bug Fixes
- Fixed insecure randomness vulnerabilities by migrating from Math.random to crypto.randomUUID()
- Secured shell commands in automated scripts from string injection
- Migrated vulnerable catastrophic backtracking RegEx parsing patterns
- Enhanced output sanitization controls inside React UI components and Server Sent Events
Upgrade Notes
Code relying on the return type of random functions may break due to the switch from Math.random to crypto.randomUUID(). Additionally, regex patterns in chat and translation pipelines have been updated to prevent catastrophic backtracking.
The Two Releases
v3.4.7
Apr 3, 2026· 7 months ago
Focuses on security hardening (cryptography health checks) and fixing bugs related to OAuth token refreshes, MCP resolution, and provider routing.
Full release notesv3.4.8
Apr 3, 2026· 7 months ago
A security-focused patch addressing all GitHub Advanced Security findings, fixing randomization vulnerabilities, and hardening shell commands.
Full release notes