Skip to content

fix: remediate image_scan CVEs in backend, frontend, and langflow images#2000

Merged
gnPy merged 2 commits into
mainfrom
fix_securityUpgrades
Jul 3, 2026
Merged

fix: remediate image_scan CVEs in backend, frontend, and langflow images#2000
gnPy merged 2 commits into
mainfrom
fix_securityUpgrades

Conversation

@gnPy

@gnPy gnPy commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator

Summary by CodeRabbit

  • Bug Fixes
    • Updated several bundled dependencies and version limits to improve stability and address security-related issues.
    • Added a fixed version pin for a frontend parser dependency to ensure more consistent builds.
    • Refreshed container build dependencies with safer minimum versions during image creation.

@gnPy gnPy self-assigned this Jul 2, 2026
@github-actions github-actions Bot added frontend 🟨 Issues related to the UI/UX docker labels Jul 2, 2026
@coderabbitai

coderabbitai Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

This PR updates dependency versions: Dockerfile.langflow adds pip upgrades for langchain and langchain-anthropic as a security remediation, frontend/package.json pins postcss-selector-parser to 6.1.4, and pyproject.toml raises minimum versions for aiohttp, cryptography, python-multipart, and starlette.

Changes

Dependency Updates

Layer / File(s) Summary
Langflow Docker security remediation
Dockerfile.langflow
Adds pip installs upgrading langchain and langchain-anthropic to fixed minimum versions after uninstalling ragstack-ai-knowledge-store, with a GHSA remediation comment.
Python dependency minimum version bumps
pyproject.toml
Raises minimum versions for aiohttp, cryptography, python-multipart, and starlette.
Frontend override pin
frontend/package.json
Adds an npm override pinning postcss-selector-parser to 6.1.4.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • langflow-ai/openrag#1714: Both PRs modify Dockerfile.langflow's pip install layer for Langflow's Python dependencies.
  • langflow-ai/openrag#1856: Extends the same ragstack-ai-knowledge-store uninstall logic in Dockerfile.langflow with additional pinned upgrades.
  • langflow-ai/openrag#1989: Both PRs modify Dockerfile.langflow's pip install step and dependency constraints for Langflow packages.

Suggested labels: bug

Suggested reviewers: edwinjosechittilappilly, mfortman11

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the security-related dependency updates across backend, frontend, and Langflow images.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix_securityUpgrades

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the bug 🔴 Something isn't working. label Jul 2, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.langflow`:
- Around line 24-27: The Dockerfile.langflow dependency upgrade is pushing
langchain and langchain-anthropic past the versions supported by
langflow-base==0.9.6. Update the install step that follows the
clickhouse-connect and ragstack-ai-knowledge-store uninstalls so it stays within
langflow-base’s compatible range, or adjust langflow-base together with its
dependency constraints. Use the existing Dockerfile.langflow install block as
the anchor and keep the langchain/langchain-anthropic pins aligned with
langflow-base 0.9.6’s requirements.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9242a5ea-a99a-4714-b2fa-ce03e66a3f13

📥 Commits

Reviewing files that changed from the base of the PR and between 4f104ec and ca8aadc.

⛔ Files ignored due to path filters (2)
  • frontend/package-lock.json is excluded by !**/package-lock.json
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • Dockerfile.langflow
  • frontend/package.json
  • pyproject.toml

Comment thread Dockerfile.langflow Outdated
@github-actions github-actions Bot added bug 🔴 Something isn't working. and removed bug 🔴 Something isn't working. labels Jul 2, 2026
@gnPy

gnPy commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@gnPy gnPy enabled auto-merge (squash) July 3, 2026 07:52
@gnPy gnPy disabled auto-merge July 3, 2026 07:52
@gnPy gnPy enabled auto-merge (squash) July 3, 2026 08:22
@gnPy gnPy merged commit 69bfbce into main Jul 3, 2026
24 checks passed
@github-actions github-actions Bot added the lgtm label Jul 3, 2026
@github-actions github-actions Bot deleted the fix_securityUpgrades branch July 3, 2026 12:08
lucaseduoli added a commit that referenced this pull request Jul 7, 2026
…model option (#2031)

