fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz - #4639

Merged

waleedlatif1 merged 6 commits into

waleedlatif1/fix-kb-fileurl-lfi

May 17, 2026

Commits on May 17, 2026

fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz
waleedlatif1
committed
4d3e1b3
fix(otp): don't leak caught error.message; fail-closed on DB retry exhaust
waleedlatif1
and
claude
committed
ad80c30
fix(mcp): use undici fetch directly in pinned-fetch for typed dispatcher
waleedlatif1
and
claude
committed
9fe9cb2
fix(build): keep agiloft/grafana tool configs client-safe
waleedlatif1
and
claude
committed
2b06b80
fix(knowledge): case-insensitive scheme checks for fileUrl
waleedlatif1
and
claude
committed
14bfcb7
fix(mcp): annotate undici/DOM type-bridge double-casts in pinned-fetch
waleedlatif1
and
claude
committed
21a93a5