v2026.7.8#531
Merged
Merged
Conversation
Three security hardening measures: 1. Sandbox exec() builtins in PythonExecRuntime — block eval/exec/compile/__import__ and restrict imports to a safe allowlist, preventing arbitrary code execution even when workflow node code unsafely processes inputs. 2. Switch Jinja2 Template to SandboxedEnvironment in LLM and HTTP request nodes, preventing SSTI attacks through template rendering. 3. Add security comment to PUBLIC_PATH_REGEXES warning against adding workflow webhook paths to the auth bypass whitelist (refs #454). Closes #454 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…n-f665b1943147 chore: sync main into dev after main-f665b1943147
…ssion-binding fix: refresh stale channel session bindings
fix(channel): preserve emails when stripping mentions
Route streaming suite installs through the configured API base with credentials. Roll back component child installs when required children or runtime refresh fail, and cover both paths with regression tests.
fix: align home agent count with agent list
…login fix: refine skyeye and edr auth login state handling
Remove unrecorded legacy component children when uninstalling a Hub component so stale SOC WebUI pages no longer remain visible. Keep independently recorded child installs intact and cover legacy WebUI cleanup plus orphan child cleanup with regression tests.
feat/sangfor zero trust v3
Resolve the flockshub catalog conflict by preserving existing SOC workspace entries alongside the new Sangfor aTrust V3 device integration. Includes the staged Sangfor, SkyEye, channel, and stats updates from the merge.
fix/contracts alert time filter
CI：Fix autotest artifact download and matching
Resolve hub installer and catalog test conflicts while preserving component install progress, bundled SOC workspace changes, and plugin catalog/device cache invalidation. Verification: uv run pytest tests/hub/test_bundled_tools.py::test_uninstall_missing_tool_record_clears_device_template_cache tests/hub/test_hub_catalog.py::test_hub_refresh_clears_catalog_and_device_template_caches tests/hub/test_hub_catalog.py::test_hub_component_install_stream_reports_child_progress
perf/webui plugin loading
…stall fix(soc): improve chart sizing and workspace uninstall
On Windows, doctor may be invoked through the .venv Scripts flocks.exe entrypoint. Running the source installer synchronously keeps that executable locked while uv sync tries to replace it, which can fail with os error 32. Start a PowerShell handoff helper that waits for the current process to exit, then reruns doctor from the source venv so the installer can update the environment without self-locking.
…completion fix(provider): support max_completion_tokens for openai-compatible
…lock fix(cli): hand off Windows doctor before install
chore/update-version-2026-7-8
duguwanglong
approved these changes
Jul 8, 2026
duguwanglong
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.