tiennm99/DocsGPT
1
0 Fork 0
mirror of https://github.com/tiennm99/DocsGPT.git synced 2026-10-12 18:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,151 Commits 2 Branches 0 Tags
ee552620ebc4e8875685d15507797fa06d237cf9
Commit Graph
5151 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex ee552620eb fix: mini nits 2026-08-12 17:05:57 +01:00
Alex 71c2e8d4c9 Update base.py 2026-08-12 16:58:53 +01:00
Alex 663869868f fix: better zip protection 2026-08-12 16:55:33 +01:00
Alex 8dd4c9a417 fix: more mermaid protection 2026-08-12 15:01:41 +01:00
Alex 4b1bc17c77 feat: image refactor 2026-08-12 12:36:43 +01:00
Alex 1c2b0f506a Merge pull request #2667 from arc53/chore/bump-docling-2.119 
chore: bump docling
 2026-08-12 09:14:47 +01:00
Alex ca53a3ac4b chore: bump docling 2026-08-12 09:05:00 +01:00
Alex f1c13d4f30 Merge pull request #2653 from ManishMadan2882/fix/react-widget-audit-security 
fix(react-widget): resolve npm audit advisories in shipped dependency tree
 2026-08-11 17:30:40 +01:00
Alex 8d4ac88a04 Merge pull request #2666 from arc53/chore/docs-deps-bump 
chore: bump docs dependencies to latest
 2026-08-11 17:28:24 +01:00
Alex 1b612e4e96 chore: bump docs dependencies to latest 
Upgrade the docs site to Next 16 and React 19:

- next 15.5.9 -> 16.3.0
- react / react-dom 18.2.0 -> 19.2.8
- @vercel/analytics 1.1.1 -> 2.0.1
- docsgpt-react 0.5.1 -> 0.6.3
- pagefind 1.4.0 -> 1.5.2
- typescript 5.9.3 -> 6.0.3

Two deliberate holds:

Next 16 makes Turbopack the default builder, but nextra 4.6.1 is not
compatible with it. Its loader calls transformerTwoslash() at module top
level, and twoslash gets an undefined ts.sys inside Turbopack's
webpack-loader shim, so every .mdx file fails to compile. Nextra offers no
option to disable twoslash, so the dev and build scripts opt out with
--webpack until nextra supports Turbopack.

typescript stays on 6.0.3 rather than 7.0.2 for the same reason: TS 7 is the
native rewrite and drops the ts.sys API that @typescript/vfs and twoslash
rely on, which breaks the build even under webpack. twoslash declares
typescript ^5.5.0 || ^6.0.0, so 6.0.3 is the ceiling this toolchain supports.

nextra and nextra-theme-docs were already at the latest 4.6.1.
 2026-08-11 17:23:28 +01:00
Alex 0d7fd529ef Merge pull request #2664 from arc53/feat/agent-guardrails 
feat: guardrails init
 2026-08-11 17:06:09 +01:00
Alex d21a49158c fix: close two guardrail bypasses and an inert instance floor 
URLCheck read the host from a regex capture group whose character class
excluded "@", so a userinfo-prefixed URL passed its userinfo off as the
host: https://allowed.com@evil.tld/ satisfied an allow_hosts entry for
allowed.com, and http://ok.com@blocked.tld/ evaded block_hosts. Match the
whole URL and take the host from the parsed authority instead. A URL that
will not parse is now redacted rather than waved through.

The PRIVATE_KEY secret pattern matched only the BEGIN header, so a redact
action masked the header and released the key material and END line in
the clear. Span the whole armored block, falling back to the header when
the block is unterminated or over the cap, and raise max_match_chars so
the streaming guard's window still covers a full PEM. The pattern also
now catches ENCRYPTED, DSA and PGP BLOCK headers, which it missed
entirely.

