fix: 1.8.0 security fixes #11449
fix: 1.8.0 security fixes #11449
Conversation
Steps 1. supposedely non-breaking pypi and dockerfile changes for many security vulnerabilities 3. npm audit fix --force 4. install offical nodejs tarball 5. update playwright version 6. dynamically set latest node 22 version 7. dynamically set arch 8. add glob and tar overrides 9. "setuptools>=80.0.0,<81.0.0" 10. jaraco-context specifier = ">=6.1.0" 11. "test-exclude": "^7.0.0" 12. pin wheel version
update locks after porting changes from 1.7.3
Adam-Aghili
requested review from
Cristhianzl,
jordanrfrazier and
ogabrielluiz
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
WalkthroughThis PR updates Playwright to version 1.57.0 across CI/CD and frontend configurations, modernizes Docker base images to Python 3.12.12 with architecture-aware Node.js installation, and bumps multiple Python dependencies including langchain-core, pypdf, and filelock across backend and LFx projects. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 7✅ Passed checks (7 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project check has failed because the head coverage (41.70%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #11449 +/- ##
==========================================
- Coverage 34.88% 34.69% -0.20%
==========================================
Files 1420 1420
Lines 68215 68215
Branches 9984 9984
==========================================
- Hits 23797 23665 -132
- Misses 43184 43315 +131
- Partials 1234 1235 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
github-actions
bot
added
lgtm
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/typescript_test.yml (1)
66-72: Update Playwright cache version to match resolved package version.
PLAYWRIGHT_VERSIONis set to1.57.0but the lockfile resolves bothplaywrightand@playwright/testto1.58.0. This mismatch will cause the Playwright cache key to diverge from the actual installed browser binaries, potentially resulting in cache misses or version conflicts. Update the environment variable to1.58.0.src/lfx/pyproject.toml (1)
11-48: Fix langchain-community version pin to match langchain 0.3.23 requirements.
langchain-community>=0.3.27requireslangchain>=0.3.24, making it incompatible withlangchain~=0.3.23. Uselangchain-community<=0.3.21in the integration group (line 89) to avoid resolver conflicts.Additionally,
setuptoolsandwheel(lines 47-48) should not be runtime dependencies—move them to build requirements or remove if only needed for development.
🤖 Fix all issues with AI agents
In `@docker/build_and_push_base.Dockerfile`:
- Around line 85-95: Download the matching SHASUMS256.txt for the selected
NODE_VERSION and NODE_ARCH (the same base URL used to fetch the tarball),
compute the SHA256 of the downloaded tarball and compare it against the expected
checksum from SHASUMS256.txt before running the tar -xJ extraction; update the
block that sets NODE_VERSION/NODE_ARCH and performs the curl | tar pipeline to
first curl and save the tarball and the SHASUMS256.txt, verify the tarball
checksum matches the entry for node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz,
and only then extract and run npm install; optionally add steps to download and
verify SHASUMS256.txt.sig with Node.js release GPG keys for stronger validation.
In `@docker/build_and_push.Dockerfile`:
- Around line 84-94: The Dockerfile currently downloads and extracts the Node.js
tarball without verifying integrity; update the RUN block that sets
ARCH/NODE_ARCH and computes NODE_VERSION to also fetch the corresponding
SHASUMS256.txt (from https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt),
extract the expected SHA256 for node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz,
compute the checksum of the downloaded tarball (e.g., via sha256sum) and compare
it to the expected value, and fail/exit if they do not match (removing the bad
tarball). Keep the existing variable names (ARCH, NODE_ARCH, NODE_VERSION) and
ensure the verification step runs before the tar -xJ extraction so extraction
only happens on a successful checksum match.
In `@src/frontend/package.json`:
- Around line 8-12: The package.json overrides block includes "tar": "^7.5.4"
but the lockfile shows no resolved tar package, so confirm whether tar is
actually a transitive dependency; search dependency tree for "tar" (e.g., npm ls
tar or pnpm why tar) and if no consumer requires it remove the "tar" override
from the overrides block, otherwise update dependencies so a package pulls in
tar@^7.5.4 (or add a direct devDependency) and then regenerate the lockfile (npm
install / npm ci or pnpm install) to ensure the override is reflected; adjust
the overrides entry for "tar" only if you find a real consumer needing that
version.
