AstrBot

v4.26.0-beta.8 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

✓ No known CVEs patched

This release patches 1 known CVE

Topics

agent ai astrbot llm chatgpt discord

+9 more

docker gemini llama mcp openai python qq qqbot telegram

Affected surfaces

rce_ssrf deps

Summary

AI summary

Broad release touches 重点更新, 修复, 其他, and Highlights.

Full changelog

优化 WebUI 升级流程：Core 更新改为后台任务，并在检测到 WebUI 与 Core 版本错配时提供自动恢复重启引导，避免刷新页面后卡在 Missing API key。(#8846)
增强 QQ 官方机器人群聊能力，支持群消息创建类型，并允许 Webhook 适配器在无缓存 msg_id 时主动发送群消息。(#8838, #8841)

Improved the WebUI upgrade flow by running Core updates as background tasks and adding guided recovery when WebUI/Core version mismatches are detected, preventing refreshes from leaving users stuck at Missing API key. (#8846)
Enhanced QQ Official Bot group chat support with group message create events and proactive Webhook group sends without requiring a cached msg_id. (#8838, #8841)

Fixed duplicate-name validation when editing personas. (#8843)
Hardened sandbox file transfers and CUA health checks to reduce file-operation risk in abnormal environments. (#8840)

Hardened sandbox file transfers and CUA health checks to reduce abnormal‑environment file‑operation risks

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track AstrBot

Get notified when new releases ship.

About AstrBot