0.64.0 — Security release

This is a security release with two fixes for path-traversal / arbitrary-file-access vulnerabilities in Langroid's file tools and SQL chat agent. Upgrading is recommended for all users, particularly anyone who exposes these tools to untrusted input or LLM-influenced tool arguments.

pip install -U langroid

Security fixes

1. Path traversal in file tools (ReadFileTool, WriteFileTool, ListDirTool)

Advisory: GHSA-fg23-3346-88f5 — High (CVSS 7.1), CWE-22 / CWE-23

The file tools changed into the configured curr_dir but then operated on the raw, caller-supplied path without verifying that the final path stayed inside curr_dir. A value such as ../secret.txt, an absolute path, or an in-directory symlink pointing outside could read, write, or list files outside the intended workspace — a real risk in agentic workflows where an LLM or an end user can influence tool arguments.

Fix: a new safe_resolve_path() helper resolves the requested path against curr_dir and rejects anything that escapes it (covers .., absolute paths, and symlink-based escapes). All three tools now refuse out-of-bounds paths.

Reported by @chaitanyagarware.

2. Arbitrary file read via SQLChatAgent validator bypass

Advisory: GHSA-pmch-g965-grmr — High, CWE-22 / CWE-89

The defense-in-depth SQL blocklist introduced in 0.63.0 listed individual function names and missed the pg_read_file / pg_stat_file / pg_ls_* / pg_current_logfile family. A plain SELECT pg_read_file('...') therefore passed both the SELECT-only allowlist and the blocklist, allowing arbitrary file reads from the PostgreSQL host — even under the strict defaults. Narrower gaps in SQLite ATTACH and MSSQL OPENDATASOURCE handling were closed as well.

Fix: the blocklist now matches the entire pg_(read|stat|ls|current_logfile)... family, handles ATTACH with or without the DATABASE keyword, blocks OPENDATASOURCE alongside OPENROWSET, and additionally blocks CREATE ... LANGUAGE / RULE / EVENT TRIGGER / FOREIGN TABLE.

Reported by @tonghuaroot.

Behavior change (why this is a minor release)

Both fixes restrict behavior that previously succeeded: file-tool paths that escape curr_dir, and the PostgreSQL/SQLite/MSSQL primitives listed above, are now rejected with an explicit error. This is intentional. If your application legitimately relied on any of these, you will need to adjust.

Upgrade

pip install -U langroid

Full changelog: 0.63.0...0.64.0