All pull requests

Pull requests

• fix(blueprints): hash basic-auth before header-auth delete

  #3922·Tyagiquamar opened Oct 18, 2026Contributor·1 task·

  ·
  1

• Fix open redirect in OIDC IdP login flow

  #3921·MauryaQbit opened Oct 18, 2026Contributor·

  ·

• feat: add configurable upstream TLS certificate verification

  #3919·makk50 opened Oct 16, 2026·

  ·
  5

• fix(app): keep internal deployment details out of the anonymous client payload

  #3913·choksi2212 opened Oct 15, 2026Contributor·

  ·
  1

  2

• fix(badger): expire resource session cookies at the resource session length

  #3908·choksi2212 opened Oct 14, 2026Contributor·

  ·
  1

  3

• Keep newt rules for destinations still used by other resources

  #3896·MauryaQbit opened Oct 13, 2026Contributor·

  ·
  1

• Neutralise formula prefixes in CSV log exports

  #3877·MauryaQbit opened Oct 8, 2026Contributor·

  ·
  1

  2

• feat(idp): add org-scoped integration endpoint to mint session for external IdP user

  #3867·gk1 opened Oct 6, 2026·

  ·
  4

  

• feat: Identity Provider Directory Sync

  #3836·Fredkiss3 opened Sep 30, 2026Contributor·

  ·

• perf(status-history): compute day buckets in a single pass

  #3802·aithal007 opened Sep 22, 2026·

  ·
  1

• feat(resources): add multi-select bulk actions and date added column

  #3784·orochibraru opened Sep 17, 2026·

  ·
  2

• fix(olm): mark client site association as not relayed on local message (#3634)

  #3733·Adityakk9031 opened Sep 12, 2026Contributor·

  ·

• fix(ai-gateway): resolve permission error when allow all models is configured (#3629)

  #3732·Adityakk9031 opened Sep 12, 2026Contributor·

  ·

• perf(auth): make path-rule matching linear-time, fix deep-path rejection

  #3713·aithal007 opened Sep 8, 2026·

  ·
  6

• fix(ws): detect and clean up dead WebSocket connections via heartbeat

  #3697·aithal007 opened Sep 4, 2026·

  ·
  5

• Add Crowdsec bot detection

  #3674·iMord0 opened Sep 1, 2026Contributor·

  ·
  14

• fix: correctly fetch userinfo from OIDC providers

  #3661·little-meow-meow opened Aug 30, 2026·

  ·
  1

  2

  

• feat: per-site-resource opt-out from advertising the destination as a client route

  #3621·escooterclinic opened Aug 20, 2026·

  ·

• Fix: Badger: Exchanging a request token fails to delete the request token from the database

  #3596·shleeable opened Aug 16, 2026Contributor·

  ·

• Auth: Force-login fails to invalidate existing session, leaving old session active until expiry

  #3594·shleeable opened Aug 16, 2026Contributor·

  ·

• Fix: SSH settings page silently deletes extra SSH targets when resource is in push+site mode

  #3593·shleeable opened Aug 16, 2026Contributor·

  ·

• Performance: Handle badger cache invalidation and extend TTLs

  #3584·shleeable opened Aug 14, 2026Contributor·

  ·

• Performance: Add indexes for request path tables

  #3583·shleeable opened Aug 14, 2026Contributor·

  ·

• Performance: Remove GeoIP and ASN lookups from every request to only when required

  #3582·shleeable opened Aug 14, 2026Contributor·

  ·

• Feature: (Optional) Reverse Proxy Cache to Public Resources

  #3580·shleeable opened Aug 14, 2026Contributor·

  ·
  1