pengjunjie/langflow
1
0
Fork 1
mirror of https://github.com/langflow-ai/langflow.git synced 2026-07-23 17:31:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: 1.8.0 security fixes (#11449)

Browse Source 
* fix: 1.7.3 vulnerability patch for main

Steps
1. supposedely non-breaking pypi and dockerfile changes for many security vulnerabilities
3. npm audit fix --force
4. install offical nodejs tarball
5. update playwright version
6. dynamically set latest node 22 version
7. dynamically set arch
8. add glob and tar overrides
9. "setuptools>=80.0.0,<81.0.0"
10. jaraco-context specifier = ">=6.1.0"
11. "test-exclude": "^7.0.0"
12. pin wheel version

* fix: update locks after porting changes from 1.7.3

update locks after porting changes from 1.7.3

* chore: upgrade package-lock

* chore: upgrade uv.lock files

* fix: upgrade to fastmcp 2.14.4

* fix: update tar to 7.5.7
This commit is contained in:
Adam-Aghili
2026-01-28 13:17:10 -05:00
committed by GitHub
parent ed675ea478
commit b757c303ce
11 changed files with 9009 additions and 7336 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/typescript_test.yml vendored
View File

@ -69,7 +69,7 @@ env:
# Define the directory where Playwright browsers will be installed.
# This path is used for caching across workflows
PLAYWRIGHT_BROWSERS_PATH: "ms-playwright"
PLAYWRIGHT_VERSION: "1.56.0"
PLAYWRIGHT_VERSION: "1.57.0"
jobs:
determine-test-suite:

26
docker/build_and_push.Dockerfile
View File

@ -73,21 +73,31 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# RUNTIME
# Setup user, utilities and copy the virtual environment only
################################
FROM python:3.12.3-slim AS runtime
FROM python:3.12.12-slim-trixie AS runtime
RUN apt-get update \
&& apt-get upgrade -y \
&& apt-get install -y curl git libpq5 gnupg \
&& curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
&& apt-get install -y nodejs \
&& apt-get install --no-install-recommends -y curl git libpq5 gnupg xz-utils \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* \
&& useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
&& rm -rf /var/lib/apt/lists/*
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C /usr/local --strip-components=1 \
&& npm install -g npm@latest \
&& npm cache clean --force
RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
COPY --from=builder --chown=1000 /app/.venv /app/.venv
# Place executables in the environment at the front of the path
ENV PATH="/app/.venv/bin:$PATH"
RUN /app/.venv/bin/pip install --upgrade playwright \
&& /app/.venv/bin/playwright install
LABEL org.opencontainers.image.title=langflow
LABEL org.opencontainers.image.authors=['Langflow']

28
docker/build_and_push_base.Dockerfile
View File

@ -74,21 +74,31 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# RUNTIME
# Setup user, utilities and copy the virtual environment only
################################
FROM python:3.12.3-slim AS runtime
FROM python:3.12.12-slim-trixie AS runtime
RUN apt-get update \
&& apt-get upgrade -y \
&& apt-get install -y git libpq5 curl gnupg \
&& curl -fsSL https://deb.nodesource.com/setup_18.x | bash - \
&& apt-get install -y nodejs \
&& apt-get install --no-install-recommends -y curl git libpq5 gnupg xz-utils \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* \
&& useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
# and we use the venv at the root because workspaces
COPY --from=builder --chown=1000 /app/.venv /app/.venv
&& rm -rf /var/lib/apt/lists/*
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C /usr/local --strip-components=1 \
&& npm install -g npm@latest \
&& npm cache clean --force
RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
# Place executables in the environment at the front of the path
COPY --from=builder --chown=1000 /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
RUN /app/.venv/bin/pip install --upgrade playwright \
&& /app/.venv/bin/playwright install
LABEL org.opencontainers.image.title=langflow
LABEL org.opencontainers.image.authors=['Langflow']

