xinyin025/LangBot
1
0
Fork 0
mirror of https://github.com/langbot-app/LangBot.git synced 2026-10-24 09:25:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,617 Commits 197 Branches 221 Tags
b8f7b295ba9efbfcbd4557161cd53ab9231be72b
Commit Graph
268 Commits
Author SHA1 Message Date
RockChinQandmultica-agent b8f7b295ba fix(deps): patch Dependabot vulnerability alerts (Python + web) (#2762) 
Python (pyproject.toml + uv.lock):
- Pillow >=13.0.0 (52 alerts closed, including 4 critical, 33 high, 15 medium)
- pyjwt >=2.15.0 (15 alerts closed, including 1 critical, 8 high, 6 medium)
- aiohttp >=3.14.4 (11 alerts closed)
- virtualenv -> 21.14.13 (12 alerts closed)
- mcp >=1.30.0,<2.0.0 (4 alerts closed)
- soupsieve -> 3.0.4 (4 alerts closed)
- urllib3 >=2.8.0 (3 alerts closed)
- transformers -> 5.20.2 (3 alerts closed)
- anyio -> 4.14.2 (2 alerts closed, including 1 critical)
- oauthlib -> 4.0.0 (2 alerts closed)
- certifi >=2026.10.19 (1 critical alert closed)
- uv >=0.13.4 (1 critical alert closed)
- sentence-transformers -> 6.2.0 (1 critical alert closed)
- cryptography >=50.0.0, fsspec -> 2026.9.0, h2 -> 4.4.1, hpack -> 4.2.0
- langgraph-sdk -> 0.4.8, litellm >=1.88.6, Mako >=1.4.2, multidict -> 7.1.0
- opentelemetry-api -> 1.45.1, pip >=26.2.0, setuptools -> 84.2.1, torch -> 2.14.1, werkzeug -> 3.1.9
- PyPDF2: replaced with pypdf>=6.0.0 (deprecated PyPDF2 had no upstream fix; closes 1 medium alert)

Web (web/package.json + dual lockfiles npm + pnpm in sync):
- axios 1.17.0 -> 1.20.0 (22 alerts closed)
- vite 8.0.16 -> 8.3.4 (5 alerts closed)
- react-router / react-router-dom 7.17.0 -> 7.18.4 (5 alerts closed)
- brace-expansion -> 1.1.21 & 5.0.12 (4 alerts closed)
- js-yaml -> 4.3.2 (3 alerts closed)
- follow-redirects -> 1.16.1 (2 alerts closed)
- nanoid -> 3.3.18 / 3.3.20 (2 alerts closed)
- postcss -> 8.5.31 (2 alerts closed)
- @humanfs/node -> 0.16.8 (1 alert closed)
- source-map-js -> 1.2.2 (1 alert closed)

Unfixable upstream (pending ChromaDB release):
- chromadb (4 open alerts: GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr, GHSA-f4j7-r4q5-qw2c; vulnerable range <=1.5.9, latest published version is 1.5.9 with no patched release).

Verified: uv sync + core imports, pytest test suites, pnpm build, pnpm lint.

Co-authored-by: multica-agent <[email protected]>
 2026-10-23 12:23:50 +08:00
RockChinQ c538e696b2 chore(release): bump version to 4.11.2 (#2758) 2026-10-22 23:45:23 +08:00
RockChinQandmultica-agent 816d7fee3b chore(release): prepare 4.11.1 with SDK 0.7.16 
Co-authored-by: multica-agent <[email protected]>
 2026-10-20 15:44:50 +00:00
BiFangKNT 6bdd5e8c94 chore(deps): pin released langbot-plugin 0.7.15 2026-10-20 15:59:00 +08:00
RockChinQandmultica-agent 42f6f7373b chore(deps): pin released langbot-plugin 0.7.14 
Co-authored-by: multica-agent <[email protected]>
 2026-10-19 08:06:30 +00:00
海洋饼干multica-agentHaiYangBG1Chin Rock
 		947d8addea fix(box): validate and export explicitly selected files (#2641) 
* fix(box): retain outbox files when export fails

