xinyin025/LangBot
1
0
Fork 0
mirror of https://github.com/langbot-app/LangBot.git synced 2026-10-28 19:35:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,648 Commits 219 Branches 221 Tags
1d3c47c4394b71afa61eaadcf1deccc5e321f099
Commit Graph
270 Commits
Author SHA1 Message Date
RockChinQandmultica-agent 029fbbf3c3 fix(deps): raise the python-multipart floor to the locked version (#2773) 
The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32.
0.0.27 falls inside four published advisories, so any resolve that honours the
floor rather than the lock can land on a vulnerable release:

- GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time
  querystring DoS, semicolon field-separator and Content-Disposition parameter
  smuggling), fixed in 0.0.30
- GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in
  0.0.31

The locked 0.0.32 has no known advisories. Raising the floor to match the lock
costs nothing and keeps the two from drifting apart.

Reachability, for the record: multipart parsing happens on the skills and plugin
local-upload routes, both of which require USER_TOKEN_OR_API_KEY with
RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous
one.

The resolved version is unchanged; only the requirement metadata moves.

Co-authored-by: multica-agent <[email protected]>
 2026-10-26 14:20:16 +08:00
huanghuoguoguo b1b7ddc259 feat(skill): wire standard host skill contract (#2771) 
* feat(skill): wire standard host skill contract

* chore(skill): pin bounded SDK revision

* fix(skill): correct SDK pin and formatting

* chore: use released SDK 0.7.17

* fix(deps): validate nested component imports with SDK 0.7.18rc1

* fix(deps): pin validated SDK 0.7.18
 2026-10-26 12:11:27 +08:00
RockChinQandmultica-agent b8f7b295ba fix(deps): patch Dependabot vulnerability alerts (Python + web) (#2762) 
Python (pyproject.toml + uv.lock):
- Pillow >=13.0.0 (52 alerts closed, including 4 critical, 33 high, 15 medium)
- pyjwt >=2.15.0 (15 alerts closed, including 1 critical, 8 high, 6 medium)
- aiohttp >=3.14.4 (11 alerts closed)
- virtualenv -> 21.14.13 (12 alerts closed)
- mcp >=1.30.0,<2.0.0 (4 alerts closed)
- soupsieve -> 3.0.4 (4 alerts closed)
- urllib3 >=2.8.0 (3 alerts closed)
- transformers -> 5.20.2 (3 alerts closed)
- anyio -> 4.14.2 (2 alerts closed, including 1 critical)
- oauthlib -> 4.0.0 (2 alerts closed)
- certifi >=2026.10.19 (1 critical alert closed)
- uv >=0.13.4 (1 critical alert closed)
- sentence-transformers -> 6.2.0 (1 critical alert closed)
- cryptography >=50.0.0, fsspec -> 2026.9.0, h2 -> 4.4.1, hpack -> 4.2.0
- langgraph-sdk -> 0.4.8, litellm >=1.88.6, Mako >=1.4.2, multidict -> 7.1.0
- opentelemetry-api -> 1.45.1, pip >=26.2.0, setuptools -> 84.2.1, torch -> 2.14.1, werkzeug -> 3.1.9
- PyPDF2: replaced with pypdf>=6.0.0 (deprecated PyPDF2 had no upstream fix; closes 1 medium alert)

Web (web/package.json + dual lockfiles npm + pnpm in sync):
- axios 1.17.0 -> 1.20.0 (22 alerts closed)
- vite 8.0.16 -> 8.3.4 (5 alerts closed)
- react-router / react-router-dom 7.17.0 -> 7.18.4 (5 alerts closed)
- brace-expansion -> 1.1.21 & 5.0.12 (4 alerts closed)
- js-yaml -> 4.3.2 (3 alerts closed)
- follow-redirects -> 1.16.1 (2 alerts closed)
- nanoid -> 3.3.18 / 3.3.20 (2 alerts closed)
- postcss -> 8.5.31 (2 alerts closed)
- @humanfs/node -> 0.16.8 (1 alert closed)
- source-map-js -> 1.2.2 (1 alert closed)

Unfixable upstream (pending ChromaDB release):
- chromadb (4 open alerts: GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr, GHSA-f4j7-r4q5-qw2c; vulnerable range <=1.5.9, latest published version is 1.5.9 with no patched release).

Verified: uv sync + core imports, pytest test suites, pnpm build, pnpm lint.

Co-authored-by: multica-agent <[email protected]>
 2026-10-23 12:23:50 +08:00
RockChinQ c538e696b2 chore(release): bump version to 4.11.2 (#2758) 2026-10-22 23:45:23 +08:00
RockChinQandmultica-agent 816d7fee3b chore(release): prepare 4.11.1 with SDK 0.7.16 
Co-authored-by: multica-agent <[email protected]>
 2026-10-20 15:44:50 +00:00
BiFangKNT 6bdd5e8c94 chore(deps): pin released langbot-plugin 0.7.15 2026-10-20 15:59:00 +08:00
RockChinQandmultica-agent 42f6f7373b chore(deps): pin released langbot-plugin 0.7.14 
Co-authored-by: multica-agent <[email protected]>
 2026-10-19 08:06:30 +00:00
海洋饼干multica-agentHaiYangBG1Chin Rock
 		947d8addea fix(box): validate and export explicitly selected files (#2641) 
* fix(box): retain outbox files when export fails

* test(box): retain ownership evidence in CI logs

* test(box): exercise LocalAgent export repair through real runtime and Docker

Co-authored-by: multica-agent <[email protected]>

* fix(box): complete bounded outbox recovery contract

* feat(box): export explicitly selected files

Co-authored-by: multica-agent <[email protected]>

* test(box): exercise explicit export on real Docker

Co-authored-by: multica-agent <[email protected]>

* test(box): verify explicit exports with live model and Docker

Co-authored-by: multica-agent <[email protected]>

* fix(box): align explicit export SDK and integration contracts

* docs(box): describe selected-file export contract

---------

Co-authored-by: HaiYangBG1 <[email protected]>
Co-authored-by: Chin Rock <[email protected]>
Co-authored-by: multica-agent <[email protected]>
 2026-10-19 15:31:33 +08:00
Jonathan Neufeld 5c3675f4cc feat(vector): tag the Valkey Search client lib-name for attribution (#2620) 
Set client_info_tag='langbot' on the Valkey Search vector store's glide
client, so CLIENT SETINFO LIB-NAME reports GlidePy(langbot) and operators
can attribute Valkey usage to LangBot. client_name is unchanged.

client_info_tag was added in valkey-glide 2.5.2, so raise the floor from
>=2.4.1 to >=2.5.2 (pyproject, install hint, docs) and regenerate uv.lock.
 2026-10-19 14:29:19 +08:00
huanghuoguoguo db5924e71e chore(deps): pin released langbot-plugin 0.7.13 2026-10-17 10:24:49 +08:00
huanghuoguoguo d54e533985 fix(skill): pin revisions per run and preserve shared Box state 2026-10-17 09:32:41 +08:00
RockChinQandClaude Opus 5.5 653f9e731d Merge origin/master into feat/cloud-v2-subscriptions 
Keep i18n'd requester error messages while adopting master's structured
RequesterError metadata.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-17 01:37:14 +08:00
RockChinQandHyu 1c5ab3227c fix(deps): pin SDK 0.7.12 for upstream stream cancellation (#2663) 
Co-authored-by: Hyu <[email protected]>
 2026-10-15 20:13:46 +08:00
Hyu e29fd27f02 feat(i18n): localize backend messages by workspace language 2026-10-15 05:31:04 +00:00
RockChinQ 502b38130f release: prepare Core 4.11.0 with stable SDK 0.7.11 (#2660) 2026-10-14 15:54:32 +08:00
RockChinQ 688e7761e7 chore(runtime): pin SDK worker plugin identity telemetry 2026-10-13 05:05:45 +00:00
RockChinQ b5fad9f04a feat(cloud): configure dedicated and shared worker quotas independently 2026-10-13 03:19:36 +00:00
RockChinQ 5a8c1ec6ef chore: release 4.11.0-rc.3 with worker watchdog SDK (#2655) 2026-10-13 01:32:18 +08:00
RockChinQ de34d206a9 release: 4.11.0-rc.2 with SDK 0.7.11rc2 2026-10-10 17:57:12 +00:00
Hyu 353b452453 fix(ci): align SDK dependency and validate acceptance migrations 2026-10-11 00:59:51 +08:00
RockChinQ d4458d8883 chore(release): LangBot 4.11.0-rc.1 with SDK 0.7.11rc1 (#2638) 2026-10-08 16:02:31 +08:00
RockChinQ c95b8581fc fix(plugin): upgrade SDK to 0.7.10 for legacy config compatibility (#2625) 2026-10-02 08:24:43 +08:00
RockChinQ 8732fe3607 chore(release): prepare 4.11.0-beta.6 with SDK 0.7.9 (#2624) 2026-10-02 02:30:00 +08:00
Hyu 1b320aefd0 chore(deps): upgrade plugin SDK to 0.7.8 
Pins the 0.7.8 wheel published from the SDK release and refreshes uv.lock.
 2026-10-02 01:36:11 +08:00
RockChinQ 9186c8e43a chore(deps): upgrade plugin SDK to 0.7.7 (#2622) 2026-10-01 23:11:28 +08:00
Hyu ae516d2290 build(core): pin plugin SDK 0.7.6 
Carries the plugin worker process label: workers now show `--tag
author/plugin_name` in ps/htop, including the nsjail supervisor row.

