Skip to content

fix: return fileId in the summary listing; upgrade locked dependencies with advisories - #78

Merged
aron-muon merged 2 commits into
mainfrom
fix/summary-fileid
Oct 16, 2026
Merged

aron-muon merged 2 commits into
mainfrom
fix/summary-fileid

Conversation

@aron-muon

Copy link
Copy Markdown
Owner

LibreChat >= 0.8.8 checks whether a sandbox file is still alive by matching fileId in GET /files/{session_id}?detail=summary (checkSessionsAlive, checkCodeEnvFileAlive). Summary entries only had name and lastModified, so every probed file read as expired. LibreChat then re-provisioned the conversation's files on every turn, and a re-upload that collided with an existing name came back as a new suffixed copy (chart-1a2b3c.png, then chart-1a2b3c-4d5e6f.png) that the conversation carried forward.

  • Summary listing: entries now also carry fileId, the same id /upload returns. name and lastModified are unchanged. Unit and LibreChat-compat tests assert the field.
  • Locked dependencies: upgrades that carry security advisories: aiohttp 3.14.3, anyio 4.14.2, cryptography 50.0.1, fastapi 0.142.1 with starlette 1.7.0, pyasn1 0.6.4, pyjwt 2.15.1, python-multipart 0.0.32, plus their transitive updates. Lock-only: pyproject.toml is unchanged and uv lock --check passes.

Unit suite (1628) and LibreChat-compat tests pass. Verified against LibreChat 0.8.8-rc4: with the change, its own checkSessionsAlive reports a live file as alive, and still reports a deleted one as expired.

🤖 Generated with Claude Code

aron-muon and others added 2 commits October 15, 2026 22:06
LibreChat >= 0.8.8 (checkSessionsAlive, checkCodeEnvFileAlive) decides
whether a sandbox file is still alive by matching `fileId` in
GET /files/{session_id}?detail=summary. The listing only carried
`name` and `lastModified`, so every probed file read as expired:
LibreChat re-provisioned it on every turn, and each re-upload that
collided with an existing name came back under a new suffixed copy
that the conversation then carried forward.

Co-Authored-By: Claude <noreply@anthropic.com>
Lock-only: pyproject.toml ranges are unchanged and uv lock --check
passes. aiohttp 3.14.3, anyio 4.14.2, cryptography 50.0.1, fastapi
0.142.1 with starlette 1.7.0, pyasn1 0.6.4, pyjwt 2.15.1,
python-multipart 0.0.32, plus the transitive updates they pull in
(click, msgpack, python-engineio, python-socketio, urllib3,
opentelemetry-api).

Co-Authored-By: Claude <noreply@anthropic.com>
@aron-muon
aron-muon merged commit 216a3f6 into main Oct 16, 2026
32 checks passed
@aron-muon
aron-muon deleted the fix/summary-fileid branch October 16, 2026 08:32
@github-actions

Copy link
Copy Markdown

🎉 This PR is included in version 3.7.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant