Merge branch 'dev' into fix_youtube_transcript

.github/workflows/platform-autgpt-deploy-prod.yml

@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger deploy workflow
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.DEPLOY_TOKEN }}
           repository: Significant-Gravitas/AutoGPT_cloud_infrastructure

.github/workflows/platform-autogpt-deploy-dev.yaml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger deploy workflow
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.DEPLOY_TOKEN }}
           repository: Significant-Gravitas/AutoGPT_cloud_infrastructure

SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Reporting Security Issues
+
+We take the security of our project seriously. If you believe you have found a security vulnerability, please report it to us privately. **Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+> **Important Note**: Any code within the `classic/` folder is considered legacy, unsupported, and out of scope for security reports. We will not address security vulnerabilities in this deprecated code.
+
+Instead, please report them via:
+- [GitHub Security Advisory](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/new)
+- [Huntr.dev](https://huntr.com/repos/significant-gravitas/autogpt) - where you may be eligible for a bounty
+
+### Reporting Process
+1. **Submit Report**: Use one of the above channels to submit your report
+2. **Response Time**: Our team will acknowledge receipt of your report within 14 business days.
+3. **Collaboration**: We will collaborate with you to understand and validate the issue
+4. **Resolution**: We will work on a fix and coordinate the release process
+
+### Disclosure Policy
+- Please provide detailed reports with reproducible steps
+- Include the version/commit hash where you discovered the vulnerability
+- Allow us a 90-day security fix window before any public disclosure
+- Share any potential mitigations or workarounds if known
+
+## Supported Versions
+Only the following versions are eligible for security updates:
+
+| Version | Supported |
+|---------|-----------|
+| Latest release on master branch | ✅ |
+| Development commits (pre-master) | ✅ |
+| Classic folder (deprecated) | ❌ |
+| All other versions | ❌ |
+
+## Security Best Practices
+When using this project:
+1. Always use the latest stable version
+2. Review security advisories before updating
+3. Follow our security documentation and guidelines
+4. Keep your dependencies up to date
+5. Do not use code from the `classic/` folder as it is deprecated and unsupported
+
+## Past Security Advisories
+For a list of past security advisories, please visit our [Security Advisory Page](https://github.com/Significant-Gravitas/AutoGPT/security/advisories) and [Huntr Disclosures Page](https://huntr.com/repos/significant-gravitas/autogpt).
+
+---
+Last updated: November 2024

autogpt_platform/autogpt_libs/autogpt_libs/supabase_integration_credentials_store/store.py

@@ -46,21 +46,21 @@
 )
 openai_credentials = APIKeyCredentials(
     id="53c25cb8-e3ee-465c-a4d1-e75a4c899c2a",
-    provider="llm",
+    provider="openai",
     api_key=SecretStr(settings.secrets.openai_api_key),
     title="Use Credits for OpenAI",
     expires_at=None,
 )
 anthropic_credentials = APIKeyCredentials(
     id="24e5d942-d9e3-4798-8151-90143ee55629",
-    provider="llm",
+    provider="anthropic",
     api_key=SecretStr(settings.secrets.anthropic_api_key),
     title="Use Credits for Anthropic",
     expires_at=None,
 )
 groq_credentials = APIKeyCredentials(
     id="4ec22295-8f97-4dd1-b42b-2c6957a02545",
-    provider="llm",
+    provider="groq",
     api_key=SecretStr(settings.secrets.groq_api_key),
     title="Use Credits for Groq",
     expires_at=None,
@@ -79,6 +79,13 @@
     title="Use Credits for Jina",
     expires_at=None,
 )
+unreal_credentials = APIKeyCredentials(#
+    id="66f20754-1b81-48e4-91d0-f4f0dd82145f",
+    provider="unreal",
+    api_key=SecretStr(settings.secrets.unreal_speech_api_key),
+    title="Use Credits for Unreal",
+    expires_at=None,
+)
 
 
 DEFAULT_CREDENTIALS = [
@@ -90,6 +97,7 @@
     groq_credentials,
     did_credentials,
     jina_credentials,
+    unreal_credentials,
 ]
 
 
@@ -135,6 +143,8 @@ def get_all_creds(self, user_id: str) -> list[Credentials]:
             all_credentials.append(did_credentials)
         if settings.secrets.jina_api_key:
             all_credentials.append(jina_credentials)
+        if settings.secrets.unreal_speech_api_key:
+            all_credentials.append(unreal_credentials)
         return all_credentials
 
     def get_creds_by_id(self, user_id: str, credentials_id: str) -> Credentials | None:

autogpt_platform/autogpt_libs/pyproject.toml

@@ -15,11 +15,11 @@ pydantic-settings = "^2.6.1"
 pyjwt = "^2.8.0"
 python = ">=3.10,<4.0"
 python-dotenv = "^1.0.1"
-supabase = "^2.9.1"
+supabase = "^2.10.0"
 
 [tool.poetry.group.dev.dependencies]
 redis = "^5.2.0"
-ruff = "^0.7.2"
+ruff = "^0.7.3"
 
 [build-system]
 requires = ["poetry-core"]

autogpt_platform/backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim-buster AS builder
+FROM python:3.11.10-slim-bookworm AS builder
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE 1
@@ -35,7 +35,7 @@ COPY autogpt_platform/backend/schema.prisma ./
 RUN poetry config virtualenvs.create false \
     && poetry run prisma generate
 
-FROM python:3.11-slim-buster AS server_dependencies
+FROM python:3.11.10-slim-bookworm AS server_dependencies
 
 WORKDIR /app