@lobehub/lobehub 2.0.0-next.167 → 2.0.0-next.169

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 # Changelog
 
+## [Version 2.0.0-next.169](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.168...v2.0.0-next.169)
+
+<sup>Released on **2025-12-12**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Fix CVE errors.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Fix CVE errors, closes [#10748](https://github.com/lobehub/lobe-chat/issues/10748) ([6591f3c](https://github.com/lobehub/lobe-chat/commit/6591f3c))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
+## [Version 2.0.0-next.168](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.167...v2.0.0-next.168)
+
+<sup>Released on **2025-12-12**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Slove market oidc error.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Slove market oidc error, closes [#10715](https://github.com/lobehub/lobe-chat/issues/10715) ([108d2a7](https://github.com/lobehub/lobe-chat/commit/108d2a7))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
 ## [Version 2.0.0-next.167](https://github.com/lobehub/lobe-chat/compare/v2.0.0-next.166...v2.0.0-next.167)
 
 <sup>Released on **2025-12-11**</sup>

package/README.md

@@ -352,7 +352,7 @@ In addition, these plugins are not limited to news aggregation, but can also ext
 | [SEO](https://lobechat.com/discover/plugin/SEO)<br/><sup>By **orrenprunckun** on **2025-11-14**</sup>                       | Enter any URL and keyword and get an On-Page SEO analysis & insights!<br/>`seo`                                                           |
 | [Shopping tools](https://lobechat.com/discover/plugin/ShoppingTools)<br/><sup>By **shoppingtools** on **2025-10-27**</sup>  | Search for products on eBay & AliExpress, find eBay events & coupons. Get prompt examples.<br/>`shopping` `e-bay` `ali-express` `coupons` |
 
-> 📊 Total plugins: [<kbd>**41**</kbd>](https://lobechat.com/discover/plugins)
+> 📊 Total plugins: [<kbd>**37**</kbd>](https://lobechat.com/discover/plugins)
 
  <!-- PLUGIN LIST -->
 
@@ -387,8 +387,8 @@ Our marketplace is not just a showcase platform but also a collaborative space.
 | Recent Submits                                                                                                                                                                 | Description                                                                                                                                                                                                              |
 | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | [Turtle Soup Host](https://lobechat.com/discover/assistant/lateral-thinking-puzzle)<br/><sup>By **[CSY2022](https://github.com/CSY2022)** on **2025-06-19**</sup>              | A turtle soup host needs to provide the scenario, the complete story (truth of the event), and the key point (the condition for guessing correctly).<br/>`turtle-soup` `reasoning` `interaction` `puzzle` `role-playing` |
-| [Gourmet Reviewer🍟](https://lobechat.com/discover/assistant/food-reviewer)<br/><sup>By **[renhai-lab](https://github.com/renhai-lab)** on **2025-06-17**</sup>                | Food critique expert<br/>`gourmet` `review` `writing`                                                                                                                                                                    |
 | [Academic Writing Assistant](https://lobechat.com/discover/assistant/academic-writing-assistant)<br/><sup>By **[swarfte](https://github.com/swarfte)** on **2025-06-17**</sup> | Expert in academic research paper writing and formal documentation<br/>`academic-writing` `research` `formal-style`                                                                                                      |
+| [Gourmet Reviewer🍟](https://lobechat.com/discover/assistant/food-reviewer)<br/><sup>By **[renhai-lab](https://github.com/renhai-lab)** on **2025-06-17**</sup>                | Food critique expert<br/>`gourmet` `review` `writing`                                                                                                                                                                    |
 | [Minecraft Senior Developer](https://lobechat.com/discover/assistant/java-development)<br/><sup>By **[iamyuuk](https://github.com/iamyuuk)** on **2025-06-17**</sup>           | Expert in advanced Java development and Minecraft mod and server plugin development<br/>`development` `programming` `minecraft` `java`                                                                                   |
 
