AstrBot 4.29.2__tar.gz → 4.29.3__tar.gz

{astrbot-4.29.2 → astrbot-4.29.3}/Dockerfile

@@ -23,12 +23,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 COPY . /AstrBot/
 
-RUN python -m pip install uv \
+# Bootstrap pip from the hash-verified wheel before downloading other packages.
+RUN python -m pip install --no-cache-dir \
+    "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" \
+    && python -m pip install --upgrade --no-cache-dir "uv>=0.13.4" \
     && echo "3.12" > .python-version \
     && uv lock \
     && uv export --format requirements.txt --output-file requirements.txt --frozen \
     && uv pip install -r requirements.txt --no-cache-dir --system \
     && uv pip install socksio uv pilk --no-cache-dir --system \
+    && uv pip install --upgrade "certifi>=2026.10.19" "pip>=26.2.2" --no-cache-dir --system \
     && uv pip install -e . --no-deps --system \
     && touch /AstrBot/.astrbot
 

{astrbot-4.29.2 → astrbot-4.29.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AstrBot
-Version: 4.29.2
+Version: 4.29.3
 Summary: Easy-to-use multi-platform LLM chatbot and development framework
 Project-URL: Repository, https://github.com/AstrBotDevs/AstrBot
 License: AGPL-3.0-or-later

{astrbot-4.29.2 → astrbot-4.29.3}/astrbot/__init__.py

@@ -1,4 +1,4 @@
 import logging
 
-__version__ = "4.29.2"
+__version__ = "4.29.3"
 logger = logging.getLogger("astrbot")

{astrbot-4.29.2 → astrbot-4.29.3}/astrbot/core/utils/pip_installer.py

@@ -1022,7 +1022,24 @@ class PipInstaller:
         requirements_path: str | None = None,
         mirror: str | None = None,
         allow_target_upgrade: bool = True,
+        bypass_core_constraints: bool = False,
     ) -> None:
+        """Install packages while protecting core dependency versions by default.
+
+        Args:
+            package_name: Package specifications to install.
+            requirements_path: Requirements file to install instead of packages.
+            mirror: Optional package index overriding the configured index.
+            allow_target_upgrade: Whether desktop target packages may be upgraded.
+            bypass_core_constraints: Skip automatically generated core and desktop
+                dependency locks when updating AstrBot itself. Plugin installs
+                should keep the default protection enabled.
+
+        Raises:
+            ValueError: Package input is invalid or both input forms are provided.
+            DependencyConflictError: Pip cannot resolve the requested dependencies.
+            PipInstallError: Pip fails without a classified dependency conflict.
+        """
         args, requested_requirements = self._build_pip_args(
             package_name, requirements_path, mirror
         )
@@ -1050,7 +1067,11 @@ class PipInstaller:
                     ]
                 )
 
-        with self._core_constraints.constraints_file() as constraints_file_path:
+        with (
+            contextlib.nullcontext(None)
+            if bypass_core_constraints
+            else self._core_constraints.constraints_file()
+        ) as constraints_file_path:
             if constraints_file_path:
                 args.extend(["-c", constraints_file_path])
 

astrbot-4.29.3/astrbot/dashboard/dist/assets/version

@@ -0,0 +1 @@
+v4.29.3

{astrbot-4.29.2 → astrbot-4.29.3}/astrbot/dashboard/services/update_service.py

@@ -217,7 +217,10 @@ class UpdateService:
             )
             logger.info("Updating dependencies...")
             try:
-                await self.pip_install(requirements_path="requirements.txt")
+                await self.pip_install(
+                    requirements_path="requirements.txt",
+                    bypass_core_constraints=True,
+                )
             except Exception as exc:
                 logger.error(f"Failed to update dependencies: {exc}")
             self._set_update_stage(

astrbot-4.29.2/changelogs/v4.29.2.md → astrbot-4.29.3/changelogs/v4.29.3.md

@@ -1,4 +1,4 @@
-## [4.29.2] - 2026-10-24
+## [4.29.3] - 2026-10-24
 
 Life is like a box of chocolates.
 
@@ -17,7 +17,6 @@ Life is like a box of chocolates.
 - WebUI：修复配置刷新后模型元数据丢失、默认聊天模型选择、插件侧栏名称本地化、桌面更新通知和配置模板字段默认值。 (#10522, #10663, #10576, #10622, #10517)
 - WebUI：优化配置说明与条件选项显示，修复全屏日志中的 Pip 安装弹窗、日志流连接等待和页面切换后的重复日志，并明确插件筛选范围。 (#10647, #10608, #10666, #10694, #10691)
 - 数据库：使用跨数据库兼容的 JSON 查询表达式。 (#10664)
-- 依赖：升级 certifi 和 pip。 (#10670)
 
 ### Added
 
@@ -34,6 +33,5 @@ Life is like a box of chocolates.
 - WebUI: Preserve fetched model metadata after configuration refresh; restore default chat model selection; localize plugin sidebar names; fix desktop update notices and template field defaults. (#10522, #10663, #10576, #10622, #10517)
 - WebUI: Clarify configuration hints and conditional settings; keep the Pip dialog visible in fullscreen logs; flush log stream headers promptly; prevent duplicate logs after navigation; clarify plugin filter scope. (#10647, #10608, #10666, #10694, #10691)
 - Database: Use portable JSON query expressions. (#10664)
-- Dependencies: Update certifi and pip. (#10670)
 
-**Full Changelog**: https://github.com/AstrBotDevs/AstrBot/compare/v4.29.1...v4.29.2
+**Full Changelog**: https://github.com/AstrBotDevs/AstrBot/compare/v4.29.1...v4.29.3

{astrbot-4.29.2 → astrbot-4.29.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "AstrBot"
-version = "4.29.2"
+version = "4.29.3"
 description = "Easy-to-use multi-platform LLM chatbot and development framework"
 readme = "README.md"
 license = { text = "AGPL-3.0-or-later" }

{astrbot-4.29.2 → astrbot-4.29.3}/requirements.txt

@@ -4,7 +4,7 @@ aiohttp>=3.11.18
 aiosqlite>=0.21.0
 anthropic>=0.51.0
 apscheduler>=3.11.0
-certifi>=2026.10.19
+certifi>=2025.4.26
 chardet~=5.1.0
 loguru>=0.7.2
 cryptography>=44.0.3
@@ -26,7 +26,7 @@ ormsgpack>=1.9.1
 openpyxl>=3.1.5
 pandas>=2.2.0
 pillow>=11.2.1
-pip>=26.2.2
+pip>=25.1.1
 psutil>=5.8.0,<7.2.0
 py-cord>=2.6.1
 pydantic>=2.12.5

astrbot-4.29.2/astrbot/dashboard/dist/assets/version

@@ -1 +0,0 @@
-v4.29.2