Skip to content

Commit 0732423

Browse files
Adam-Aghiliericharevjgit96
committed
chore: security patch (#12725)
* chore: security patch security patch * chore: upgrade package-lock.json * chore: smolagents and transformer update * chore: redis upgrade * chore: litellm upgrade * fix: Pin click to avoid lower versions ## Root cause **litellm 1.83.5+** introduced an exact pin `click==8.1.8` in its `requires_dist` (upstream bug [BerriAI/litellm#26154](BerriAI/litellm#26154) — "Pinning exact dependency versions breaks downstream consumers"). When this branch bumped litellm to 1.83.11, uv was forced to downgrade click from 8.3.2 → 8.1.8. Click 8.2+ captures stderr separately by default; 8.1 merges it — hence `ValueError: stderr not separately captured`. ## Fix - [pyproject.toml:155](pyproject.toml:155) — added `"click>=8.3.0"` to `[tool.uv] override-dependencies` with comment linking the upstream issue. - [src/backend/base/pyproject.toml:112](src/backend/base/pyproject.toml:112) — same override so `langflow-base` Docker builds pick it up too. - Regenerated `uv.lock` (click: 8.1.8 → 8.3.3). - Patched the `click` entry in `src/backend/base/uv.lock` to 8.3.3 (that lockfile is used by `docker/build_and_push_base.Dockerfile` via `uv sync --frozen`; uv treats backend/base as a workspace member so I updated its click block directly — no other references to 8.1.8 remain). - Reverted [src/lfx/tests/unit/cli/test_run_real_flows.py](src/lfx/tests/unit/cli/test_run_real_flows.py) back to its original `result.stderr` usage — now passes cleanly with click 8.3.3. All 19 tests in the file pass. * Update build_and_push_backend.Dockerfile The `uv pip install` command doesn't read `[tool.uv] override-dependencies` from the target packages' pyproject.toml — those overrides only apply during `uv lock`/`uv sync`. The fix is to pass the overrides explicitly via `--overrides`. Now let me verify it works by running the same install locally. Resolution succeeded — click==8.3.3, aiohttp==3.13.5, litellm==1.83.11 all coexist. Let me also test without `--overrides` to confirm I reproduce the original failure. Reproduced the Docker failure locally. Now test with the overrides file: Fix verified — resolution succeeds with the overrides file, failing without. Let me clean up and show the final Dockerfile change. ## Summary **Root cause:** The Dockerfile uses `uv pip install ./src/...` which **does not read** `[tool.uv] override-dependencies` from the target packages' `pyproject.toml` — those overrides only apply during `uv lock`/`uv sync`. On Linux, `cuga>=0.2.20` requires `aiohttp>=3.13.5`, but `litellm==1.83.11` exact-pins `aiohttp==3.13.3` (same upstream bug as the click pin, [BerriAI/litellm#26154](BerriAI/litellm#26154)). Without an active override, resolution fails. **Fix:** Write a `/tmp/uv-overrides.txt` file mirroring the workspace's `override-dependencies` (litellm, python-dotenv, openai, aiohttp, click) and pass `--overrides /tmp/uv-overrides.txt` to `uv pip install`. Verified locally by reproducing the exact failure in an isolated tmp directory (to escape the workspace's pyproject.toml auto-apply), then confirming the overrides file resolves it: - aiohttp==3.13.5 ✓ - click==8.3.3 ✓ - litellm==1.83.11 ✓ - cuga==0.2.22 ✓ * Templates version update * Update .secrets.baseline * chore: update overrides * chore: bump version * chore: bump main version * chore: bump SDK version to 0.1.1 * chore: run uv lock and uv sync after SDK version bump * chore: read the overrides from a single source security patch * chore: add pip check toggle add pip check toggle * chore: litellm base uv.lock update * fix(chore): Pin litellm back to last working release * fix(chore): Pin to 1.83 and higher litellm * Update build_and_push_backend.Dockerfile * chore: update base uv.lock * fix: lazyload toolguard since its an optional extra * Update .secrets.baseline * Update component_index.json * Rebuild component index * Update component_index.json --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> (cherry picked from commit 60a8f76)
1 parent 0659105 commit 0732423

