- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
instead of request.url.path for whitelist checks: a crafted Host
header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
self-signed token with account=admin can no longer impersonate the
administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
source-level guards
Co-Authored-By: Claude <[email protected]>
- Add MiniMax-M3 as the new default model
- Retain MiniMax-M2.7 as available alternative
- Remove deprecated MiniMax-M2.5 and MiniMax-M2.5-highspeed
- Update unit and integration tests for the new model list
Add MiniMax AI as a built-in LLM supplier alongside existing providers
(OpenAI, DeepSeek, Gemini, Kimi, etc.) via OpenAI-compatible API.
Changes:
- Add MiniMax supplier entry (id=13) in supplier.ts with M2.7, M2.5,
M2.5-highspeed models and temperature range [0, 1]
- Add MiniMax icon (96x96 PNG) to frontend assets
- Add i18n translations for MiniMax in en, zh-CN, ko-KR locales
- Add supported LLM providers table to both README files
- Add 24 unit tests + 3 integration tests