The documented GUARDRAILS_FLOOR example omitted "enabled": true, and the
field defaults to false, so an operator copying it got a floor that
parsed clean, merged to nothing and warned nowhere. Fix the example and
warn when a floor is set but disabled.
 2026-08-11 16:15:58 +01:00
Alex 3adc09af5d fix: more guardrail hardening 2026-08-11 15:13:27 +01:00
Alex 9446c16108 fix: guardrail fixes 2026-08-11 13:33:52 +01:00
Alex e44cff2e91 fix: mini copy edits 2026-08-11 12:29:46 +01:00
Alex 4f5d565298 Merge pull request #2665 from arc53/ManishMadan2882/main 
(fix)ui/chat: drop bubble avatar chrome, unify live-step state
 2026-08-11 12:16:23 +01:00
Alex 9aa7a01949 fix: e2e tests 2026-08-11 11:47:09 +01:00
Alex 64a6b81fbb feat: guardrails init 2026-08-11 00:09:56 +01:00
ManishMadan2882 c5b6c27f05 (chore)deps: purge unused snarkdown 2026-08-11 03:27:51 +05:30
ManishMadan2882 7d1aafebce fix(react-widget): resolve npm audit advisories in shipped dependency tree 
Lockfile-only update; package.json is unchanged.

extensions/react-widget is published as the npm package `docsgpt` and as an
HTML embed, so its production dependency tree reaches every consumer. That
tree carried 5 advisories (2 high, 2 moderate, 1 low), 7 across the full tree.

  dompurify        3.4.0  -> 3.4.13  (moderate, XSS)
  js-yaml          4.1.1  -> 4.3.1   (high, quadratic-complexity DoS)
  linkify-it       5.0.0  -> 5.0.2   (high)
  markdown-it     14.1.0  -> 14.3.0  (moderate)
  svgo             4.0.1  -> 4.0.2   (high, dev)
  brace-expansion  1.1.12 -> 1.1.18  (high, CVE-2026-13149; nested copies)
  @babel/core      7.29.0 -> 7.29.7  (low)

npm audit goes 7 -> 0 (production tree 5 -> 0). Verified locally: clean
npm ci, `npm run build` (embed) and `npm run build:react` (library) both
build, npm run lint and tsc --noEmit pass.
 2026-08-11 03:27:51 +05:30
Alex f7b3d3eacd Merge pull request #2636 from ManishMadan2882/main 
(feat)ui/chat: inline streaming steps for reasoning and tool calls
 2026-08-10 19:49:21 +01:00
Alex 94766c93cb fix: minor edits, cleanup, light changes 2026-08-10 19:45:57 +01:00
Alex bac62b04b9 Merge pull request #2652 from arc53/fix/stream-durability-triad 
feat: improve tool call durability on long calls
 2026-08-10 15:38:52 +01:00
Alex 26038da499 feat: auto cancel on retry or edit during reconciliation 2026-08-10 15:26:03 +01:00
Alex b6cc07ad04 fix: mini quality issue 2026-08-10 15:07:31 +01:00
Alex 924864f964 fix: tests 2026-08-10 14:51:33 +01:00
Alex ca345e3bf8 feat: improve tool call durability on long calls 2026-08-10 14:32:30 +01:00
Alex 7137196212 Merge pull request #2648 from arc53/chore/bump-backend-deps 
chore(deps): bump 47 backend dependencies
 2026-08-10 13:11:05 +01:00
Manish Madan 46f99c1759 Merge pull request #2461 from arc53/dependabot/npm_and_yarn/extensions/react-widget/npm_and_yarn-3d438dea79 
chore(deps-dev): bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.8 in /extensions/react-widget in the npm_and_yarn group across 1 directory
 2026-08-10 17:29:15 +05:30
dependabot[bot] 3ac2dc9351 chore(deps-dev): bump @babel/plugin-transform-modules-systemjs 
Bumps the npm_and_yarn group with 1 update in the /extensions/react-widget directory: [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs).


Updates `@babel/plugin-transform-modules-systemjs` from 7.29.0 to 7.29.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 11:57:12 +00:00
Manish Madan 77ec98f7c8 Merge pull request #2455 from arc53/dependabot/npm_and_yarn/extensions/react-widget/typescript-eslint/parser-8.59.2 
chore(deps-dev): bump @typescript-eslint/parser from 8.59.1 to 8.66.0 in /extensions/react-widget
 2026-08-10 17:25:44 +05:30
dependabot[bot] 74283bd6db chore(deps-dev): bump @typescript-eslint/parser 
Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.59.1 to 8.66.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.59.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 11:54:08 +00:00
Manish Madan c18dc1da2f Merge pull request #2454 from arc53/dependabot/npm_and_yarn/extensions/react-widget/flow-bin-0.312.1 
chore(deps): bump flow-bin from 0.311.0 to 0.326.0 in /extensions/react-widget
 2026-08-10 17:22:35 +05:30
dependabot[bot] 8a9ae1e8d4 chore(deps): bump flow-bin in /extensions/react-widget 
Bumps [flow-bin](https://github.com/flowtype/flow-bin) from 0.311.0 to 0.326.0.
- [Release notes](https://github.com/flowtype/flow-bin/releases)
- [Commits](https://github.com/flowtype/flow-bin/commits)

