v3.8.13 v3.8.14

Name: OmniRoute
Author: cheaper-inference

high risk

cheaper-inference/OmniRouteJun 6, 2026 → Jun 7, 20261 day between releases

What's New

Fixes critical SSRF vulnerability and adds per-provider custom headers

Breaking Changes

Proxy auto-selection is now opt-in
Migration 095 adds the custom_headers_json column

New Features

Per-provider custom headers for OpenAI/Anthropic-compatible nodes

Improvements

Hardened security against SSRF attacks in provider auto-sync

Bug Fixes

Fixed critical SSRF vulnerability in provider auto-sync self-fetch
Fixed Gemini/Vertex tool parameter types to OBJECT
Fixed Electron process tree termination on Exit/Update
Fixed proxy auto-selection to be opt-in

Upgrade Notes

Run migration 095 to add the custom_headers_json column. Update proxy configuration as auto-selection is now opt-in. Review provider node settings for custom headers syntax.

The Two Releases

v3.8.13

Jun 6, 2026· 5 months ago

Introduces self-service login infrastructure for web-cookie providers and a VS Code Ollama-compatible endpoint. The release also fixes dashboard crashes and Codex stripping of client-only params.

Full release notes

v3.8.14

Jun 7, 2026· 5 months ago

Adds per-provider custom headers and hardens security against SSRF attacks. The release also fixes translator bugs for Gemini/Vertex tools and improves Electron process termination.

Full release notes