chore(deps-dev): bump electron from 43.1.1 to 43.2.0 in /frontend - #478
chore(deps-dev): bump electron from 43.1.1 to 43.2.0 in /frontend#478dependabot[bot] wants to merge 12 commits into
Conversation
Bumps [electron](https://github.com/electron/electron) from 43.1.1 to 43.2.0. - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v43.1.1...v43.2.0) --- updated-dependencies: - dependency-name: electron dependency-version: 43.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Give every agent its own Docker sandbox with a private /workspace volume so tool execution never touches the backend host filesystem. - services/agent_sandbox.py: ensure_sandbox (reuse/create container + named volume, network_mode=none, read_only rootfs, tmpfs /tmp, rlimits via mem/pids/nano_cpus), exec_in_sandbox (host-side timeout + pkill), write_file (extract into the writable /workspace volume, not the read-only rootfs), export_artifact (copy a produced file out into media_storage), teardown (remove container +/- volume). - terminal_tools.run_approved_command + python_sandbox.run_python_code route through the sandbox first, falling back to a host subprocess under strict rlimits when no Docker daemon is available. - terminal_approval direct path shares the same sandbox-first execution. - delete_agent tears the sandbox down (container + volume) so removed agents don't leak isolated environments.
…ncies, and adjust linting configurations.
…ific linting warnings across codebase
CI ran an unpinned `pip install ruff`, so a routine release bump (0.15 -> 0.16) silently expanded Ruff's default rule set and turned the lint job red with ~730 findings across the whole repo (B008 on every FastAPI Depends(), isort, bandit) — none related to any code change. - backend/ruff.toml: pin the rule set to the classic default (E4/E7/E9 + F) the project was written against, so the effective set no longer moves with the Ruff version. Alembic revisions ignore F401 for their boilerplate Union import. - ci.yml: pin ruff==0.16.0 so the version is deterministic too. - drop the now-unused `from typing import Union` from 11 Alembic revisions and switch a webhook query to `.is_(True)` (E712). Adopting a broader rule set (bugbear, isort, …) should be a deliberate future PR that fixes the fallout in the same change.
Bumps [next](https://github.com/vercel/next.js) from 16.2.10 to 16.2.11. - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.11) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nd/electron-43.2.0
There was a problem hiding this comment.
🤖 Automated Code Review
Summary: 🟡 2 warnings · 🔵 3 suggestions
Code Review
Overall, the codebase looks well-structured and clean. However, I've identified a few issues that need attention:
[WARNING] backend/app/services/agent_sandbox.py:123
Issue: The ensure_sandbox function does not handle the case where the Docker daemon is unavailable, but the teardown function does. This inconsistency might lead to unexpected behavior.
Why it matters: Inconsistent error handling can cause issues in production.
Fix:
async def ensure_sandbox(user_id: int, agent_id: int | None) -> Optional[str]:
try:
# ...
except DockerUnavailable as exc:
log.info("agent_sandbox: docker unavailable, host fallback: %s", exc)
return None
except Exception as exc:
log.warning("agent_sandbox: ensure failed, host fallback: %s", exc)
return None[WARNING] backend/app/tools/terminal_tools.py:105
Issue: The execute_terminal_command function does not handle the case where the approved variable is None.
Why it matters: Unhandled None values can cause unexpected behavior.
Fix:
if approved is None:
return "Terminal Execution Request was REJECTED by user."[SUGGESTION] backend/app/services/agent_sandbox.py:283
Issue: The agent_sandbox module has a lot of duplicated code for handling Docker errors. Consider extracting a separate function for error handling.
Why it matters: Duplicated code makes maintenance harder.
Fix:
def _handle_docker_error(exc: Exception) -> None:
log.warning("agent_sandbox: docker error: %s", exc)
# ...
try:
# ...
except DockerUnavailable as exc:
_handle_docker_error(exc)[SUGGESTION] backend/tests/test_auth.py:16
Issue: The test_register_user function does not check for the presence of the refresh_token in the response.
Why it matters: Incomplete testing can lead to issues in production.
Fix:
assert "refresh_token" in data[SUGGESTION] backend/tests/test_tools.py:166
Issue: The test_forget_tool_parameters function does not test the case where the tool_parameters are None.
Why it matters: Incomplete testing can lead to issues in production.
Fix:
def test_forget_tool_parameters_none():
# ...
tool_parameters = None
# ...Overall, the codebase looks good, and these issues are minor. However, addressing them will improve the overall quality and reliability of the code.
Powered by NVIDIA NIM · meta/llama-3.1-70b-instruct
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps electron from 43.1.1 to 43.2.0.
Release notes
Sourced from electron's releases.
Commits
9b58e96fix: use GTK UI theme for Linux message boxes (#52410)281d885fix: invalid printer settings when settings passed (#52381)eddd87cfix: don't treat transparent overlays as occluders on macOS (#52389)2a35b07test: make webContents.clone() process-id test offline (#52377)4675b83chore: bump chromium to 150.0.7871.129 (43-x-y) (#52355)8d1cc07feat: add net.WebSocket (#52344)f7b6b2cfix: append --disable-gpu switch in app.disableHardwareAcceleration() (#52369)6a44af0refactor: migrateelectron::api::DesktopCapturerto cppgc (#52372)edf129ffix: enable GlobalShortcutsPortalPreferredTrigger by default on Linux (#52228)e04df3bbuild: add missing pdf resources dep in chromium_src (#52340)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)