* test(box): retain ownership evidence in CI logs

* test(box): exercise LocalAgent export repair through real runtime and Docker

Co-authored-by: multica-agent <[email protected]>

* fix(box): complete bounded outbox recovery contract

* feat(box): export explicitly selected files

Co-authored-by: multica-agent <[email protected]>

* test(box): exercise explicit export on real Docker

Co-authored-by: multica-agent <[email protected]>

* test(box): verify explicit exports with live model and Docker

Co-authored-by: multica-agent <[email protected]>

* fix(box): align explicit export SDK and integration contracts

* docs(box): describe selected-file export contract

---------

Co-authored-by: HaiYangBG1 <[email protected]>
Co-authored-by: Chin Rock <[email protected]>
Co-authored-by: multica-agent <[email protected]>
 2026-10-19 15:31:33 +08:00
Jonathan Neufeld 5c3675f4cc feat(vector): tag the Valkey Search client lib-name for attribution (#2620) 
Set client_info_tag='langbot' on the Valkey Search vector store's glide
client, so CLIENT SETINFO LIB-NAME reports GlidePy(langbot) and operators
can attribute Valkey usage to LangBot. client_name is unchanged.

client_info_tag was added in valkey-glide 2.5.2, so raise the floor from
>=2.4.1 to >=2.5.2 (pyproject, install hint, docs) and regenerate uv.lock.
 2026-10-19 14:29:19 +08:00
huanghuoguoguo db5924e71e chore(deps): pin released langbot-plugin 0.7.13 2026-10-17 10:24:49 +08:00
huanghuoguoguo d54e533985 fix(skill): pin revisions per run and preserve shared Box state 2026-10-17 09:32:41 +08:00
RockChinQandClaude Opus 5.5 653f9e731d Merge origin/master into feat/cloud-v2-subscriptions 
Keep i18n'd requester error messages while adopting master's structured
RequesterError metadata.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-17 01:37:14 +08:00
RockChinQandHyu 1c5ab3227c fix(deps): pin SDK 0.7.12 for upstream stream cancellation (#2663) 
Co-authored-by: Hyu <[email protected]>
 2026-10-15 20:13:46 +08:00
Hyu e29fd27f02 feat(i18n): localize backend messages by workspace language 2026-10-15 05:31:04 +00:00
RockChinQ 502b38130f release: prepare Core 4.11.0 with stable SDK 0.7.11 (#2660) 2026-10-14 15:54:32 +08:00
RockChinQ 688e7761e7 chore(runtime): pin SDK worker plugin identity telemetry 2026-10-13 05:05:45 +00:00
RockChinQ b5fad9f04a feat(cloud): configure dedicated and shared worker quotas independently 2026-10-13 03:19:36 +00:00
RockChinQ 5a8c1ec6ef chore: release 4.11.0-rc.3 with worker watchdog SDK (#2655) 2026-10-13 01:32:18 +08:00
RockChinQ de34d206a9 release: 4.11.0-rc.2 with SDK 0.7.11rc2 2026-10-10 17:57:12 +00:00
Hyu 353b452453 fix(ci): align SDK dependency and validate acceptance migrations 2026-10-11 00:59:51 +08:00
RockChinQ d4458d8883 chore(release): LangBot 4.11.0-rc.1 with SDK 0.7.11rc1 (#2638) 2026-10-08 16:02:31 +08:00
RockChinQ c95b8581fc fix(plugin): upgrade SDK to 0.7.10 for legacy config compatibility (#2625) 2026-10-02 08:24:43 +08:00
RockChinQ 8732fe3607 chore(release): prepare 4.11.0-beta.6 with SDK 0.7.9 (#2624) 2026-10-02 02:30:00 +08:00
Hyu 1b320aefd0 chore(deps): upgrade plugin SDK to 0.7.8 
Pins the 0.7.8 wheel published from the SDK release and refreshes uv.lock.
 2026-10-02 01:36:11 +08:00
RockChinQ 9186c8e43a chore(deps): upgrade plugin SDK to 0.7.7 (#2622) 2026-10-01 23:11:28 +08:00
Hyu ae516d2290 build(core): pin plugin SDK 0.7.6 
Carries the plugin worker process label: workers now show `--tag
author/plugin_name` in ps/htop, including the nsjail supervisor row.

