🔒 Every critical and high advisory closed — and a 1.5 GB lighter image

Released 2026-09-10

Every critical and high security advisory against ChatterMate is now closed. That took five pull requests across the frontend, the backend and the container image, and along the way it turned up two bugs that had nothing to do with dependencies: a knowledge source that reported the wrong reason when it failed, and a startup hook that had quietly stopped running.

Self-hosters get a container image roughly 1.5 GB smaller.

Highlights

Every critical and high advisory closed

The frontend moved to axios 1.20, socket.io-client 4.8.3, DOMPurify 3.4.15, Vite 6.4.3 and Vitest 3.2.7, plus a refresh of every flagged transitive dependency. npm audit now reports zero vulnerabilities for both the runtime and development trees.

The backend moved to Starlette 1.6, FastAPI 0.137.2, cryptography 50.0.1 and pyOpenSSL 26.4. The Starlette upgrade is the one that mattered most: before 1.3.1, the field-count and field-size caps on form bodies were silently ignored for urlencoded posts, which is exactly what the SMS and email webhooks receive. An oversized body is now refused.

The widget test harness moved to Express 5, because Express 4 pins qs to a version with an array-limit bypass and will not accept the patched release. It is a small static server used for local widget testing, and nothing about it changed but the dependency.

Two things could not be fixed by upgrading. The agno eval-injection advisory has no fix outside agno 2.x, which is a migration of its own, so the two modules that call eval on a model-supplied type name now get a replacement that maps a builtin type name to the type and refuses everything else. Nothing can execute through that path any more, and blocked attempts are logged. The other is a SQL injection in agno's ClickHouse backend, which this project never imports.

A container image about 1.5 GB smaller

Nothing in the backend ever imported torch, transformers or sentence-transformers. Embeddings run on fastembed, which is ONNX-based. The three packages were carried purely by a startup step that warmed a model nothing then used.

They are gone, along with their model-cache environment variables and the torch cache volume. Startup no longer downloads a sentence-transformer model it will not consult.

Re-adding a knowledge source no longer fails

Adding a website or PDF that was already indexed failed the whole source with:

No content could be read from . The page may be empty, require JavaScript, or be unreachable

Nothing was wrong with the site. Already-indexed URLs are skipped, and a run that skipped everything was being treated as a crawl that could read nothing — it failed in milliseconds without a single network request, while blaming the page for content that was already in the database. Re-adding now completes and keeps the existing content. A crawl that genuinely reads nothing still fails, and bot protection still reports its own specific message.

Socket.IO configuration was not running at startup

The backend registered its Socket.IO setup, CORS listener and chat auto-closer through a startup hook that had been dead since the app moved to a lifespan handler. It happened to be harmless, because the lifespan handler already called the same function, but Starlette 1.x removes the hook entirely. It is now wired through lifespan only, with the auto-closer task held so it cannot be garbage-collected.

Notes for self-hosters

• The image no longer ships torch, transformers or sentence-transformers. If you extended the image and import any of them, add them back to your own layer.
• TRANSFORMERS_CACHE, SENTENCE_TRANSFORMERS_HOME, TORCH_HOME and PYTORCH_TRANSFORMERS_CACHE are gone from the Dockerfiles and compose files, as is the torch_cache volume. HF_HOME stays; fastembed uses it.
• EMBEDDING_MODEL_ID was removed. It had no effect.
• crawl4ai's floor moved to 0.9, because 0.7.x pulled the ML stack back in.

Security alert status

Every advisory GitHub raised against this repository is now closed: 186 resolved by these upgrades, and four dismissed with a recorded reason. Two are the agno advisories described above. The other two are a development-only path traversal in Vitest's mocker, whose fix requires Vitest 4; that upgrade breaks tests in the enterprise module and is being handled separately.

Testing

The backend suite runs 3022 tests. New coverage was added for the webhook form limits, which fail on the old Starlette and pass on the new one, for the static file mounts including path traversal attempts, for the agno guard driven through agno's own tool-call loop, for the sanitizer's XSS behaviour, and for the API client's 401 refresh-and-retry.