53 files changed

Lines changed: 2766 additions & 2147 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/e2e-testing/SKILL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ description: Write and review Playwright E2E tests for Langflow. Trigger when th
2121

2222
| Tool | Version | Purpose |
2323
|------|---------|---------|
24-
| Playwright | 1.57.0 | E2E test runner + browser automation |
24+
| Playwright | 1.59.1 | E2E test runner + browser automation |
2525
| Chromium | (bundled) | Default browser (Firefox/Safari disabled) |
2626
| Custom fixtures | `tests/fixtures.ts` | Auto-detects API errors and flow execution failures |
2727

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ on:
5353
required: false
5454
type: boolean
5555
default: true
56+
run_pip_check:
57+
description: "Whether to run pip check - ONLY SET TO FALSE ONCE YOU HAVE ALREADY ATTEMPTED AND FAILED A RUN THEN MADE SURE DEPS DO NOT CAUSE FAILURES"
58+
required: false
59+
type: boolean
60+
default: true
5661

5762
jobs:
5863
echo-inputs:
@@ -107,7 +112,7 @@ jobs:
107112
uses: actions/checkout@v6
108113
with:
109114
fetch-depth: 0
110-
115+
111116
- name: Validate Tag Has v Prefix
112117
run: |
113118
TAG="${{ inputs.release_tag }}"
@@ -119,12 +124,12 @@ jobs:
119124
exit 1
120125
fi
121126
echo "✅ Tag format is valid: $TAG"
122-
127+
123128
- name: Check for Duplicate Tag Without v Prefix
124129
run: |
125130
TAG="${{ inputs.release_tag }}"
126131
TAG_WITHOUT_V="${TAG#v}"
127-
132+
128133
if git rev-parse "$TAG_WITHOUT_V" >/dev/null 2>&1; then
129134
echo "❌ Error: Duplicate tag without 'v' prefix exists: $TAG_WITHOUT_V"
130135
echo " This will cause release notes to use the wrong base comparison."
@@ -600,6 +605,7 @@ jobs:
600605
fi
601606
uv pip install $FIND_LINKS --prerelease=allow -e src/backend/base
602607
- name: Check for dependency incompatibility
608+
if: ${{ inputs.run_pip_check }}
603609
run: uv pip check
604610
- name: Set version for pre-release
605611
if: ${{ inputs.pre_release }}
@@ -747,6 +753,7 @@ jobs:
747753
fi
748754
uv pip install $FIND_LINKS --prerelease=allow -e .
749755
- name: Check for dependency incompatibility
756+
if: ${{ inputs.run_pip_check }}
750757
run: uv pip check
751758
- name: Set version for pre-release
752759
if: ${{ inputs.pre_release }}
@@ -1040,7 +1047,8 @@ jobs:
10401047
create_release:
10411048
name: Create Release
10421049
runs-on: ubuntu-latest
1043-
needs: [determine-main-version, build-main, publish-main, validate-tag-format]
1050+
needs:
1051+
[determine-main-version, build-main, publish-main, validate-tag-format]
10441052
if: |
10451053
always() &&
10461054
!cancelled() &&

‎.github/workflows/typescript_test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ env:
7070
# Define the directory where Playwright browsers will be installed.
7171
# This path is used for caching across workflows
7272
PLAYWRIGHT_BROWSERS_PATH: "ms-playwright"
73-
PLAYWRIGHT_VERSION: "1.57.0"
73+
PLAYWRIGHT_VERSION: "1.59.1"
7474
LANGFLOW_FEATURE_WXO_DEPLOYMENTS: "true"
7575

7676
jobs:

‎.secrets.baseline‎

Lines changed: 3 additions & 131 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@
197197
"filename": ".github/workflows/release.yml",
198198
"hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
199199
"is_verified": false,
200-
"line_number": 346,
200+
"line_number": 391,
201201
"is_secret": false
202202
}
203203
],
@@ -1726,38 +1726,6 @@
17261726
"hashed_secret": "d6e6d7b4b115cd3b9d172623199f8c403055fecc",
17271727
"is_verified": false,
17281728
"line_number": 659
1729-
},
1730-
{
1731-
"type": "Secret Keyword",
1732-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
1733-
"hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
1734-
"is_verified": false,
1735-
"line_number": 1506,
1736-
"is_secret": false
1737-
},
1738-
{
1739-
"type": "Secret Keyword",
1740-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
1741-
"hashed_secret": "3f2df46921dd8e2c36e2ce85238705ac0774c74a",
1742-
"is_verified": false,
1743-
"line_number": 1641,
1744-
"is_secret": false
1745-
},
1746-
{
1747-
"type": "Secret Keyword",
1748-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
1749-
"hashed_secret": "d3d6fe3f7d33d0f4aa28c49544a865982a48a00a",
1750-
"is_verified": false,
1751-
"line_number": 1701,
1752-
"is_secret": false
1753-
},
1754-
{
1755-
"type": "Secret Keyword",
1756-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json",
1757-
"hashed_secret": "d4c3d66fd0c38547a3c7a4c6bdc29c36911bc030",
1758-
"is_verified": false,
1759-
"line_number": 1766,
1760-
"is_secret": false
17611729
}
17621730
],
17631731
"src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json": [
@@ -2259,44 +2227,12 @@
22592227
"line_number": 1612,
22602228
"is_secret": false
22612229
},
2262-
{
2263-
"type": "Secret Keyword",
2264-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json",
2265-
"hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
2266-
"is_verified": false,
2267-
"line_number": 1803,
2268-
"is_secret": false
2269-
},
2270-
{
2271-
"type": "Secret Keyword",
2272-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json",
2273-
"hashed_secret": "3f2df46921dd8e2c36e2ce85238705ac0774c74a",
2274-
"is_verified": false,
2275-
"line_number": 1938,
2276-
"is_secret": false
2277-
},
2278-
{
2279-
"type": "Secret Keyword",
2280-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json",
2281-
"hashed_secret": "d3d6fe3f7d33d0f4aa28c49544a865982a48a00a",
2282-
"is_verified": false,
2283-
"line_number": 1998,
2284-
"is_secret": false
2285-
},
2286-
{
2287-
"type": "Secret Keyword",
2288-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json",
2289-
"hashed_secret": "d4c3d66fd0c38547a3c7a4c6bdc29c36911bc030",
2290-
"is_verified": false,
2291-
"line_number": 2063,
2292-
"is_secret": false
2293-
},
22942230
{
22952231
"type": "Hex High Entropy String",
22962232
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json",
22972233
"hashed_secret": "13f728be4fd927580a98667bcd624f511f459de0",
22982234
"is_verified": false,
2299-
"line_number": 2333
2235+
"line_number": 2017
23002236
}
23012237
],
23022238
"src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json": [
@@ -2449,38 +2385,6 @@
24492385
"hashed_secret": "d6e6d7b4b115cd3b9d172623199f8c403055fecc",
24502386
"is_verified": false,
24512387
"line_number": 650
2452-
},
2453-
{
2454-
"type": "Secret Keyword",
2455-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json",
2456-
"hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
2457-
"is_verified": false,
2458-
"line_number": 1278,
2459-
"is_secret": false
2460-
},
2461-
{
2462-
"type": "Secret Keyword",
2463-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json",
2464-
"hashed_secret": "3f2df46921dd8e2c36e2ce85238705ac0774c74a",
2465-
"is_verified": false,
2466-
"line_number": 1410,
2467-
"is_secret": false
2468-
},
2469-
{
2470-
"type": "Secret Keyword",
2471-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json",
2472-
"hashed_secret": "d3d6fe3f7d33d0f4aa28c49544a865982a48a00a",
2473-
"is_verified": false,
2474-
"line_number": 1470,
2475-
"is_secret": false
2476-
},
2477-
{
2478-
"type": "Secret Keyword",
2479-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json",
2480-
"hashed_secret": "d4c3d66fd0c38547a3c7a4c6bdc29c36911bc030",
2481-
"is_verified": false,
2482-
"line_number": 1535,
2483-
"is_secret": false
24842388
}
24852389
],
24862390
"src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json": [
@@ -2523,38 +2427,6 @@
25232427
"is_verified": false,
25242428
"line_number": 1480,
25252429
"is_secret": false
2526-
},
2527-
{
2528-
"type": "Secret Keyword",
2529-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json",
2530-
"hashed_secret": "665b1e3851eefefa3fb878654292f16597d25155",
2531-
"is_verified": false,
2532-
"line_number": 1671,
2533-
"is_secret": false
2534-
},
2535-
{
2536-
"type": "Secret Keyword",
2537-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json",
2538-
"hashed_secret": "3f2df46921dd8e2c36e2ce85238705ac0774c74a",
2539-
"is_verified": false,
2540-
"line_number": 1806,
2541-
"is_secret": false
2542-
},
2543-
{
2544-
"type": "Secret Keyword",
2545-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json",
2546-
"hashed_secret": "d3d6fe3f7d33d0f4aa28c49544a865982a48a00a",
2547-
"is_verified": false,
2548-
"line_number": 1866,
2549-
"is_secret": false
2550-
},
2551-
{
2552-
"type": "Secret Keyword",
2553-
"filename": "src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json",
2554-
"hashed_secret": "d4c3d66fd0c38547a3c7a4c6bdc29c36911bc030",
2555-
"is_verified": false,
2556-
"line_number": 1931,
2557-
"is_secret": false
25582430
}
25592431
],
25602432
"src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json": [
@@ -8373,5 +8245,5 @@
83738245
}
83748246
]
83758247
},
8376-
"generated_at": "2026-04-14T23:44:15Z"
8248+
"generated_at": "2026-04-23T21:12:19Z"
83778249
}

