Commit 0d96729e authored by Gutyina Gergő's avatar Gutyina Gergő Committed by Niklas Korz
Browse files

librechat: 0.8.0 -> 0.8.4 

Fixes CVE-2026-31949

Changelogs:

- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.4
- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.3
- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2
- https://github.com/danny-avila/LibreChat/releases/tag/v0.8.1
parent 95b9dc0e

pkgs/by-name/li/librechat/0001-npm-pack.patch

+2 −4
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ diff --git a/package.json b/package.json 
index 2131951..91e4846 100644

--- a/package.json

+++ b/package.json

@@ -114,5 +114,15 @@

@@ -114,5 +114,13 @@

       "admin/",

       "packages/"

     ]
@@ -10,9 +10,7 @@ index 2131951..91e4846 100644 
+  "files": [

+    "api",

+    "client/dist",

+    "packages/data-provider",

+    "packages/data-schemas",

+    "packages/mcp"

+    "packages"

+  ],

+  "bin": {

+    "librechat-server": "api/server/index.js"

pkgs/by-name/li/librechat/0002-logs.patch

+16 −16
Original line number Diff line number Diff line 
diff --git a/api/config/meiliLogger.js b/api/config/meiliLogger.js

index 195b387..d445e54 100644

index 398672da5..fcd6864f8 100644

--- a/api/config/meiliLogger.js

+++ b/api/config/meiliLogger.js

@@ -2,7 +2,7 @@ const path = require('path');

 const winston = require('winston');

 require('winston-daily-rotate-file');

@@ -26,7 +26,7 @@ const getLogDir = () => {

   }

 

-const logDir = path.join(__dirname, '..', 'logs');

+const logDir = path.join('.', 'logs');

 

 const { NODE_ENV } = process.env;

   // Local development: use api/logs relative to this file

-  return path.join(__dirname, '..', 'logs');

+  return path.join('.', 'logs');

 };

 

 const logDir = getLogDir();

diff --git a/api/config/winston.js b/api/config/winston.js

index 8f51b99..2ebd041 100644

index 93b84f7c4..4276bd6c2 100644

--- a/api/config/winston.js

+++ b/api/config/winston.js

@@ -3,7 +3,7 @@ const winston = require('winston');

 require('winston-daily-rotate-file');

 const { redactFormat, redactMessage, debugTraverse, jsonTruncateFormat } = require('./parsers');

 

-const logDir = path.join(__dirname, '..', 'logs');

+const logDir = path.join('.', 'logs');

@@ -27,7 +27,7 @@ const getLogDir = () => {

   }

 

 const { NODE_ENV, DEBUG_LOGGING = true, DEBUG_CONSOLE = false, CONSOLE_JSON = false } = process.env;

   // Local development: use api/logs relative to this file

-  return path.join(__dirname, '..', 'logs');

+  return path.join('.', 'logs');

 };

 

 const logDir = getLogDir();
 
 No newline at end of file

pkgs/by-name/li/librechat/package.nix

+8 −3
Original line number Diff line number Diff line
@@ -12,13 +12,13 @@ 


buildNpmPackage (finalAttrs: {

  pname = "librechat";

  version = "0.8.0";

  version = "0.8.4";



  src = fetchFromGitHub {

    owner = "danny-avila";

    repo = "LibreChat";

    tag = "v${finalAttrs.version}";

    hash = "sha256-DTmb9J2nsMy6f+V6BgRtFgpTwOi9OQnvikSx4QZQ0HI=";

    hash = "sha256-XiPnTKiSOMezUZuhkaGJ0xHiT7jrz8OYbZrvq5gb/V8=";

  };



  patches = [
@@ -40,7 +40,7 @@ buildNpmPackage (finalAttrs: { 
  ];



  npmDepsFetcherVersion = 2;

  npmDepsHash = "sha256-JXXOJDkh+do8ZOf4KHyiH7igMeC8WkwflMNx1rZRY3g=";

  npmDepsHash = "sha256-h15rNYl2QYnh7/cJvA7lrRqmXw8Ri2QKTfTr7w7+mMo=";



  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535

  nodejs = nodejs_22;
@@ -57,6 +57,11 @@ buildNpmPackage (finalAttrs: { 
  npmBuildScript = "frontend";

  npmPruneFlags = [ "--production" ];



  # npmConfigHook only patches the root node_modules

  postConfigure = ''

    patchShebangs client/node_modules

  '';



  # For reasons beyond my understanding, the api and client directory disappears after the build finishes.

  # Hence, the build fails with broken symlinks and if the symlink is removed,

  # starting LibreChat fails with a "module not found" error.