 > 📊 Total agents: [<kbd>**505**</kbd> ](https://lobechat.com/discover/assistants)

package/README.zh-CN.md

@@ -345,7 +345,7 @@ LobeChat 的插件生态系统是其核心功能的重要扩展，它极大地
 | [SEO](https://lobechat.com/discover/plugin/SEO)<br/><sup>By **orrenprunckun** on **2025-11-14**</sup>                       | 输入任何 URL 和关键词，获取页面 SEO 分析和见解！<br/>`seo`                                                         |
 | [购物工具](https://lobechat.com/discover/plugin/ShoppingTools)<br/><sup>By **shoppingtools** on **2025-10-27**</sup>        | 在 eBay 和 AliExpress 上搜索产品，查找 eBay 活动和优惠券。获取快速示例。<br/>`购物` `e-bay` `ali-express` `优惠券` |
 
-> 📊 Total plugins: [<kbd>**41**</kbd>](https://lobechat.com/discover/plugins)
+> 📊 Total plugins: [<kbd>**37**</kbd>](https://lobechat.com/discover/plugins)
 
  <!-- PLUGIN LIST -->
 
@@ -376,8 +376,8 @@ LobeChat 的插件生态系统是其核心功能的重要扩展，它极大地
 | 最近新增                                                                                                                                                         | 描述                                                                                                              |
 | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
 | [海龟汤主持人](https://lobechat.com/discover/assistant/lateral-thinking-puzzle)<br/><sup>By **[CSY2022](https://github.com/CSY2022)** on **2025-06-19**</sup>    | 一个海龟汤主持人，需要自己提供汤面，汤底与关键点（猜中的判定条件）。<br/>`海龟汤` `推理` `互动` `谜题` `角色扮演` |
-| [美食评论员🍟](https://lobechat.com/discover/assistant/food-reviewer)<br/><sup>By **[renhai-lab](https://github.com/renhai-lab)** on **2025-06-17**</sup>        | 美食评价专家<br/>`美食` `评价` `写作`                                                                             |
 | [学术写作助手](https://lobechat.com/discover/assistant/academic-writing-assistant)<br/><sup>By **[swarfte](https://github.com/swarfte)** on **2025-06-17**</sup> | 专业的学术研究论文写作和正式文档编写专家<br/>`学术写作` `研究` `正式风格`                                         |
+| [美食评论员🍟](https://lobechat.com/discover/assistant/food-reviewer)<br/><sup>By **[renhai-lab](https://github.com/renhai-lab)** on **2025-06-17**</sup>        | 美食评价专家<br/>`美食` `评价` `写作`                                                                             |
 | [Minecraft 资深开发者](https://lobechat.com/discover/assistant/java-development)<br/><sup>By **[iamyuuk](https://github.com/iamyuuk)** on **2025-06-17**</sup>   | 擅长高级 Java 开发及 Minecraft 开发<br/>`开发` `编程` `minecraft` `java`                                          |
 
 > 📊 Total agents: [<kbd>**505**</kbd> ](https://lobechat.com/discover/assistants)

package/changelog/v1.json

@@ -1,4 +1,22 @@
 [
+  {
+    "children": {
+      "fixes": [
+        "Fix CVE errors."
+      ]
+    },
+    "date": "2025-12-12",
+    "version": "2.0.0-next.169"
+  },
+  {
+    "children": {
+      "fixes": [
+        "Slove market oidc error."
+      ]
+    },
+    "date": "2025-12-12",
+    "version": "2.0.0-next.168"
+  },
   {
     "children": {
       "features": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/lobehub",
-  "version": "2.0.0-next.167",
+  "version": "2.0.0-next.169",
   "description": "LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",
@@ -243,7 +243,7 @@
     "mdast-util-to-markdown": "^2.1.2",
     "model-bank": "workspace:*",
     "nanoid": "^5.1.6",
-    "next": "^16.0.8",
+    "next": "^16.0.10",
     "next-auth": "5.0.0-beta.30",
     "next-mdx-remote": "^5.0.0",
     "nextjs-toploader": "^3.9.17",
@@ -271,10 +271,10 @@
     "query-string": "^9.3.1",
     "random-words": "^2.0.1",
     "rc-util": "^5.44.4",
-    "react": "^19.2.1",
+    "react": "^19.2.3",
     "react-confetti": "^6.4.0",
     "react-diff-view": "^3.3.2",
-    "react-dom": "^19.2.1",
+    "react-dom": "^19.2.3",
     "react-fast-marquee": "^1.6.5",
     "react-hotkeys-hook": "^5.2.1",
     "react-i18next": "^15.7.4",

package/packages/file-loaders/src/loaders/text/index.ts

@@ -6,7 +6,7 @@ import type { DocumentPage, FileLoaderInterface } from '../../types';
 const log = debug('file-loaders:text');
 
 /**
- * 用于加载纯文本文件的加载器。
+ * Loader for loading plain text files.
  */
 export class TextLoader implements FileLoaderInterface {
   async loadPages(filePath: string): Promise<DocumentPage[]> {
@@ -35,7 +35,7 @@ export class TextLoader implements FileLoaderInterface {
       const error = e as Error;
       log('Error encountered while loading text file');
       console.error(`Error loading text file ${filePath}: ${error.message}`);
-      // 如果读取失败，返回一个包含错误信息的 Page
+      // If reading fails, return a Page containing error information
       const errorPage: DocumentPage = {
         charCount: 0,
         lineCount: 0,
@@ -50,14 +50,14 @@ export class TextLoader implements FileLoaderInterface {
   }
 
   /**
-   * 对于纯文本，简单地连接所有页面的内容。
-   * （虽然 TextLoader 通常只有一个页面，但保持接口一致性）
-   * @param pages 页面数组
-   * @returns 聚合后的内容
+   * For plain text, simply concatenate the content of all pages.
+   * (Although TextLoader typically has only one page, this maintains interface consistency)
+   * @param pages Array of pages
+   * @returns Aggregated content
    */
   async aggregateContent(pages: DocumentPage[]): Promise<string> {
     log('Aggregating content from', pages.length, 'text pages');
-    // 默认使用换行符连接，可以根据需要调整或使其可配置
+    // By default, join with newline separator, can be adjusted or made configurable as needed
     const result = pages.map((page) => page.pageContent).join('\n');
     log('Content aggregated successfully, length:', result.length);
     return result;

package/packages/file-loaders/src/types.ts

@@ -2,199 +2,199 @@
 export type SupportedFileType = 'pdf' | 'doc' | 'docx' | 'txt' | 'excel' | 'pptx'; // | 'pptx' | 'latex' | 'epub' | 'code' | 'markdown';
 
 /**
- * 代表一个完整的已加载文件，包含文件级信息和其所有页面/块。
+ * Represents a complete loaded file, including file-level information and all its pages/chunks.
  */
 export interface FileDocument {
   /**
-   * 文件内容
+   * File content
    */
   content: string;
 
   /**
-   * 文件创建时间戳。
+   * File creation timestamp.
    */
   createdTime: Date;
 
   /**
-   * 文件类型或扩展名。
+   * File type or extension.
    */
   fileType: string;
 
   /**
-   * 原始文件名。
+   * Original filename.
    */
   filename: string;
 
   /**
-   * 文件级别的元数据。
-   * 例如从文件属性中提取的标题、作者，或整个文件加载失败时的错误。
+   * File-level metadata.
+   * For example, title and author extracted from file properties, or errors when the entire file loading fails.
    */
   metadata: {
     /**
-     * 允许添加其他文件级别的元数据。
+     * Allows adding other file-level metadata.
      */
     [key: string]: any;
     /**
-     * 文档作者 (如果可用)。
+     * Document author (if available).
      */
     author?: string;
     /**
-     * 如果整个文件加载失败，记录错误信息。
+     * If the entire file loading fails, record error information.
      */
     error?: string;
     /**
-     * 文档标题 (如果可用)。
+     * Document title (if available).
      */
     title?: string;
   };
 
   /**
-   * 文件最后修改时间戳。
+   * File last modified timestamp.
    */
   modifiedTime: Date;
 
   /**
-   * 包含文档中所有逻辑页面/块的数组。
-   * 顺序通常对应文件中的自然顺序。
+   * Array containing all logical pages/chunks in the document.
+   * The order typically corresponds to the natural order in the file.
    */
   pages?: DocumentPage[];
 
   /**
-   * 原始文件的完整路径。
+   * Full path of the original file.
    */
   source: string;
 
   /**
-   * 整个文档的总字符数 (所有 Page 的 charCount 之和)。
-   * 需要在所有 Page 加载和计算后得出。
+   * Total character count of the entire document (sum of all Page charCounts).
+   * Needs to be calculated after all Pages are loaded and computed.
    */
   totalCharCount: number;
 
