Jamie Tanna af055eba22 feat(config): allow self-hosted admins to bypass allowedHeaders (#45654) ...

In a similar way to how `allowedEnv` works, we should allow a
self-hosted admin to specify whichever headers they wish in their
`hostRules` - whether in their global config, a `repositories[]` entry,
or a preset a `repositories[]` entry extends.

Previously, this would require a self-hosted admin to add any header
they wished to set to `allowedHeaders`, which would also allow any of
their users' repositories to set that same header.

We can align this behaviour with `allowedEnv`, which makes sure that
the admin's own `headers` are always applied regardless of
`allowedHeaders`, while a repository's own `hostRules` - and those of
any preset it extends - remain constrained by it as before.

We make sure to use an explicit `[]` to make it clear when there are no
headers to allow, opposed to using something less clear like
`undefined`.

We do not currently allow an `extends` (without a `repositories[]`
entry) to bypass, and they'll be followed-up with in #45670.

Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>

2026-09-29 10:37:15 +00:00

..

development

docs: document code conventions and pnpm check as the verification (#46471)

2026-09-25 12:51:01 +00:00

usage

feat(config): allow self-hosted admins to bypass allowedHeaders (#45654)

2026-09-29 10:37:15 +00:00