mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Mark
36f2972150
GHSA-72qq-p3r5-f7wq (CVSS 9.3). web_core <= 0.10.1 passed an agent-supplied `openUrl` argument straight to `window.open()` with no scheme allowlist, so a Button whose `functionCall` named a `javascript:` URI executed arbitrary script in the host origin when a user clicked it. The Basic Catalog is the default, so no non-default configuration was required to be exposed. We pinned 0.9.0 exactly, as a runtime dependency of two published packages (@copilotkit/a2ui-renderer, @copilotkit/vue) and transitively of @copilotkit/react-core and @copilotkit/angular, so downstream users could not upgrade out of it on their own. 0.10.4 keeps the ./v0_9 and ./v0_9/basic_catalog entrypoints we import; the only symbol dropped from v0_9 is FrameworkSignal, which we never referenced. Add regression tests over both renderers that reach the sink independently (React and Lit). They assert that javascript: and data: URIs never reach window.open, that https URLs still open with noopener,noreferrer, and that a blocked scheme leaves the surface mounted rather than escaping into the click handler. Verified they fail against 0.9.0 and pass against 0.10.4.
63 lines
1.8 KiB
JSON
63 lines
1.8 KiB
JSON
{
|
|
"name": "@copilotkit/angular-demo",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"start": "ng serve",
|
|
"build": "ng build",
|
|
"dev": "pnpm -s run serve:clean",
|
|
"serve:clean": "rimraf .angular || true && ng serve",
|
|
"clean": "rimraf dist .angular"
|
|
},
|
|
"dependencies": {
|
|
"@ag-ui/client": "0.0.53",
|
|
"@ag-ui/core": "0.0.53",
|
|
"@ag-ui/encoder": "0.0.53",
|
|
"@ag-ui/proto": "0.0.53",
|
|
"@a2ui/web_core": "0.10.4",
|
|
"@angular/animations": "^21.2.15",
|
|
"@angular/cdk": "^21.2.13",
|
|
"@angular/common": "^21.2.15",
|
|
"@angular/compiler": "^21.2.15",
|
|
"@angular/core": "^21.2.15",
|
|
"@angular/forms": "^21.2.15",
|
|
"@angular/platform-browser": "^21.2.15",
|
|
"@angular/platform-browser-dynamic": "^21.2.15",
|
|
"@angular/router": "^21.2.15",
|
|
"@copilotkit/a2ui-renderer": "workspace:*",
|
|
"@copilotkit/core": "workspace:*",
|
|
"@copilotkit/shared": "workspace:*",
|
|
"@copilotkit/web-inspector": "workspace:*",
|
|
"@copilotkit/angular": "workspace:*",
|
|
"@jetbrains/websandbox": "^1.1.3",
|
|
"@tanstack/pacer": "^0.20.1",
|
|
"clsx": "^2.1.1",
|
|
"compare-versions": "^6.1.1",
|
|
"fast-json-patch": "^3.1.1",
|
|
"highlight.js": "^11.11.1",
|
|
"katex": "^0.16.22",
|
|
"lit": "^3.3.1",
|
|
"lucide": "^0.525.0",
|
|
"lucide-angular": "^0.540.0",
|
|
"marked": "^16.2.0",
|
|
"partial-json": "^0.1.7",
|
|
"phoenix": "^1.8.4",
|
|
"rxjs": "^7.8.1",
|
|
"tailwind-merge": "^2.6.0",
|
|
"tslib": "^2.8.1",
|
|
"untruncate-json": "^0.0.1",
|
|
"uuid": "^11.1.0",
|
|
"zod": "^3.25.75",
|
|
"zod-to-json-schema": "^3.24.6"
|
|
},
|
|
"devDependencies": {
|
|
"@angular/build": "^21.2.13",
|
|
"@angular/cli": "^21.2.13",
|
|
"@angular/compiler-cli": "^21.2.15",
|
|
"nodemon": "^3.1.7",
|
|
"rimraf": "^6.0.1",
|
|
"typescript": "5.9.3"
|
|
}
|
|
}
|