Verified locally: the published wheel hash matches the pin, the shared runtime
launches workers with the tag, plugins register and knowledge retrieval is
unaffected.
 2026-09-30 23:54:20 +08:00
Hyu 05de72570d build(core): pin plugin SDK 0.7.5 
Pick up the shared-worker startup and installation-binding fixes released as
langbot-plugin 0.7.5 (tag v0.7.5), so Core deployments stop installing the
0.7.4 wheel that cannot launch shared pool workers and drops the installation
binding on plugin dispatches and relays.
 2026-09-30 14:48:02 +08:00
RockChinQ 36661442ad build(core): pin SDK 0.7.4 wheel while PyPI index catches up 2026-09-28 10:57:20 +00:00
RockChinQ 299a6df74a build(core): pin plugin SDK 0.7.4 for legacy runner compatibility 2026-09-28 10:53:25 +00:00
RockChinQ 621f2f0a4a fix(cloud): pin SDK 0.7.3 dedicated binding fix 2026-09-28 08:40:59 +00:00
RockChinQ ebe5bd9d86 fix(cloud): pin SDK dedicated worker initialization fix 2026-09-28 08:06:46 +00:00
RockChinQ b51a448b1e feat: stateless certified shared worker 
Implements stateless singleton component model for certified shared Workers, integrating with SDK 0.7.0.
 2026-09-28 13:25:40 +08:00
huanghuoguoguo 84b2c1f86d build(deps): pin validated skill sdk head 2026-09-28 11:06:04 +08:00
huanghuoguoguo 38a7c10d04 build(deps): pin paired skill sdk revision 2026-09-28 10:23:02 +08:00
RockChinQ 3b94b7e4cc chore(plugin): pin SDK 0.6.20 2026-09-27 09:00:36 +00:00
RockChinQ 0b78617b82 chore(plugin): pin SDK 0.6.19 2026-09-27 07:42:02 +00:00
RockChinQ cbc8ef2324 chore(plugin): pin SDK 0.6.18 2026-09-27 06:36:21 +00:00
RockChinQ b06083d9b6 chore(plugin): pin SDK 0.6.17 2026-09-27 05:36:56 +00:00
RockChinQ c7306dc8b2 chore(plugin): pin SDK 0.6.16 2026-09-27 04:38:11 +00:00
RockChinQ 6da0aea901 fix(plugin): pin SDK 0.6.15 2026-09-27 02:59:40 +00:00
RockChinQ 765dac74ea fix(plugin): pin SDK 0.6.14 and bound shared readiness 2026-09-27 00:11:57 +00:00
RockChinQ 3d6a203724 chore(runtime): pin plugin SDK 0.6.13 2026-09-26 21:28:52 +00:00
RockChinQ e63fcb36e4 chore(runtime): pin plugin SDK 0.6.12 2026-09-26 20:42:15 +00:00
RockChinQ 755149ab0a chore(runtime): pin plugin SDK 0.6.11 2026-09-26 18:16:39 +00:00
RockChinQ 3493660f5e chore(runtime): pin plugin SDK 0.6.10 2026-09-26 17:08:51 +00:00
RockChinQ 64dc04d848 chore(runtime): pin plugin SDK 0.6.9 2026-09-26 14:33:35 +00:00
RockChinQ ccbf7c226e chore(runtime): pin plugin SDK 0.6.8 2026-09-26 13:02:43 +00:00
RockChinQ 92669ef584 fix(plugin): pin runtime SDK 0.6.7 2026-09-26 06:19:15 +00:00
RockChinQ 37e80e510f fix(plugin): pin runtime SDK 0.6.6 2026-09-26 05:21:50 +00:00
RockChinQ 9690f0bc6c fix(plugin): pin runtime SDK 0.6.5 2026-09-26 04:29:05 +00:00
RockChinQ ede433f0b1 fix(plugin): pin runtime SDK 0.6.4 2026-09-25 22:34:08 +00:00
RockChinQ deca26a666 chore(plugin): pin SDK 0.6.3 2026-09-25 19:09:16 +00:00