fetch_all_nodes already had a max_items guard (default 2000) but
fetch_all_edges had no such safeguard, allowing unbounded memory growth
on graphs with large numbers of edges.
Add _MAX_EDGES = 5000 constant and mirror the same loop-guard pattern
from fetch_all_nodes: cap the result list, emit a warning log, and
break pagination once the limit is reached.
Upgrade the transitive Python dependency NLTK from 3.9.2 to 3.10.0 to address CVE-2025-14009. The contributor title said 3.9.3, but the reviewed lockfile resolves 3.10.0.
HistoryDatabase.vue formatDate() derived the day from UTC
(new Date(dateStr).toISOString().slice(0, 10)) while the sibling
formatTime() uses local hours/minutes. The backend sends naive-local
timestamps (datetime.now().isoformat()), so for any non-UTC client the
two disagree by up to a day -- e.g. for the project's UTC+8 audience a
record created 00:00-08:00 local shows the previous day's date next to
the current time. Derive the date from local components so it matches
the time shown.
The Shanda sponsor logo's alt text was `666ghj%2MiroFish | Shanda`,
missing the `F` from the URL-encoded `/`. Every other badge in both
READMEs uses the correct `666ghj%2FMiroFish`. Bring this one in line
with the rest.
- Add return type annotation (list[str]) to Config.validate()
- Add type annotations (msg: str, -> None) to logger convenience functions
- Add FileParser.is_supported() classmethod for checking file format support
The filter was meant to skip the message just pushed by the caller, but
it matches by content, so a repeated message like "tell me more" also
removes the previous turn from the history sent to the backend.
DEBUG defaults to True (FLASK_DEBUG env var is 'True' unless overridden) and the server binds to 0.0.0.0. When debug mode is active, Flask enables the Werkzeug interactive debugger, which allows arbitrary Python code execution via the browser-accessible debugger console if an exception is triggered. Combined with the public bind address this creates a remote code execution vector on any deployment that forgets to set FLASK_DEBUG=False.
Affected files: config.py
Signed-off-by: ChinhLee <76194645+chinhkrb113@users.noreply.github.com>
- Add sans-serif font for English left-pane (status, workflow sections)
- Shorten English workflow step descriptions
- Reduce English report title font-size from 36px to 28px
- Use sans-serif font for English titles, descriptions and navbar
- Shorten English hero text to avoid overflow
- Fix :global() scoped CSS issue that was setting root font-size to 3.5rem
- Use separate unscoped style block for html[lang] selectors
Background threads (graph building, simulation prep, report generation,
profile generation) now inherit the requesting user's locale preference.
Previously these fell back to 'zh' because Flask request context was
unavailable in spawned threads.
Ensure poster_type stays PascalCase English and stance stays English enum
values regardless of language setting. Only natural language fields follow
the user's language preference.
The language instruction was causing LLM to change entity/relation naming
conventions. Now explicitly enforce PascalCase/UPPER_SNAKE_CASE for technical
identifiers while only applying language preference to description fields.
666ghj
harshitanand
orbisai0security
Osamaali313
BaiFu
YunyueLi
lllopic
au-sf
Sami Rusani
ChinhLee
ghostubborn