Skip to content

[pull] main from lobehub:main#495

Open
pull[bot] wants to merge 2279 commits intocode:mainfrom
lobehub:main
Open

[pull] main from lobehub:main#495
pull[bot] wants to merge 2279 commits intocode:mainfrom
lobehub:main

Conversation

@pull
Copy link

@pull pull bot commented Jan 27, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

@pull pull bot locked and limited conversation to collaborators Jan 27, 2026
@pull pull bot added ⤵️ pull merge-conflict Resolve conflicts manually labels Jan 27, 2026
semantic-release-bot and others added 27 commits January 29, 2026 14:02
### [Version 2.0.11](v2.0.10...v2.0.11)
<sup>Released on **2026-01-29**</sup>

#### 💄 Styles

- **misc**: Fix group task render.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### Styles

* **misc**: Fix group task render, closes [#11952](#11952) ([b8ef02e](b8ef02e))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
#11965)

* fix: when use group in market the supervisor plugins lost

* fix: slove the group pubilsh but not set the market id into group
### [Version&nbsp;2.0.12](v2.0.11...v2.0.12)
<sup>Released on **2026-01-29**</sup>

#### 🐛 Bug Fixes

- **misc**: Group publish to market should set local group market identifer.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's fixed

* **misc**: Group publish to market should set local group market identifer, closes [#11965](#11965) ([0bda4d9](0bda4d9))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
* wip: use stack bar chart

* 💄 style: update labels

* 🐛 fix: should not include INF vales

* ♻️ refactor: improve codes

* 💄 style: improve label format

* 💄 style: improve label format
### [Version&nbsp;2.0.13](v2.0.12...v2.0.13)
<sup>Released on **2026-01-29**</sup>

#### 💄 Styles

- **misc**: Fix usage table display issues.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### Styles

* **misc**: Fix usage table display issues, closes [#10108](#10108) ([4bd82c3](4bd82c3))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
…lag (#11975)

- Replace compile-time ENABLE_BUSINESS_FEATURES constant with runtime
  serverConfigSelectors.enableBusinessFeatures for cron module
- Redesign CronJobScheduleConfig with FormGroup pattern matching Settings UI
- Update CronJobHeader with simplified layout (28px title, Switch only)
- Convert all cron feature components to use createStaticStyles with cssVar
- Add i18n keys for cron job form labels

LOBE-4540
## [Version&nbsp;2.1.0](v2.0.13...v2.1.0)
<sup>Released on **2026-01-30**</sup>

#### ✨ Features

- **misc**: Refactor cron job UI and use runtime enableBusinessFeatures flag.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's improved

* **misc**: Refactor cron job UI and use runtime enableBusinessFeatures flag, closes [#11975](#11975) ([104a19a](104a19a))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
Fixed the download URL path from '/download' to '/downloads' to match the actual official site path.
* improve message content

* ♻️ refactor(docker-compose): 创建精简版 deploy 配置

- 新建 docker-compose/deploy 目录,包含最小化部署配置
- 仅保留核心服务:postgresql、redis、rustfs、searxng、lobe
- 移除 Casdoor 认证服务相关配置
- 移除可观测性服务(Grafana/Prometheus/Tempo/otel-collector)
- 使用 paradedb/paradedb:latest 镜像(支持 pgvector + pg_search)
- 更新 setup.sh 指向新的 deploy 目录
- 清理 .env 示例文件中的 Casdoor 相关配置

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* update document

* update content

* update content

* improve env

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
### [Version&nbsp;2.1.1](v2.1.0...v2.1.1)
<sup>Released on **2026-01-30**</sup>

#### 🐛 Bug Fixes

- **misc**: Correct desktop download URL path.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's fixed

* **misc**: Correct desktop download URL path, closes [#11990](#11990) ([e46df98](e46df98))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
* update document

* update documents

* update auth

* move

* update database

* move auth

* move auth

* update
### [Version&nbsp;2.1.2](v2.1.1...v2.1.2)
<sup>Released on **2026-01-30**</sup>

#### 🐛 Bug Fixes

- **misc**: Fix feishu sso provider.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's fixed

* **misc**: Fix feishu sso provider, closes [#11970](#11970) ([ffd9fff](ffd9fff))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
### [Version&nbsp;2.1.3](v2.1.2...v2.1.3)
<sup>Released on **2026-01-31**</sup>

#### 🐛 Bug Fixes

- **auth**: Add AUTH_DISABLE_EMAIL_PASSWORD env to enable SSO-only mode.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's fixed

