Combine main's Workspace LSP release notes with image-gen plugin
feature notes. Keep main's editor-lsp-foundation content and add
new sections for image-gen MCP plugin, desktop plugin config, and
inline image rendering.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
HIGH fixes:
- SSRF protection: block private/link-local IPs and file:// URLs
in edit_image image_url parameter
- Mask sensitive values in GET /api/plugins/options response
MEDIUM fixes:
- Clamp n parameter to 1-10 to prevent API bill exhaustion
- Validate prompt is non-empty string before API call
- Return empty array when no providers configured (clear error)
- Add 1MB buffer limit for JSON-RPC line accumulation
- Fix PluginConfigModal useEffect re-fetch loop on parent re-render
LOW fixes:
- Remove unused requestId variable
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
