Docker :latest now follows releases
If you run FreeLLMAPI in Docker, this is the one to read. :latest was being retagged on every push to main, so pulling it gave you unreleased code instead of the newest release. It now follows release tags only (#679, reported in discussion #533).
From this release onward, :latest and :v0.6.6 are the same image:
docker pull ghcr.io/tashfeenahmed/freellmapi:latestMain builds keep their own main and sha-<sha> tags, so if you were deliberately tracking the development stream, use those.
Admin surface hardening
Thanks to @s-uryansh for this work (#498):
- Stricter CSP via Helmet.
- Per-IP rate limiting on
/api, tunable withADMIN_RATE_LIMIT_RPM(0disables). Key export gets its own tighter bucket, since it is the one admin endpoint that verifies a password. - Exporting your API keys now asks for your dashboard password. It is asked as a second step, after you choose what to export, rather than up front.
X-Forwarded-Foris ignored unlesstrust proxyis enabled.- Production 5xx responses are sanitised, with full detail still going to the server log.
Translations
CLI on npm
The CLI now publishes as freellmapi (#672):
npx freellmapi setup-claudeKnown issue
The version string the app reports internally (for example on /livez) still drifts from the release version. Confirm which image you are running by digest rather than by that number. A proper fix is in progress.
Install
Desktop installers are attached below. The macOS DMG is unsigned, so on first launch use right-click then Open rather than double-clicking.
Full changelog: v0.6.5...v0.6.6