Danny Avila 2ef12b1e1d 🦺 feat: Configurable Baseline HTTP Security Headers (#14445) ... Adds helmet's CSP-independent headers (HSTS, X-Frame-Options, X-Content-Type-Options, COOP, CORP, Referrer-Policy) on every response, with contentSecurityPolicy explicitly disabled. Every header that can break a deployment is configurable, so there is no allow-list to go stale the way #7377's hardcoded CSP directives did. HSTS includeSubDomains defaults off rather than matching helmet's on-by-default: it would otherwise pin every sibling subdomain to HTTPS for a year in every visitor's browser, and undoing that requires serving max-age=0 from each affected host.		2026-08-25 08:21:39 -04:00
..
app	⚡ perf: Append Saved Message Ids Instead of Rebuilding the Conversation Array (#15141)	2026-08-23 16:52:44 -04:00
cache
config
db
models
server	🦺 feat: Configurable Baseline HTTP Security Headers (#14445)	2026-08-25 08:21:39 -04:00
strategies
test
utils
jest.config.js
jsconfig.json
package.json	📦 chore: bump @librechat/agents@latest to v3.7.1 (#15176)	2026-08-24 16:06:25 -04:00
typedefs.js