赵月辉 / fastgpt-migrated

* fix: prevent path traversal in document meta API (CWE-22)

* address review: delete legacy document/app/api/meta route instead of patching

* docs: add root password FAQ

* docs: remove FAQ heading numbers

* docs: run document update scripts

* fix: tool connection

* doc

* fix: clear reference values in node debug

* doc

* fix: align invalid condition input type

* fix: support boolean values in BoolSchema

* update lock

Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 10.9.4 to 10.9.6.
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/v10.9.4...v10.9.6)

---
updated-dependencies:
- dependency-name: mermaid
  dependency-version: 10.9.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: reduce otel log body duplication

* refactor: record message into otel body instead of attributes

* fix: trace and metric initialization

* fix: remove redundant traceId and spanId in the body

* fix: avoid socket close abort false positives

* fix: require abort signal for close tracking

* doc

* doc

* fix: share field filter

* perf: review

* fix: build docs

* fix: deps

* fix: support older browsers for share page

* chore: remove local compatibility note

* fix: reduce base64 image payloads

* doc

* doc

* chore: migrate eslint config

* submodule

* doc

* fix: copy flat eslint config in app image

* ci: use packageManager pnpm version in sandbox test

---------

Co-authored-by: archer <545436317@qq.com>

* fix: ts

* fix review

* fix: form input icon store

* perf: variables

* perf: workflow file upload

* fix: test

* fix: icon refresh

* add time in preview

* perf: fix review

* fix: file selector reference

* docs: update ai settings guide

* fix: ci pnpm version error

* fix: ts

* fix review

* chore: bump and clean deps

* fix: action workflow

* doc

* doc

* doc

* doc style

* perf: ip check

* fix: restore IP limit proxy handling

* test: check xff and xri

* fix: type check

* doc

* update template

* fix: workspace

* fix: import

* fix: align IP limit env usage

* init env

* init env

* fix: mongo log url

* fix: mongo log url

* submodule

* update piagent import

---------

Co-authored-by: xqvvu <whoeverimf5@gmail.com>

* perf: read file worker

* perf: worker pool

* fix: test

* fix: review

* fix: test

* fix: add helm aes secret env

* fix: align required env configuration

* docs: align env default values

* test: make AES tamper case deterministic

* sandbox default env

* chore: centralize environment configuration

* fix: tighten env ownership and validation

* fix: harden env compatibility

* perf: env

* fix: resolve env ci failures

* perf: env

* perf: env

* remove invalid code

* doc

* doc

* doc

* doc

* perf: axios header get

* fix: test

* fix: i18n

* feat: close wecom channel;fix: scope chat resume to current app  (#6874)

* feat: close wecom channel

* fix: scope chat resume to current app (#6860)

* fix: scope chat resume to current app

Abort stale resume streams when switching apps and only resume after the current app/chat init state is aligned.

Made-with: Cursor

* refactor: centralize resume stream cancellation

Ensure only one resume stream is active per client tab and discard queued resume messages after abort.

Made-with: Cursor

* fix: make sure controller unique

* chore: remove redundant effect

* perf: remove invalid code

* update package

---------

Co-authored-by: Ryo <whoeverimf5@gmail.com>

* doc

* lock

---------

Co-authored-by: Ryo <whoeverimf5@gmail.com>

Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.2.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.6...v1.15.2)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.12.1 to 8.22.1.
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Automattic/mongoose/compare/8.12.1...8.22.1)

---
updated-dependencies:
- dependency-name: mongoose
  dependency-version: 8.22.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: scope chat resume to current app

Abort stale resume streams when switching apps and only resume after the current app/chat init state is aligned.

Made-with: Cursor

* refactor: centralize resume stream cancellation

Ensure only one resume stream is active per client tab and discard queued resume messages after abort.

Made-with: Cursor

* fix: make sure controller unique

* chore: remove redundant effect

* fix: skip allowed extensions

* fix: use upload control file config

Made-with: Cursor

* docs: v4.14.18

* chore: update pro submodule

* docs

* feat(app): sync aiChatReasoningEffort in SimpleApp form and refine AI settings inputs

* chore: bump pro submodule to 1a56dfc0

* feat: refactor AI setting modal layout, standardize input heights, and update internationalization strings