---
updated-dependencies:
- dependency-name: flow-bin
  dependency-version: 0.312.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 11:51:28 +00:00
Alex 209c29d759 fix: test 2026-08-10 12:37:40 +01:00
Manish Madan 8c66a65e81 Merge pull request #2650 from arc53/dependabot/npm_and_yarn/frontend/npm_and_yarn-5210b699ed 
chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates
 2026-08-10 16:50:11 +05:30
dependabot[bot] 540e95e9d6 chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates 
Bumps the npm_and_yarn group with 3 updates in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [dompurify](https://github.com/cure53/DOMPurify) and [js-yaml](https://github.com/nodeca/js-yaml).


Updates `brace-expansion` from 1.1.12 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.18)

Updates `dompurify` from 3.4.0 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.13)

Updates `js-yaml` from 4.1.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 11:18:08 +00:00
Alex a166796f6c feat: prune some deps 2026-08-10 12:10:54 +01:00
Manish Madan 8c127b4306 Merge pull request #2644 from arc53/dependabot/npm_and_yarn/frontend/vitejs/plugin-react-6.0.5 
chore(deps-dev): bump @vitejs/plugin-react from 6.0.1 to 6.0.5 in /frontend
 2026-08-10 16:29:56 +05:30
dependabot[bot] 523a2fd137 chore(deps-dev): bump @vitejs/plugin-react in /frontend 
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.0.1 to 6.0.5.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 10:57:55 +00:00
Manish Madan 85f7b56d6c Merge pull request #2643 from arc53/dependabot/npm_and_yarn/frontend/types/lodash-4.17.25 
chore(deps-dev): bump @types/lodash from 4.17.20 to 4.17.25 in /frontend
 2026-08-10 16:26:15 +05:30
dependabot[bot] 8f6cb07a38 chore(deps-dev): bump @types/lodash from 4.17.20 to 4.17.25 in /frontend 
Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.17.20 to 4.17.25.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

---
updated-dependencies:
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 10:54:44 +00:00
Manish Madan aebc1e2121 Merge pull request #2642 from arc53/dependabot/npm_and_yarn/frontend/mermaid-11.16.1 
chore(deps): bump mermaid from 11.15.0 to 11.16.1 in /frontend
 2026-08-10 16:23:19 +05:30
dependabot[bot] 336c79f275 chore(deps): bump mermaid from 11.15.0 to 11.16.1 in /frontend 
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.15.0 to 11.16.1.
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.1)

---
updated-dependencies:
- dependency-name: mermaid
  dependency-version: 11.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 10:49:20 +00:00
Manish Madan cbcb0133c7 Merge pull request #2641 from arc53/dependabot/npm_and_yarn/frontend/vite-8.2.0 
chore(deps-dev): bump vite from 8.1.5 to 8.2.1 in /frontend
 2026-08-10 16:17:05 +05:30
dependabot[bot] 8dd65320ad chore(deps-dev): bump vite from 8.1.5 to 8.2.1 in /frontend 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.5 to 8.2.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 10:44:54 +00:00
Manish Madan 56bb1c1869 Merge pull request #2640 from arc53/dependabot/npm_and_yarn/frontend/radix-ui/react-dialog-1.1.23 
chore(deps): bump @radix-ui/react-dialog from 1.1.19 to 1.1.23 in /frontend
 2026-08-10 16:13:29 +05:30
dependabot[bot] 0f3c10715e chore(deps): bump @radix-ui/react-dialog in /frontend 
Bumps [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) from 1.1.19 to 1.1.23.
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog)

---
updated-dependencies:
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.1.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 10:38:50 +00:00
Alex c5b372df1e fix: pin rapidocr and onnxruntime 2026-08-10 10:37:43 +01:00
ManishMadan2882 e2f85bf19b (fix)streaming status: code quality 2026-08-09 19:02:50 +05:30