* **auth**: Add AUTH_DISABLE_EMAIL_PASSWORD env to enable SSO-only mode, closes [#12009](#12009) ([f3210a3](f3210a3))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>
💄 style: update i18n

Co-authored-by: canisminor1990 <17870709+canisminor1990@users.noreply.github.com>
Innei and others added 30 commits February 11, 2026 13:10
* 🐛 fix: filter stdio MCP tools on web environment

Prevent stdio-based MCP tools (desktop-only) from being injected into agent
conversations on web platforms. Stdio transport requires Electron IPC which
is unavailable on web, causing runtime errors. Added environment-aware
filtering in createAgentToolsEngine enableChecker with comprehensive tests.

* 🐛 fix: filter stdio MCP tools on web environment

- Simplify serverExternalPackages config with nullish coalescing
- Filter out stdio MCP plugins in non-desktop environments since stdio transport requires Electron IPC
🔧 fix: update PR build workflows to trigger on release branches in addition to specific labels
…t in global styles (#12252)

* 🔧 chore: remove unused ESLint suppression for anonymous default export in global styles

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: refactor TypeScript linting to use a dedicated script for improved maintainability

Signed-off-by: Innei <tukon479@gmail.com>

---------

Signed-off-by: Innei <tukon479@gmail.com>
🐛 fix: correct import path for defaultSecurityBlacklist in test

The import path was pointing to `../defaultSecurityBlacklist` (core/) but
the file was moved to `../../audit/defaultSecurityBlacklist` during a
prior refactor. The broken import was lost during a rebase conflict
resolution, causing 8 cascading TS errors.
## 📦 Release v2.1.27

This branch contains changes for the upcoming v2.1.27 release.

### Change Type
- Checked out from dev branch and merged to main branch

### Release Process
1. ✅ Release branch created
2. ✅ Pushed to remote
3. 🔄 Waiting for PR review and merge
4. ⏳ Release workflow triggered after merge

---
Created by release script
#### 💻 Change Type

<!-- For change type, change [ ] to [x]. -->

- [ ] ✨ feat
- [ ] 🐛 fix
- [ ] ♻️ refactor
- [ ] 💄 style
- [ ] 👷 build
- [ ] ⚡️ perf
- [ ] ✅ test
- [ ] 📝 docs
- [x] 🔨 chore

#### 🔗 Related Issue

<!-- Link to the issue that is fixed by this PR -->

<!-- Example: Fixes #xxx, Closes #xxx, Related to #xxx -->

#### 🔀 Description of Change

<!-- Thank you for your Pull Request. Please provide a description
above. -->

#### 🧪 How to Test

<!-- Please describe how you tested your changes -->

<!-- For AI features, please include test prompts or scenarios -->

- [ ] Tested locally
- [ ] Added/updated tests
- [ ] No tests needed

#### 📸 Screenshots / Videos

<!-- If this PR includes UI changes, please provide screenshots or
videos -->

| Before | After |
| ------ | ----- |
| ...    | ...   |

#### 📝 Additional Information

<!-- Add any other context about the Pull Request here. -->

<!-- Breaking changes? Migration guide? Performance impact? -->

## Summary by Sourcery

CI:
- Introduce a new sync-main-to-canary GitHub Actions workflow that
creates an automatic PR from main to canary on pushes to main and remove
the previous sync-main-to-dev workflow.
#12260)

* ✨ feat: add hotfix workflow and script for automated hotfix management

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 fix: refactor PR creation command to use execFileSync for improved reliability

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: update @lobehub/ui version and refactor dynamic import handling

- Bump @lobehub/ui dependency from ^4.35.0 to ^4.36.2 in package.json.
- Refactor settingsContentToStatic.mts to simplify dynamic import processing by removing business feature checks.
- Add initialize.ts to enable immer's map set functionality.
- Correct import path in layout.tsx from 'initiallize' to 'initialize'.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: update @types/react version in package.json

- Bump @types/react dependency from ^19.2.9 to 19.2.14.
- Add @types/react version to overrides section for consistency.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: enhance auto-tag-release workflow for strict semver validation

- Updated regex to match strict semantic versioning format, allowing for optional prerelease and build metadata.
- Added validation step to ensure the version is a valid semver before proceeding with the release process.