* fix: remediate image_scan CVEs in backend, frontend, and langflow images (#2000)

* fix light color text catergory chips in light mode (#2013)

Co-authored-by: Olfa Maslah <[email protected]>

* fix: upgraded version of docling (#1995)

* changed version of docling

* fix logs not being the correct ones

* go back to sequential building to save space

* add cache to builds

* remove single use results from docling manager

* revert single use results

* change the ray tenant id header

* added env

* changed cache to hit if no changes were made

* fix hash for cache

* style: ruff autofix (auto)

* fixed coderabbit

* style: ruff autofix (auto)

* added comment on docling manager

* style: ruff autofix (auto)

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* feat: add chunk level page source (#2015)

* Changed export docling document to append page number

* update result on frontend to append page number

* document how to get page number in readmes

* Update flows/components/export_docling_document.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Update flows/components/export_docling_document.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix: apply CodeRabbit auto-fixes

Fixed 1 file(s) based on 1 unresolved review comment.

Co-authored-by: CodeRabbit <[email protected]>

* update component code

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <[email protected]>

* fix: error in skip duplicates functionality for folder ingest for connectors (backport of #1941) (#2018)

* fix: error in skip duplicates functionality for folder ingest for connectors 75616(#1842) (#1941)

* fix: enhance duplicate handling and indexing for connector file uploads

* style: ruff autofix (auto)

* fix: improve duplicate handling in connector sync functionality

* chore: trigger CodeRabbit

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
(cherry picked from commit effaf02)

* style: ruff autofix (auto)

* fix: remove duplicate test definitions from main merge

The automated merge-from-main on this branch concatenated two tests
(test_connector_processor_indexes_cleaned_filename,
test_langflow_connector_processor_uses_cleaned_filename) that already
existed under both names, tripping ruff F811. Keep one copy of each,
preferring the version wired with connector_id_exists=True to match
current check_document_exists behavior.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: Ingestion of buckets not working right after connection is tested - CPD #75506 (#1942) (#2019)

* fix: update bucket ingestion messages for clarity and consistency

* fix: guard bucket pre-selection against connection ID mismatch

The defaults query returns the first S3/COS connection regardless of active
status. Only pre-select saved bucket_names when the defaults connection_id
matches the current connector.connectionId to avoid seeding the wrong
buckets if a stale connection exists alongside the active one.



* fix: prevent defaults from overwriting user bucket selections

Two issues in the initial-selection effect:
1. hasAppliedInitial was only set when valid buckets were found, leaving the
   effect live across bucket refreshes and allowing stale defaults to overwrite
   selections made after a refetch.
2. No guard against the async race where buckets loads before initialSelectedBuckets:
   user clicks buckets, defaults arrive later and silently overwrite them.

Fix: mark hasAppliedInitial unconditionally on first evaluation, and only apply
defaults when selectedBuckets is still empty (user hasn't acted yet).



---------


(cherry picked from commit f3823b8)

Co-authored-by: Claude Sonnet 4.6 <[email protected]>

* fix: handle orphan files and return appropriate responses when syncing connectors (#1785) (#2016)

* feat: handle orphan files and return appropriate responses when syncing connectors

* feat: refactor GoogleDriveOAuth to separate required scopes and add handling for missing optional group scopes in tests

* style: ruff autofix (auto)

* feat: add handling for skipped files and warnings in task processing and UI components

---------


(cherry picked from commit aca865a)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: enhance error handling for document processing and add OCR requirement check for image files (#1859) (#2017)

* fix: enhance error handling for document processing and add OCR requirement check for image files

* style: ruff autofix (auto)

* remove clickhouse connect from langflow image (#1801)

