Merge branch 'dev' into toran/open-2839-aiimagecustomizerblock-sends-raw-file-paths-instead-of-valid

.github/workflows/claude-dependabot.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "21"
+          node-version: "22"
 
       - name: Enable corepack
         run: corepack enable

.github/workflows/claude.yml

@@ -90,7 +90,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "21"
+          node-version: "22"
 
       - name: Enable corepack
         run: corepack enable

.github/workflows/copilot-setup-steps.yml

@@ -78,7 +78,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "21"
+          node-version: "22"
 
       - name: Enable corepack
         run: corepack enable
@@ -299,4 +299,4 @@ jobs:
           echo "✅ AutoGPT Platform development environment setup complete!"
           echo "🚀 Ready for development with Docker services running"
           echo "📝 Backend server: poetry run serve (port 8000)"
-          echo "🌐 Frontend server: pnpm dev (port 3000)"
+          echo "🌐 Frontend server: pnpm dev (port 3000)"

autogpt_platform/frontend/next.config.mjs

@@ -34,7 +34,8 @@ const nextConfig = {
       },
     ],
   },
-  output: "standalone",
+  // Vercel has its own deployment mechanism and doesn't need standalone mode
+  ...(process.env.VERCEL ? {} : { output: "standalone" }),
   transpilePackages: ["geist"],
 };
 

autogpt_platform/frontend/package.json

@@ -54,7 +54,7 @@
     "@rjsf/core": "5.24.13",
     "@rjsf/utils": "5.24.13",
     "@rjsf/validator-ajv8": "5.24.13",
-    "@sentry/nextjs": "10.22.0",
+    "@sentry/nextjs": "10.27.0",
     "@supabase/ssr": "0.7.0",
     "@supabase/supabase-js": "2.78.0",
     "@tanstack/react-query": "5.90.6",

autogpt_platform/frontend/src/lib/utils.ts

@@ -2,12 +2,12 @@ import { type ClassValue, clsx } from "clsx";
 import { isEmpty as _isEmpty } from "lodash";
 import { twMerge } from "tailwind-merge";
 
+import { NodeDimension } from "@/app/(platform)/build/components/legacy-builder/Flow/Flow";
 import {
   BlockIOObjectSubSchema,
   BlockIORootSchema,
   Category,
 } from "@/lib/autogpt-server-api/types";
-import { NodeDimension } from "@/app/(platform)/build/components/legacy-builder/Flow/Flow";
 
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
@@ -153,24 +153,29 @@ export function setNestedProperty(obj: any, path: string, value: any) {
     throw new Error("Path must be a non-empty string");
   }
 
-  const keys = path.split(/[\/.]/);
+  // Split by both / and . to handle mixed separators, then filter empty strings
+  const keys = path.split(/[\/.]/).filter((key) => key.length > 0);
 
+  if (keys.length === 0) {
+    throw new Error("Path must be a non-empty string");
+  }
+
+  // Validate keys for prototype pollution protection
   for (const key of keys) {
-    if (
-      !key ||
-      key === "__proto__" ||
-      key === "constructor" ||
-      key === "prototype"
-    ) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
       throw new Error(`Invalid property name: ${key}`);
     }
   }
 
+  // Securely traverse and set nested properties
+  // Use Object.prototype.hasOwnProperty.call() to safely check properties
   let current = obj;
 
   for (let i = 0; i < keys.length - 1; i++) {
     const key = keys[i];
-    if (!current.hasOwnProperty(key)) {
+
+    // Use hasOwnProperty check to avoid prototype chain access
+    if (!Object.prototype.hasOwnProperty.call(current, key)) {
       current[key] = {};
     } else if (typeof current[key] !== "object" || current[key] === null) {
       current[key] = {};
@@ -178,7 +183,10 @@ export function setNestedProperty(obj: any, path: string, value: any) {
     current = current[key];
   }
 
-  current[keys[keys.length - 1]] = value;
+  // Set the final value using bracket notation with validated key
+  // Since we've validated all keys, this is safe from prototype pollution
+  const finalKey = keys[keys.length - 1];
+  current[finalKey] = value;
 }
 
 export function pruneEmptyValues(