   /**
-   * 整个文档的总行数 (所有 Page 的 lineCount 之和)。
-   * 需要在所有 Page 加载和计算后得出。
+   * Total line count of the entire document (sum of all Page lineCounts).
+   * Needs to be calculated after all Pages are loaded and computed.
    */
   totalLineCount: number;
 }
 
 /**
- * 代表文件中的一个逻辑单元/页面/块。
+ * Represents a logical unit/page/chunk in a file.
  */
 export interface DocumentPage {
   /**
-   * 此页/块内容的字符数。
+   * Character count of this page/chunk content.
    */
   charCount: number;
 
   /**
-   * 此页/块内容的行数。
+   * Line count of this page/chunk content.
    */
   lineCount: number;
 
   /**
-   * 与此页/块相关的元数据。
+   * Metadata related to this page/chunk.
    */
   metadata: {
     /**
-     * 允许添加其他特定于页/块的元数据。
+     * Allows adding other page/chunk-specific metadata.
      */
     [key: string]: any;
 
     /**
-     * 如果原始文件单元被进一步分割成块，这是当前块的索引。
+     * If the original file unit is further divided into chunks, this is the index of the current chunk.
      */
     chunkIndex?: number;
 
     /**
-     * 处理此页/块时发生的错误。
+     * Error that occurred when processing this page/chunk.
      */
     error?: string;
 
     /**
-     * 此页/块在原始文件中的结束行号。
+     * Ending line number of this page/chunk in the original file.
      */
     lineNumberEnd?: number;
 
     /**
-     * 此页/块在原始文件中的起始行号。
+     * Starting line number of this page/chunk in the original file.
      */
     lineNumberStart?: number;
 
     /**
-     * 页码 (适用于 PDF, DOCX)。
+     * Page number (applicable for PDF, DOCX).
      */
     pageNumber?: number;
 
     /**
-     * 与此页/块相关的章节标题。
+     * Section title related to this page/chunk.
      */
     sectionTitle?: string;
 
     /**
-     * 工作表名称 (适用于 XLSX)。
+     * Sheet name (applicable for XLSX).
      */
     sheetName?: string;
 
     /**
-     * 幻灯片编号 (适用于 PPTX)。
+     * Slide number (applicable for PPTX).
      */
     slideNumber?: number;
 
     /**
-     * 如果原始文件单元被进一步分割成块，这是该单元的总块数。
+     * If the original file unit is further divided into chunks, this is the total number of chunks for that unit.
      */
     totalChunks?: number;
   };
 
   /**
-   * 此页/块的核心文本内容。
+   * Core text content of this page/chunk.
    */
   pageContent: string;
 }
 
 /**
- * 可选的文件元数据，用于覆盖从文件系统读取的信息。
+ * Optional file metadata used to override information read from the filesystem.
  */
 export interface FileMetadata {
   /**
-   * 文件创建时间戳。
+   * File creation timestamp.
    */
   createdTime?: Date;
   /**
-   * 文件类型或扩展名。
+   * File type or extension.
    */
   fileType?: string;
   /**
-   * 文件名。
+   * Filename.
    */
   filename?: string;
   /**
-   * 文件最后修改时间戳。
+   * File last modified timestamp.
    */
   modifiedTime?: Date;
   /**
-   * 文件来源标识 (例如 S3 URL 或原始路径)。
+   * File source identifier (e.g., S3 URL or original path).
    */
   source?: string;
 }
 
 /**
- * 定义所有文件加载器类必须实现的接口。
+ * Defines the interface that all file loader classes must implement.
  */
 export interface FileLoaderInterface {
   /**
-   * 将从 loadPages 获取的页面内容聚合成单一的字符串。
-   * @param pages DocumentPage 对象的数组。
-   * @returns 返回聚合后的文本内容的 Promise。
+   * Aggregates the page content obtained from loadPages into a single string.
+   * @param pages Array of DocumentPage objects.
+   * @returns Promise that returns the aggregated text content.
    */
   aggregateContent(pages: DocumentPage[]): Promise<string>;
 
   attachDocumentMetadata?(filePath: string): Promise<Record<string, any>>;
 