Verified locally: the published wheel hash matches the pin, the shared runtime
launches workers with the tag, plugins register and knowledge retrieval is
unaffected.
 2026-09-30 23:54:20 +08:00
Hyu 05de72570d build(core): pin plugin SDK 0.7.5 
Pick up the shared-worker startup and installation-binding fixes released as
langbot-plugin 0.7.5 (tag v0.7.5), so Core deployments stop installing the
0.7.4 wheel that cannot launch shared pool workers and drops the installation
binding on plugin dispatches and relays.
 2026-09-30 14:48:02 +08:00
RockChinQ 36661442ad build(core): pin SDK 0.7.4 wheel while PyPI index catches up 2026-09-28 10:57:20 +00:00
RockChinQ 299a6df74a build(core): pin plugin SDK 0.7.4 for legacy runner compatibility 2026-09-28 10:53:25 +00:00
RockChinQ 621f2f0a4a fix(cloud): pin SDK 0.7.3 dedicated binding fix 2026-09-28 08:40:59 +00:00
RockChinQ ebe5bd9d86 fix(cloud): pin SDK dedicated worker initialization fix 2026-09-28 08:06:46 +00:00
RockChinQ b51a448b1e feat: stateless certified shared worker 
Implements stateless singleton component model for certified shared Workers, integrating with SDK 0.7.0.
 2026-09-28 13:25:40 +08:00
huanghuoguoguo 84b2c1f86d build(deps): pin validated skill sdk head 2026-09-28 11:06:04 +08:00
huanghuoguoguo 38a7c10d04 build(deps): pin paired skill sdk revision 2026-09-28 10:23:02 +08:00
RockChinQ 3b94b7e4cc chore(plugin): pin SDK 0.6.20 2026-09-27 09:00:36 +00:00
RockChinQ 0b78617b82 chore(plugin): pin SDK 0.6.19 2026-09-27 07:42:02 +00:00
RockChinQ cbc8ef2324 chore(plugin): pin SDK 0.6.18 2026-09-27 06:36:21 +00:00
RockChinQ b06083d9b6 chore(plugin): pin SDK 0.6.17 2026-09-27 05:36:56 +00:00
RockChinQ c7306dc8b2 chore(plugin): pin SDK 0.6.16 2026-09-27 04:38:11 +00:00
RockChinQ 6da0aea901 fix(plugin): pin SDK 0.6.15 2026-09-27 02:59:40 +00:00
RockChinQ 765dac74ea fix(plugin): pin SDK 0.6.14 and bound shared readiness 2026-09-27 00:11:57 +00:00
RockChinQ 3d6a203724 chore(runtime): pin plugin SDK 0.6.13 2026-09-26 21:28:52 +00:00
RockChinQ e63fcb36e4 chore(runtime): pin plugin SDK 0.6.12 2026-09-26 20:42:15 +00:00
RockChinQ 755149ab0a chore(runtime): pin plugin SDK 0.6.11 2026-09-26 18:16:39 +00:00
RockChinQ 3493660f5e chore(runtime): pin plugin SDK 0.6.10 2026-09-26 17:08:51 +00:00
RockChinQ 64dc04d848 chore(runtime): pin plugin SDK 0.6.9 2026-09-26 14:33:35 +00:00
RockChinQ ccbf7c226e chore(runtime): pin plugin SDK 0.6.8 2026-09-26 13:02:43 +00:00
RockChinQ 92669ef584 fix(plugin): pin runtime SDK 0.6.7 2026-09-26 06:19:15 +00:00
RockChinQ 37e80e510f fix(plugin): pin runtime SDK 0.6.6 2026-09-26 05:21:50 +00:00
RockChinQ 9690f0bc6c fix(plugin): pin runtime SDK 0.6.5 2026-09-26 04:29:05 +00:00