Signed-off-by: Innei <tukon479@gmail.com>

* 🗑️ chore: remove defaultSecurityBlacklist test file

- Deleted the test file for DEFAULT_SECURITY_BLACKLIST as it is no longer needed.
- This cleanup helps maintain a more streamlined test suite.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: update localization files for multiple languages

- Improved translations in Arabic, Bulgarian, German, English, and Spanish for chat and tool-related strings.
- Enhanced descriptions for various parameters and added new keys for file handling and security warnings.
- Adjusted phrasing for clarity and consistency across languages.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: update PR comment script to include Actions Artifacts link

- Modified the PR comment generation script to accept an additional artifactsUrl parameter.
- Updated the comment format to include both Release download and Actions Artifacts links for better accessibility.

Signed-off-by: Innei <tukon479@gmail.com>

---------

Signed-off-by: Innei <tukon479@gmail.com>
- async_tasks: add inference_id column with index
- generation_topics: add type column (default 'image')
Upgrade next-mdx-remote from v5.0.0 to v6.0.0 to fix CVE-2026-0969,
an arbitrary code execution vulnerability in MDX content processing.
## 🩹 Hotfix v2.1.29

This PR starts a hotfix release from `main`.

### Release Process
1. ✅ Hotfix branch created from main
2. ✅ Pushed to remote
3. 🔄 Waiting for PR review and merge
4. ⏳ Auto tag + GitHub Release will be created after merge

---
Created by hotfix script

## Summary by Sourcery

Improve main-to-canary sync workflow robustness and tighten hotfix
auto-tagging criteria for release automation.

Enhancements:
- Make the main-to-canary sync workflow attempt direct merges to canary,
falling back to PR creation only when necessary or when conflicts occur,
and handle existing sync PRs more gracefully.
- Refine hotfix detection in the auto-tag workflow by requiring both a
hotfix branch prefix and a valid conventional commit-style PR title
prefix before tagging.
- Update the @lobehub/ui dependency to the latest patch version.

Build:
- Adjust release auto-tag workflow logic to gate hotfix tagging by both
branch naming and PR title format.

CI:
- Enhance GitHub Actions workflow for syncing main to canary with
conflict handling, direct-push optimization, and automated PR
management.
* ✨ chore: enhance release workflow to include conditional release body handling

- Added environment variable `RELEASE_BODY` to capture release notes from the GitHub event.
- Updated the workflow to use this variable, ensuring proper handling of release body content during manual dispatch events.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: simplify GitHub release workflow by removing hotfix-specific logic

- Consolidated the GitHub release creation step to handle both regular and hotfix releases under a single condition.
- Removed the separate hotfix release creation step to streamline the workflow.

Signed-off-by: Innei <tukon479@gmail.com>

* ✨ fix: replace UserPanel popover

- Introduced `PanelContentSkeleton` for better user experience during loading states in the UserPanel.
- Updated `UserPanel` to use the new skeleton and adjusted popover content handling.
- Refactored `PanelContent` to use `FC` type for better type safety.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 chore: bump @lobehub/ui dependency to version 4.38.1

- Updated the @lobehub/ui package to the latest version for improved features and bug fixes.

Signed-off-by: Innei <tukon479@gmail.com>

* 🔧 refactor: remove inset prop from Popover in UserPanel

- Cleaned up the Popover component in UserPanel by removing the unnecessary inset prop for improved clarity and maintainability.

Signed-off-by: Innei <tukon479@gmail.com>

---------

Signed-off-by: Innei <tukon479@gmail.com>
When merge conflicts involve .github/workflows/ files, GitHub requires
the `workflows: write` permission to push branches containing workflow
file changes. Without this permission, the sync branch push is rejected
with 'refusing to allow a GitHub App to create or update workflow without
workflows permission'.
The GITHUB_TOKEN cannot push changes to .github/workflows/ files due to
GitHub's security restrictions. The 'workflows' permission key added in
the previous commit is not a valid workflow permission scope.

Fix: Use secrets.GH_TOKEN (PAT with workflow scope) in the checkout step
so that git push has the necessary credentials to push branches that
contain workflow file changes (e.g. from merge conflicts).

Also reverts the invalid 'workflows: write' permission.
* feat: 添加多个新模型及其定价信息,更新模型解析配置

* fix: 更新多个模型的导入语法,添加新模型GLM-5及其属性

* feat: 添加多个Doubao模型及其定价信息,优化payload处理逻辑
🐛 fix(ci): use pull_request_target to support fork PR secrets
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

⤵️ pull merge-conflict Resolve conflicts manually

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Comments