llm 0.37.2
Release: llm 0.37.2 Fixes a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w . LLM has a mechanism called extra-openai-models.yaml - now managed by the new-in-0.37 llm openai endpoint add command - for using LLM with OpenAI-compatible API endpoints from other providers. Daniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by api_key_name had never been stored, or if a responses:
Read original source
Source record
Research analysis
Source record
Source account: Release: llm 0.37.2 Fixes a security issue reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w . LLM has a mechanism called extra-openai-models.yaml - now managed by the new-in-0.37 llm openai endpoint add command - for using LLM with OpenAI-compatible API endpoints from other providers. Daniel reported two ways this could accidentally send your configured OpenAI API key to one of those providers: if the key named by api_key_name had never been stored, or if a responses:
Available context
Recent records to compare: “[程序员] codex tibo 说重置，我还没收到，你们呢？” (V2EX, Nov 12, 2026); “8-K - iANTHUS CAPITAL HOLDINGS, INC. (0001643154) (Filer)” (SEC EDGAR, Nov 12, 2026). Shared themes are navigation hints; they have not been verified as the same need or independent corroboration.
Research status
This record has not been assigned a sufficiently supported main content category. No commercial or performance conclusion is generated.
Missing evidence
The main event, affected audience and supporting primary source need review.
Next step
Read the original and identify the decision it supports before choosing an analysis framework.