35
docker/build_and_push_ep.Dockerfile
View File

@ -70,31 +70,30 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# RUNTIME
# Setup user, utilities and copy the virtual environment only
################################
FROM python:3.12.3-slim AS runtime
FROM python:3.12.12-slim-trixie AS runtime
RUN apt-get update \
&& apt-get upgrade -y \
&& apt-get install --no-install-recommends -y \
curl \
git \
# Add PostgreSQL client libraries
libpq5 \
gnupg \
&& curl -fsSL https://deb.nodesource.com/setup_18.x | bash - \
&& apt-get install -y nodejs \
&& apt-get install --no-install-recommends -y curl git libpq5 gnupg xz-utils \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* \
&& useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data -s /usr/bin/false \
&& mkdir /data && chown -R 1000:0 /data
&& rm -rf /var/lib/apt/lists/*
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C /usr/local --strip-components=1 \
&& npm install -g npm@latest \
&& npm cache clean --force
RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
COPY --from=builder --chown=1000 /app/.venv /app/.venv
# Remove shell binaries to completely disable shell access
RUN rm -f /bin/sh /bin/bash /bin/dash /usr/bin/sh /usr/bin/bash /usr/bin/dash \
/bin/ash /bin/zsh /bin/csh /bin/tcsh /bin/ksh 2>/dev/null || true
# Place executables in the environment at the front of the path
ENV PATH="/app/.venv/bin:$PATH"
RUN /app/.venv/bin/pip install --upgrade playwright \
&& /app/.venv/bin/playwright install
LABEL org.opencontainers.image.title=langflow
LABEL org.opencontainers.image.authors=['Langflow']

26
docker/build_and_push_with_extras.Dockerfile
View File

@ -70,21 +70,31 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# RUNTIME
# Setup user, utilities and copy the virtual environment only
################################
FROM python:3.12.3-slim AS runtime
FROM python:3.12.12-slim-trixie AS runtime
RUN apt-get update \
&& apt-get upgrade -y \
&& apt-get install -y curl git libpq5 gnupg \
&& curl -fsSL https://deb.nodesource.com/setup_18.x | bash - \
&& apt-get install -y nodejs \
&& apt-get install --no-install-recommends -y curl git libpq5 gnupg xz-utils \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* \
&& useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
&& rm -rf /var/lib/apt/lists/*
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C /usr/local --strip-components=1 \
&& npm install -g npm@latest \
&& npm cache clean --force
RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
COPY --from=builder --chown=1000 /app/.venv /app/.venv
# Place executables in the environment at the front of the path
ENV PATH="/app/.venv/bin:$PATH"
RUN /app/.venv/bin/pip install --upgrade playwright \
&& /app/.venv/bin/playwright install
LABEL org.opencontainers.image.title=langflow
LABEL org.opencontainers.image.authors=['Langflow']

14
src/backend/base/pyproject.toml
View File

@ -25,7 +25,7 @@ dependencies = [
"gunicorn>=22.0.0,<23.0.0",
"langchain~=0.3.27",
"langchain-community>=0.3.28,<1.0.0",
"langchain-core>=0.3.45,<1.0.0",
"langchain-core>=0.3.81,<1.0.0",
"langchainhub~=0.1.15",
"loguru>=0.7.1,<1.0.0",
"structlog>=25.4.0,<26.0.0",
@ -67,9 +67,9 @@ dependencies = [
"prometheus-client>=0.20.0,<1.0.0",
"aiofiles>=24.1.0,<25.0.0",
"pip>=25.3,<26.0.0",
"setuptools>=78.1.1,<79.0.0",
"setuptools>=80.0.0,<81.0.0",
"nanoid>=2.0.0,<3.0.0",
"filelock>=3.15.4,<4.0.0",
"filelock>=3.20.1,<4.0.0",
"grandalf>=0.8.0,<1.0.0",
"spider-client>=0.0.27,<1.0.0",
"diskcache>=5.6.3,<6.0.0",
@ -77,7 +77,7 @@ dependencies = [
"assemblyai>=0.33.0,<1.0.0",
"fastapi-pagination>=0.13.1,<1.0.0",
"defusedxml>=0.7.1,<1.0.0",
"pypdf~=5.1.0",
"pypdf>=6.4.0,<7.0.0",
"validators>=0.34.0,<1.0.0",
"networkx>=3.4.2,<4.0.0",
"json-repair>=0.30.3,<1.0.0",
@ -93,6 +93,8 @@ dependencies = [
"langchain-ibm>=0.3.8,<1.0.0",
"trustcall>=0.0.38,<1.0.0",
"langchain-chroma>=0.1.4,<1.0.0",
"jaraco-context>=6.1.0",
"wheel>=0.46.2,<1.0.0",
]
[dependency-groups]
@ -245,7 +247,7 @@ langsmith = ["langsmith>=0.3.42,<1.0.0"]
arize = ["arize-phoenix-otel>=0.6.1"]
# Individual document loaders
pypdf = ["pypdf~=5.1.0"]
pypdf = ["pypdf~=6.6.2"]
docx = ["python-docx>=1.1.0"]
pytube = ["pytube==15.0.0"]
@ -348,7 +350,7 @@ mlx = [
]
# MCP
fastmcp = ["fastmcp==2.13.0"]
fastmcp = ["fastmcp>=2.14.0"]
# AWS extras
aioboto3 = ["aioboto3>=15.2.0,<16.0.0"]