   /**
-   * 根据文件路径加载文件内容，并将其分割为逻辑页面/块。
-   * @param filePath 文件的完整路径。
-   * @returns 返回包含 DocumentPage 对象的数组的 Promise。
+   * Loads file content based on the file path and splits it into logical pages/chunks.
+   * @param filePath Full path of the file.
+   * @returns Promise that returns an array containing DocumentPage objects.
    */
   loadPages(filePath: string): Promise<DocumentPage[]>;
 }

package/src/libs/oidc-provider/provider.ts

@@ -1,11 +1,9 @@
-import type { EmailAddress } from '@clerk/backend';
 import { LobeChatDatabase } from '@lobechat/database';
 import debug from 'debug';
 import Provider, { Configuration, KoaContextWithOIDC, errors } from 'oidc-provider';
 import urlJoin from 'url-join';
 
 import { serverDBEnv } from '@/config/db';
-import { enableClerk } from '@/const/auth';
 import { UserModel } from '@/database/models/user';
 import { appEnv } from '@/envs/app';
 import { getJWKS } from '@/libs/oidc-provider/jwt';
@@ -15,59 +13,9 @@ import { DrizzleAdapter } from './adapter';
 import { defaultClaims, defaultClients, defaultScopes } from './config';
 import { createInteractionPolicy } from './interaction-policy';
 
-const logProvider = debug('lobe-oidc:provider'); // <--- 添加 provider 日志实例
+const logProvider = debug('lobe-oidc:provider');
 
-const MARKET_CLIENT_ID = 'lobehub-market';
-
-const resolveClerkAccount = async (accountId: string) => {
-  if (!enableClerk) return undefined;
-
-  try {
-    const { clerkClient } = await import('@clerk/nextjs/server');
-    const client = await clerkClient();
-    const user = await client.users.getUser(accountId);
-
-    if (!user) {
-      logProvider('Clerk user not found for accountId: %s', accountId);
-      return undefined;
-    }
-
-    const pickName = () =>
-      user.fullName ||
-      [user.firstName, user.lastName].filter(Boolean).join(' ').trim() ||
-      user.username ||
-      user.id;
-
-    const primaryEmail = user.primaryEmailAddressId
-      ? user.emailAddresses.find((item: EmailAddress) => item.id === user.primaryEmailAddressId)
-      : user.emailAddresses.at(0);
-
-    return {
-      accountId: user.id,
-      async claims(_use: string, scope: string) {
-        const scopeSet = new Set((scope || '').split(/\s+/).filter(Boolean));
-        const claims: { [key: string]: any; sub: string } = { sub: user.id };
-
-        if (scopeSet.has('profile')) {
-          claims.name = pickName();
-          if (user.imageUrl) claims.picture = user.imageUrl;
-        }
-
-        if (scopeSet.has('email') && primaryEmail) {
-          claims.email = primaryEmail.emailAddress;
-          claims.email_verified = primaryEmail.verification?.status === 'verified' || false;
-        }
-
-        return claims;
-      },
-    };
-  } catch (error) {
-    logProvider('Error resolving Clerk account for %s: %O', accountId, error);
-    return undefined;
-  }
-};
-
-export const API_AUDIENCE = 'urn:lobehub:chat'; // <-- 把这里换成你自己的 API 标识符
+export const API_AUDIENCE = 'urn:lobehub:chat';
 
 /**
  * 获取 Cookie 密钥，使用 KEY_VAULTS_SECRET
@@ -190,25 +138,6 @@ export const createOIDCProvider = async (db: LobeChatDatabase): Promise<Provider
 
       logProvider('OIDC request client id: %s', clientId);
 
-      if (clientId === MARKET_CLIENT_ID) {
-        logProvider('Using Clerk account resolution for marketplace client');
-
-        if (!accountIdToFind) {
-          logProvider('No account id available for Clerk resolution, returning undefined');
-          return undefined;
-        }
-
-        const clerkAccount = await resolveClerkAccount(accountIdToFind);
-
-        if (clerkAccount) {
-          logProvider('Clerk account resolved successfully for %s', accountIdToFind);
-          return clerkAccount;
-        }
-
-        logProvider('Clerk account resolution failed for %s', accountIdToFind);
-        return undefined;
-      }
-
       logProvider(
         'Attempting to find account with ID: %s (source: %s)',
         accountIdToFind,