|
|
96c9035fc6
|
docs: point security reports to hackerone (#12368)
* use-hackerone-and-remove-cve-list
* link-to-ibm-hackerone
* add-release-note
* typo
|
2026-04-02 01:42:03 +00:00 |
|
|
|
91219be56c
|
feat: add secret key rotation script and documentation (#10978)
* feat: add script for migrating encrypted data to a new secret key
* test: add unit tests for secret key migration script
* docs: update SECURITY.md to include secret key rotation process and migration instructions
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* update component index
* update component index
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* refactor: use atomic transaction for secret key migration
* fix: print new key for both generated and provided cases
Ensure users always see the key being used regardless of whether
it was auto-generated or provided via --new-key flag.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: improve error handling and test coverage for secret key migration
- Update docstring to accurately reflect migrated fields (remove KB reference)
- Change migrate_auth_settings to return (result, failed_fields) tuple
- Skip folders with failed field migrations instead of silently preserving old values
- Add tests for transaction atomicity and rollback behavior
- Add tests for error handling: invalid data, null values, malformed JSON
- Add test for file permissions (0o600 on Unix)
- Add test for dry-run mode database preservation
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* docs: improve docstrings for secret key migration script
- Add detailed description for ensure_valid_key explaining short vs long key handling
- Add Returns section to migrate_value documenting None return on failure
- Add full Args documentation and transaction behavior to migrate function
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* fix: update .gitignore to include new data files and user-specific cache
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* fix: update usage instructions to include 'uv run' for secret key migration script
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* feat: add migration verification functionality and corresponding tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
2026-03-03 13:06:58 +00:00 |
|
|
|
eac66f3056
|
docs: CSV agent RCE (#11798)
* arbitrary-code-execution-warniing
* remove-parenthetical
* cleanup
* add-security-note
* remove-parenthetical
|
2026-02-24 14:20:34 +00:00 |
|
|
|
6504e70081
|
docs: CVEs for 1.7 (#11112)
* ssrf-cve
* cve-filename
* readme
|
2025-12-19 16:48:08 +00:00 |
|
|
|
c59bfc875a
|
docs: warnings for dotenv vulnerability (#10138)
* dotenv-warnings-and-164-patch
Dotenv warnings and 164 patch.
* Apply suggestions from code review
* remove-pragma-flags
* Apply suggestion from @mendonk
* Apply suggestion from @mendonk
* Apply suggestion from @mendonk
---------
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
|
2025-10-07 18:10:36 +00:00 |
|
|
|
59d64f0cf5
|
docs: CVE advisory and patch release 1.5.1 (#9584)
* add-info-for-CVE-2025-57760
* cleanup
|
2025-08-28 18:42:14 +00:00 |
|
|
|
c188ec113c
|
fix: enforce authentication for superuser cli command (#9152)
* Enforce authentication for superuser cli command
* shorten security md
* cleanup
* use session_scope
* re-add uvlock
* [autofix.ci] apply automated fixes
* ruff
* update env example
* [autofix.ci] apply automated fixes
* better exception handling
* [autofix.ci] apply automated fixes
* update tests to not use mocks
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* Remove old test
* Catch exceptions for typer
* Try output instead of stdout
* Use xdist to run in serial
* Separate create superuse
* [autofix.ci] apply automated fixes
* Ruff
* [autofix.ci] apply automated fixes
* lint
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
2025-08-14 20:29:35 +00:00 |
|
|
|
c03074300f
|
docs: combine api keys and authentication pages (#9172)
* combine-api-keys-and-auth
* remove-old-page-redirect-and-sidebar
* Update docs/docs/Configuration/api-keys-and-authentication.mdx
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix-parse-error
* Apply suggestions from code review
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
* upto-env-vars
* clarity-in-example
* clarify-user-creation
* specify-which-table
* links
* link text
* environment variable alignment
* environment variable table cleanup
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
Co-authored-by: April M <april.murphy@datastax.com>
|
2025-07-30 01:07:15 +00:00 |
|
|
|
d59c890dce
|
docs: langflow 1.5 auto-login security doc (#9057)
* langflow-auto-login-security-doc
* trailing-space
* auto-not-auth
* clarify-new-behavior
* env-var-default
* security-md-and-var-names
* Apply suggestions from code review
* Update docs/docs/Configuration/environment-variables.mdx
* Update docs/docs/Configuration/configuration-authentication.mdx
---------
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
|
2025-07-23 13:48:46 +00:00 |
|
|
|
2ff3345182
|
docs: create initial security policy (#8598)
* Create security.md
* move known to end
|
2025-06-17 18:55:43 +00:00 |
|
