Misc Security fixes#2820

Merged

dgageot merged 6 commits into

docker:mainfrom

dgageot:board/a06d029e834182e5

May 20, 2026

Commits on May 20, 2026

fix(skills): use SSRF-safe HTTP client for remote skills registry

dev
authored and
dgageot
committed
refactor(rag,evaluation): use errors.Is for sentinel error checks

dev
authored and
dgageot
committed
fix(mcp/oauth): drop stray OAuth callbacks instead of blocking the handler

dev
authored and
dgageot
committed
fix(skills): honour Cache-Control no-store and no-cache properly

dev
authored and
dgageot
committed
fix(skills): keep no-store responses on disk for in-process consumption

dev
authored and
dgageot
committed
fix(mcp/oauth): respond 409 to duplicate OAuth callbacks instead of misleading 200
dgageot
committed