11634
src/backend/base/uv.lock generated
View File

File diff suppressed because it is too large Load Diff

1549
src/frontend/package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

13
src/frontend/package.json
View File

@ -5,6 +5,11 @@
"engines": {
"node": ">=20.19.0"
},
"overrides": {
"tar": "^7.5.7",
"glob": "^11.1.0",
"test-exclude": "^7.0.0"
},
"dependencies": {
"@chakra-ui/number-input": "^2.1.2",
"@chakra-ui/system": "^2.6.2",
@ -63,7 +68,7 @@
"openseadragon": "^4.1.1",
"p-debounce": "^4.0.0",
"pako": "^2.1.0",
"playwright": "^1.56.0",
"playwright": "^1.57.0",
"pretty-ms": "^9.1.0",
"react": "^19.2.1",
"react-ace": "^14.0.1",
@ -135,8 +140,8 @@
"devDependencies": {
"@biomejs/biome": "2.1.1",
"@jest/types": "^30.0.1",
"@modelcontextprotocol/server-everything": "^2025.12.18",
"@playwright/test": "^1.56.0",
"@modelcontextprotocol/server-everything": "^2026.1.14",
"@playwright/test": "^1.57.0",
"@storybook/addon-docs": "^10.1.0",
"@storybook/addon-links": "^10.1.0",
"@storybook/react": "^10.1.0",
@ -167,6 +172,6 @@
"ts-jest": "^29.4.0",
"typescript": "^5.4.5",
"ua-parser-js": "^1.0.38",
"vite": "^7.3.0"
"vite": "^7.3.1"
}
}

10
src/lfx/pyproject.toml
View File

@ -8,7 +8,7 @@ authors = [
]
requires-python = ">=3.10,<3.14"
dependencies = [
"langchain-core>=0.3.66,<1.0.0",
"langchain-core>=0.3.81,<1.0.0",
"pandas>=2.0.0,<3.0.0",
"pydantic>=2.0.0,<3.0.0",
"pillow>=10.0.0,<13.0.0",
@ -39,11 +39,13 @@ dependencies = [
"loguru>=0.7.3,<1.0.0",
"langchain~=0.3.23",
"validators>=0.34.0,<1.0.0",
"filelock>=3.20.0",
"pypdf>=5.1.0",
"filelock>=3.20.1,<4.0.0",
"pypdf>=6.4.0,<7.0.0",
"cryptography>=43.0.0",
"ag-ui-protocol>=0.1.10",
"markitdown>=0.1.4,<2.0.0",
"setuptools>=80.0.0,<81.0.0",
"wheel>=0.46.2,<1.0.0",
]
[project.scripts]
@ -84,7 +86,7 @@ dev = [
integration = [
# Dependencies for running Simple Agent and other integration tests
"langchain-openai>=0.3.0,<1.0.0",
"langchain-community>=0.3.0,<1.0.0",
"langchain-community>=0.3.27,<1.0.0",
"beautifulsoup4>=4.12.0",
"lxml>=5.0.0",
]

3008
uv.lock generated
View File

File diff suppressed because it is too large Load Diff