‎.whitesource‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"settingsInheritedFrom": "whitesource-config/whitesource-config@master",
3+
"scanSettings": {
4+
"dependencyScopes": [
5+
"prod"
6+
],
7+
"baseBranches": [
8+
"main",
9+
"release-*"
10+
]
11+
}
12+
}

‎docker/build_and_push.Dockerfile‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,6 @@ RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
9999

100100
COPY --from=builder --chown=1000 /app/.venv /app/.venv
101101
ENV PATH="/app/.venv/bin:$PATH"
102-
RUN /app/.venv/bin/pip install --upgrade playwright \
103-
&& /app/.venv/bin/playwright install
104102

105103
LABEL org.opencontainers.image.title=langflow
106104
LABEL org.opencontainers.image.authors=['Langflow']

‎docker/build_and_push_backend.Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ RUN uv venv /app/.venv
3737
ENV PATH="/app/.venv/bin:$PATH"
3838
ENV VIRTUAL_ENV="/app/.venv"
3939

40+
# Install langflow-base with all extras except dev (which includes Playwright)
4041
RUN --mount=type=cache,target=/root/.cache/uv \
4142
uv pip install ./src/sdk ./src/lfx "./src/backend/base[complete,postgresql]"
4243

‎docker/build_and_push_base.Dockerfile‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,6 @@ RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
101101

102102
COPY --from=builder --chown=1000 /app/.venv /app/.venv
103103
ENV PATH="/app/.venv/bin:$PATH"
104-
RUN /app/.venv/bin/pip install --upgrade playwright \
105-
&& /app/.venv/bin/playwright install
106104

107105
LABEL org.opencontainers.image.title=langflow
108106
LABEL org.opencontainers.image.authors=['Langflow']

‎docker/build_and_push_ep.Dockerfile‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,6 @@ RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
9595

9696
COPY --from=builder --chown=1000 /app/.venv /app/.venv
9797
ENV PATH="/app/.venv/bin:$PATH"
98-
RUN /app/.venv/bin/pip install --upgrade playwright \
99-
&& /app/.venv/bin/playwright install
10098

10199
LABEL org.opencontainers.image.title=langflow
102100
LABEL org.opencontainers.image.authors=['Langflow']

‎docker/build_and_push_with_extras.Dockerfile‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,6 @@ RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
9696

9797
COPY --from=builder --chown=1000 /app/.venv /app/.venv
9898
ENV PATH="/app/.venv/bin:$PATH"
99-
RUN /app/.venv/bin/pip install --upgrade playwright \
100-
&& /app/.venv/bin/playwright install
10199

102100
LABEL org.opencontainers.image.title=langflow
103101
LABEL org.opencontainers.image.authors=['Langflow']

0 commit comments

Comments
 (0)