* chore: fix ci (#1889)

* Update processors.py

* test fix

* fix ci

---------




(cherry picked from commit a286581)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Lucas Oliveira <[email protected]>
Co-authored-by: Edwin Jose <[email protected]>

* fix: bump golang.org/x/net to v0.55.0 to remediate CVE-2026-25680 and CVE-2026-39821 (#2014)

* feat: add new design for messages and add inline references (#2020)

* update opensearch multimodal and flows to support parser, chunk size and chunk overlap

* update backend to support citations and chunk metadata

* update frontend to support citations and metadata, implement new design for assistant message

* changed the prompt for the agent

* changed the prompt for the agent

* remove hallucinated chunk references

* adjust design of citations and where popover appears

* adjusted design for message, popover and cards

* fix React Doctor picks

* fix: apply CodeRabbit auto-fixes

Fixed 5 file(s) based on 4 unresolved review comments.

Co-authored-by: CodeRabbit <[email protected]>

* style: apply biome auto-fixes [skip ci]

* updated colors in ibm mode

* fixed react doctor picks

* added correct type and validation for function calls

* remove style for message when on onboarding

* fix message not being w full

* remove search query in end of the message

* change popup to use shadcn popover

* fix coderabbit's suggestion

* increase prompt limit

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <[email protected]>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* apply new settings on retry (#2010)

* fix: preserve HTTPException status in update_docling_preset (#1586) (#2004)

* fix: report actual synced connection count in connector_sync (#1547) (#2006)

* fix: restore LLM model values in reapply_all_settings fallback (#1587) (#2008)

* fix: prevent partial matches for exact token searches (#2003)

* fix: prevent partial matches for exact token searches (#1937)

* style: ruff autofix (auto)

* chore: remove unused json import

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: target agent component when updating chat flow system prompt (#2001)

* fix: target langflow agent component for system prompt update instead of provider LLM component

Signed-off-by: vchen7629 <[email protected]>

* fix: removed unused llm_provider arg from _update_langflow_system_prompt

Signed-off-by: vchen7629 <[email protected]>

* test: add unit tests for update_chat_flow_system_prompt

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

* fix(test): resolve flow path relative to repo root in test_langflow_agent_system_prompt

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

---------

Signed-off-by: vchen7629 <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: replaced hardcoded docker.io prefix with a env variable prefix for private repo compatibility (#2002)

Signed-off-by: vchen7629 <[email protected]>

* fix: resolve Pydantic delta serialization warnings in agent streaming (#2005)

* fix: updated agent model dump to exclude delta field

Signed-off-by: vchen7629 <[email protected]>

* test: added regression unit test to verify response field + no warnings

* style: ruff autofix (auto)

* test: added additional unit test to verify that model_dump without exclusion raises the warning

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

* test: tighten delta warning assertion to match specific Pydantic error

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

---------

Signed-off-by: vchen7629 <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: prevent exception details from leaking in API error responses (#2007)

* fix: removed str(e) in exceptions to prevent internals from leaking

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

* fix: added missing status_code

Signed-off-by: vchen7629 <[email protected]>

* style: ruff autofix (auto)

---------

Signed-off-by: vchen7629 <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* Changed docling options to include local support and be shown in the Langflow tab

* style: ruff autofix (auto)

* enable ollama and delete unused file

* fix next lint

---------

Signed-off-by: vchen7629 <[email protected]>
Co-authored-by: Gautham N Pai <[email protected]>
Co-authored-by: Wallgau <[email protected]>
Co-authored-by: Olfa Maslah <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <[email protected]>
Co-authored-by: Rico Furtado <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Edwin Jose <[email protected]>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Mike Fortman <[email protected]>
Co-authored-by: hunterxtang <[email protected]>
Co-authored-by: NishadA05 <[email protected]>
Co-authored-by: Zephyrus <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug 🔴 Something isn't working. docker frontend 🟨 Issues related to the UI/UX lgtm

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants