mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-10-28 11:25:35 +08:00
RockChinQandmultica-agent
029fbbf3c3
The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32. 0.0.27 falls inside four published advisories, so any resolve that honours the floor rather than the lock can land on a vulnerable release: - GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time querystring DoS, semicolon field-separator and Content-Disposition parameter smuggling), fixed in 0.0.30 - GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in 0.0.31 The locked 0.0.32 has no known advisories. Raising the floor to match the lock costs nothing and keeps the two from drifting apart. Reachability, for the record: multipart parsing happens on the skills and plugin local-upload routes, both of which require USER_TOKEN_OR_API_KEY with RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous one. The resolved version is unchanged; only the requirement metadata moves. Co-authored-by: multica-agent <[email protected]>
237 lines
6.1 KiB
TOML
237 lines
6.1 KiB
TOML
[project]
|
|
name = "langbot"
|
|
version = "4.11.2"
|
|
description = "Production-grade platform for building agentic IM bots"
|
|
readme = "README.md"
|
|
license-files = ["LICENSE"]
|
|
requires-python = ">=3.11,<4.0"
|
|
dependencies = [
|
|
"aiocqhttp>=1.4.4",
|
|
"aiofiles>=24.1.0",
|
|
"aiohttp>=3.14.4",
|
|
"aioshutil>=1.5",
|
|
"aiosqlite>=0.21.0",
|
|
"anthropic>=0.51.0",
|
|
"argon2-cffi>=23.1.0",
|
|
"async-lru>=2.0.5",
|
|
"certifi>=2026.10.19",
|
|
"colorlog~=6.6.0",
|
|
"cryptography>=50.0.0",
|
|
"dashscope>=1.25.10",
|
|
"dingtalk-stream>=0.24.0",
|
|
"discord-py>=2.5.2",
|
|
"pynacl>=1.5.0", # Required for Discord voice support
|
|
"gewechat-client>=0.1.5",
|
|
"lark-oapi>=1.5.5",
|
|
"mcp>=1.30.0,<2.0.0",
|
|
"nakuru-project-idk>=0.0.2.1",
|
|
"ollama>=0.4.8",
|
|
"openai>1.0.0",
|
|
"pillow>=13.0.0",
|
|
"psutil>=7.0.0",
|
|
"pycryptodome>=3.22.0",
|
|
"pydantic>2.0",
|
|
"pyjwt>=2.15.0",
|
|
"python-telegram-bot>=22.0",
|
|
"pyyaml>=6.0.2",
|
|
"qq-botpy-rc>=1.2.1.6",
|
|
"qrcode>=7.4",
|
|
"quart>=0.20.0",
|
|
"quart-cors>=0.8.0",
|
|
"requests>=2.33.0",
|
|
"regex>=2026.1.15",
|
|
"slack-sdk>=3.35.0",
|
|
"alembic>=1.15.0",
|
|
"sqlalchemy[asyncio]>=2.0.40",
|
|
"sqlmodel>=0.0.24",
|
|
"telegramify-markdown>=0.5.1",
|
|
"tiktoken>=0.9.0",
|
|
"urllib3>=2.8.0",
|
|
"websockets>=15.0.1",
|
|
"python-socks>=2.7.1", # dingtalk missing dependency
|
|
"pip>=26.2.0",
|
|
"ruff>=0.11.9",
|
|
"pre-commit>=4.2.0",
|
|
"uv>=0.13.4",
|
|
"mypy>=1.16.0",
|
|
"pypdf>=6.0.0",
|
|
"python-docx>=1.1.0",
|
|
"pandas>=2.2.2",
|
|
"chardet>=5.2.0",
|
|
"xxhash>=3.5.0",
|
|
"markdown>=3.6",
|
|
"beautifulsoup4>=4.12.3",
|
|
"ebooklib>=0.18",
|
|
"html2text>=2024.2.26",
|
|
"langchain>=1.3.9",
|
|
"langchain-core>=1.3.3",
|
|
"langsmith>=0.8.18",
|
|
"python-multipart>=0.0.32",
|
|
"Mako>=1.4.2",
|
|
"langchain-text-splitters>=1.1.2",
|
|
"chromadb>=1.0.0,<2.0.0",
|
|
"qdrant-client (>=1.15.1,<2.0.0)",
|
|
"langbot-plugin==0.7.18",
|
|
"asyncpg>=0.30.0",
|
|
"line-bot-sdk>=3.19.0",
|
|
"matrix-nio>=0.25.2",
|
|
"tboxsdk>=0.0.10",
|
|
"boto3>=1.35.0",
|
|
"pymilvus>=2.6.4",
|
|
"pgvector>=0.4.1",
|
|
"botocore>=1.42.39",
|
|
"litellm>=1.88.6",
|
|
"valkey-glide>=2.5.2,<3.0.0; sys_platform != 'win32'", # No Windows wheels are published
|
|
"webauthn>=3.0.0",
|
|
"httpx[socks]>=0.28.1",
|
|
]
|
|
keywords = [
|
|
"bot",
|
|
"agent",
|
|
"telegram",
|
|
"plugins",
|
|
"openai",
|
|
"instant-messaging",
|
|
"wechat",
|
|
"qq",
|
|
"dify",
|
|
"llm",
|
|
"chatgpt",
|
|
"deepseek",
|
|
"onebot",
|
|
]
|
|
classifiers = [
|
|
"Development Status :: 5 - Production/Stable",
|
|
"Framework :: AsyncIO",
|
|
"Framework :: Robot Framework",
|
|
"Framework :: Robot Framework :: Library",
|
|
