v3.5.1 v3.5.3

Name: OmniRoute
Author: cheaper-inference

medium risk

cheaper-inference/OmniRouteApr 4, 2026 → Apr 7, 20263 days between releases

What's New

Upgraded Next.js to 16.2.2 and Vite to 8.0.5; remediates 12 high-severity CodeQL vulnerabilities.

Improvements

Remediated 12 High-Severity CodeQL vulnerabilities by migrating to `crypto.randomUUID()`.
Upgraded Next.js to 16.2.2 and Vite to 8.0.5 to resolve critical DoS vectors.
Enhanced E2E stability and CI/CD reliability by refactoring Playwright interactions.
Synchronized Machine Translation updates across all 32 supported languages.
Improved Edge-case error handling and preserved primary failure contexts.

Bug Fixes

Fixed infinite redirect loop on dashboard when `requireLogin` is disabled.
Resolved extreme CI unreliability and transient test timeouts.
Sanitized trailing HTTP fragments and enforced rigid SSRF verification.
Optimized local git hooks and normalized token coverage endpoints.
Guarded GLM region lookups to prevent potential failures.

Upgrade Notes

Review `package.json` for Next.js and Vite version constraints; check middleware configuration if `requireLogin` is enabled; monitor SSRF behavior in internal routes.

The Two Releases

v3.5.1

Apr 4, 2026· 7 months ago

Integrates models.dev for authoritative model data and adds native provider capabilities and custom User-Agent support.

Full release notes

v3.5.3

Apr 7, 2026· 7 months ago

Security-focused release remediating CodeQL vulnerabilities and upgrading Next.js/Vite.

Full release notes