mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-10-24 09:25:21 +08:00
RockChinQandmultica-agent
b8f7b295ba
Python (pyproject.toml + uv.lock): - Pillow >=13.0.0 (52 alerts closed, including 4 critical, 33 high, 15 medium) - pyjwt >=2.15.0 (15 alerts closed, including 1 critical, 8 high, 6 medium) - aiohttp >=3.14.4 (11 alerts closed) - virtualenv -> 21.14.13 (12 alerts closed) - mcp >=1.30.0,<2.0.0 (4 alerts closed) - soupsieve -> 3.0.4 (4 alerts closed) - urllib3 >=2.8.0 (3 alerts closed) - transformers -> 5.20.2 (3 alerts closed) - anyio -> 4.14.2 (2 alerts closed, including 1 critical) - oauthlib -> 4.0.0 (2 alerts closed) - certifi >=2026.10.19 (1 critical alert closed) - uv >=0.13.4 (1 critical alert closed) - sentence-transformers -> 6.2.0 (1 critical alert closed) - cryptography >=50.0.0, fsspec -> 2026.9.0, h2 -> 4.4.1, hpack -> 4.2.0 - langgraph-sdk -> 0.4.8, litellm >=1.88.6, Mako >=1.4.2, multidict -> 7.1.0 - opentelemetry-api -> 1.45.1, pip >=26.2.0, setuptools -> 84.2.1, torch -> 2.14.1, werkzeug -> 3.1.9 - PyPDF2: replaced with pypdf>=6.0.0 (deprecated PyPDF2 had no upstream fix; closes 1 medium alert) Web (web/package.json + dual lockfiles npm + pnpm in sync): - axios 1.17.0 -> 1.20.0 (22 alerts closed) - vite 8.0.16 -> 8.3.4 (5 alerts closed) - react-router / react-router-dom 7.17.0 -> 7.18.4 (5 alerts closed) - brace-expansion -> 1.1.21 & 5.0.12 (4 alerts closed) - js-yaml -> 4.3.2 (3 alerts closed) - follow-redirects -> 1.16.1 (2 alerts closed) - nanoid -> 3.3.18 / 3.3.20 (2 alerts closed) - postcss -> 8.5.31 (2 alerts closed) - @humanfs/node -> 0.16.8 (1 alert closed) - source-map-js -> 1.2.2 (1 alert closed) Unfixable upstream (pending ChromaDB release): - chromadb (4 open alerts: GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr, GHSA-f4j7-r4q5-qw2c; vulnerable range <=1.5.9, latest published version is 1.5.9 with no patched release). Verified: uv sync + core imports, pytest test suites, pnpm build, pnpm lint. Co-authored-by: multica-agent <[email protected]>
Debug LangBot Frontend
Please refer to the Development Guide for more information.
Tests
Run the frontend smoke tests without a backend process:
pnpm test:e2e
The Playwright suite starts Vite and mocks the LangBot backend and Space APIs.