"Operating System :: OS Independent",
|
|
"Programming Language :: Python :: 3",
|
|
"Topic :: Communications :: Chat",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
seekdb = [
|
|
"pyseekdb==1.4.0.post1",
|
|
"pylibseekdb==1.4.0; sys_platform == 'linux' or (sys_platform == 'darwin' and platform_machine == 'arm64')",
|
|
]
|
|
|
|
[project.urls]
|
|
Homepage = "https://langbot.app"
|
|
Documentation = "https://langbot.app/docs"
|
|
Repository = "https://github.com/langbot-app/LangBot"
|
|
|
|
[project.scripts]
|
|
langbot = "langbot.__main__:main"
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=61.0", "wheel"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools]
|
|
package-data = { "langbot" = ["templates/**", "pkg/i18n/locales/*.json", "pkg/provider/modelmgr/requesters/*", "pkg/platform/sources/*", "pkg/platform/adapters/**", "web/dist/**", "pkg/persistence/alembic/**"] }
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"moto>=5.2.1",
|
|
"pre-commit>=4.2.0",
|
|
"pytest>=9.0.3",
|
|
"pytest-asyncio>=1.0.0",
|
|
"pytest-cov>=7.0.0",
|
|
"ruff>=0.11.9",
|
|
]
|
|
|
|
[tool.ruff]
|
|
# Exclude a variety of commonly ignored directories.
|
|
exclude = [
|
|
".bzr",
|
|
".direnv",
|
|
".eggs",
|
|
".git",
|
|
".git-rewrite",
|
|
".hg",
|
|
".ipynb_checkpoints",
|
|
".mypy_cache",
|
|
".nox",
|
|
".pants.d",
|
|
".pyenv",
|
|
".pytest_cache",
|
|
".pytype",
|
|
".ruff_cache",
|
|
".svn",
|
|
".tox",
|
|
".venv",
|
|
".vscode",
|
|
"__pypackages__",
|
|
"_build",
|
|
"buck-out",
|
|
"build",
|
|
"dist",
|
|
"node_modules",
|
|
"site-packages",
|
|
"venv",
|
|
]
|
|
|
|
line-length = 120
|
|
indent-width = 4
|
|
|
|
# Assume Python 3.12
|
|
target-version = "py312"
|
|
|
|
[tool.ruff.lint]
|
|
# Enable Pyflakes (`F`) and a subset of the pycodestyle (`E`) codes by default.
|
|
select = ["E4", "E7", "E9", "F"]
|
|
ignore = [
|
|
"E712", # Comparison to true should be 'if cond is true:' or 'if cond:' (E712)
|
|
"F402", # Import `loader` from line 8 shadowed by loop variable
|
|
"F403", # * used, unable to detect undefined names
|
|
"F405", # may be undefined, or defined from star imports
|
|
"E741", # Ambiguous variable name: `l`
|
|
"E722", # bare-except
|
|
"E721", # type-comparison
|
|
"F821", # undefined-all
|
|
"FURB113", # repeated-append
|
|
"FURB152", # math-constant
|
|
"UP007", # non-pep604-annotation
|
|
"UP032", # f-string
|
|
"UP045", # non-pep604-annotation-optional
|
|
"B005", # strip-with-multi-characters
|
|
"B006", # mutable-argument-default
|
|
"B007", # unused-loop-control-variable
|
|
"B026", # star-arg-unpacking-after-keyword-arg
|
|
"B903", # class-as-data-structure
|
|
"B904", # raise-without-from-inside-except
|
|
"B905", # zip-without-explicit-strict
|
|
"N806", # non-lowercase-variable-in-function
|
|
"N815", # mixed-case-variable-in-class-scope
|
|
"PT011", # pytest-raises-too-broad
|
|
"SIM102", # collapsible-if
|
|
"SIM103", # needless-bool
|
|
"SIM105", # suppressible-exception
|
|
"SIM107", # return-in-try-except-finally
|
|
"SIM108", # if-else-block-instead-of-if-exp
|
|
"SIM113", # enumerate-for-loop
|
|
"SIM117", # multiple-with-statements
|
|
"SIM210", # if-expr-with-true-false
|
|
]
|
|
|
|
# Allow fix for all enabled rules (when `--fix`) is provided.
|
|
fixable = ["ALL"]
|
|
unfixable = []
|
|
|
|
# Allow unused variables when underscore-prefixed.
|
|
dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
|
|
|
|
[tool.ruff.format]
|
|
# Like Black, use double quotes for strings.
|
|
quote-style = "single"
|
|
|
|
# Like Black, indent with spaces, rather than tabs.
|
|
indent-style = "space"
|
|
|
|
# Like Black, respect magic trailing commas.
|
|
skip-magic-trailing-comma = false
|
|
|
|
# Like Black, automatically detect the appropriate line ending.
|
|
line-ending = "auto"
|