v1.4.546
danielmiessler/Fabricv1.4.546Oct 23, 2026by github-actions[bot]
Upgrading?
Release notes summary
This release adds server-side protection against repeated invalid API key attempts by locking out offending client addresses for one minute after 10 failures within a minute. Locked-out clients receive HTTP 429 responses with a Retry-After header, even if they later present a valid key. The change also bounds client tracking memory and improves pruning of authentication failure records.
Key Highlights
- Locks out a client address for one minute after 10 invalid API keys within a minute.
- Returns HTTP 429 with a Retry-After header for subsequent requests from locked-out clients.
- Excludes requests with missing API keys from the failure count.
- Bounds the tracked-client table to prevent unlimited memory growth.
- Improves pruning by removing unlocked clients while preserving active lockouts.
New Features
- API key authentication rate limiting and client lockout
- HTTP 429 responses with Retry-After header for locked-out clients
- Bounded client tracking to limit memory usage
- Improved pruning of authentication failure records
- Simplified authentication limit tests with controlled clock values and numeric client identifiers
Full Release Notes
## Changes ### PR [#2288](https://github.com/danielmiessler/Fabric/pull/2288) by [pcbeingused333](https://github.com/pcbeingused333) and [ksylvan](https://github.com/ksylvan): fix(server): lock out a client after repeated wrong API keys - Added rate limiting that locks out a client address for one minute after 10 invalid API keys within a minute, returning HTTP 429 with a `Retry-After` header for all subsequent requests, including those with a valid key. - Excluded requests with missing API keys from the failure count, since they are not treated as guesses. - Bounded the table of tracked clients to prevent unlimited memory growth. - Improved pruning of authentication failures by removing all unlocked clients while preserving active lockouts. - Simplified the authentication limit tests with directly controlled clock values and numeric client identifiers.
Related Repositories
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
The world’s fastest framework for building websites.
:cherry_blossom: A command-line fuzzy finder