- Line 71: The dependency upgrade to "playwright": "^1.57.0" can introduce
breaking changes—search the codebase for usages of page.accessibility(),
page.route( with glob patterns), and route.continue( to ensure no code relies on
removed page.accessibility(), that page.route() glob patterns don't use ? or []
(convert those patterns to RegExp in places where page.route( is called), and
that no code expects route.continue() to override the Cookie header (replace
such logic with browserContext.addCookies() calls). Also run WebKit tests on
macOS >=14 or adjust test targets if you rely on macOS 13. If these changes are
unacceptable, consider pinning or downgrading "playwright" in package.json or
add targeted code changes where the symbols page.accessibility, page.route,
route.continue, and browserContext.addCookies are referenced.
🧹 Nitpick comments (5)
src/backend/base/pyproject.toml (1)
70-97: Consider bounding jaraco-context and confirming runtime need for build tools.
jaraco-contextis the only unbounded dependency here; adding an upper bound keeps consistency with the rest of the file. Also, please confirmsetuptools/wheelare intended runtime dependencies (vs build-system constraints).♻️ Suggested bound for consistency
- "jaraco-context>=6.1.0", + "jaraco-context>=6.1.0,<7.0.0",docker/build_and_push_base.Dockerfile (1)
100-101: Pin Playwright version to keep builds reproducible.
pip install --upgrade playwrightpulls the latest version at build time, which can drift from the JS Playwright 1.57.0 used elsewhere. Consider pinning to a known version.♻️ Suggested pin
+ARG PLAYWRIGHT_PY_VERSION=1.57.0 -RUN /app/.venv/bin/pip install --upgrade playwright \ +RUN /app/.venv/bin/pip install --upgrade "playwright==${PLAYWRIGHT_PY_VERSION}" \ && /app/.venv/bin/playwright installdocker/build_and_push.Dockerfile (1)
99-100: Pin Playwright version to keep builds reproducible.Upgrading to the latest Playwright at build time makes the image non-deterministic and may drift from the JS Playwright version used elsewhere.
♻️ Suggested pin
+ARG PLAYWRIGHT_PY_VERSION=1.57.0 -RUN /app/.venv/bin/pip install --upgrade playwright \ +RUN /app/.venv/bin/pip install --upgrade "playwright==${PLAYWRIGHT_PY_VERSION}" \ && /app/.venv/bin/playwright installdocker/build_and_push_with_extras.Dockerfile (2)
9-11: Stale comment references outdated base image.Line 9 still references
python:3.12.3-slimbut the runtime image (line 73) now usespython:3.12.12-slim-trixie. Consider updating or removing the comment to avoid confusion.Also applies to: 73-74
81-91: Consider verifying Node.js tarball checksum for supply chain security.For a security-focused PR, downloading and extracting the Node.js tarball without verifying its SHA256 checksum introduces supply chain risk. Node.js publishes
SHASUMS256.txt(GPG-signed) alongside releases.Additionally, the architecture fallback on line 84 (
else NODE_ARCH="$ARCH") may silently fail for architectures where Node.js uses different naming conventions (e.g.,armv7l→armv7lbut Node usesarmv7ldifferently).🔒 Proposed fix to add checksum verification
RUN ARCH=$(dpkg --print-architecture) \ && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ - else NODE_ARCH="$ARCH"; fi \ + else echo "Unsupported architecture: $ARCH" && exit 1; fi \ && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | head -1) \ + && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" -o /tmp/SHASUMS256.txt \ + && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -o /tmp/node.tar.xz \ + && grep "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" /tmp/SHASUMS256.txt | sha256sum -c - \ + && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \ + && rm -f /tmp/node.tar.xz /tmp/SHASUMS256.txt \ - && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ - | tar -xJ -C /usr/local --strip-components=1 \ && npm install -g npm@latest \ && npm cache clean --force
| RUN ARCH=$(dpkg --print-architecture) \ | ||
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | ||
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | ||
| else NODE_ARCH="$ARCH"; fi \ | ||
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | ||
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | ||
| | head -1) \ | ||
| && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | ||
| | tar -xJ -C /usr/local --strip-components=1 \ | ||
| && npm install -g npm@latest \ | ||
| && npm cache clean --force |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate and examine the Dockerfile
fd -type f -name "build_and_push_base.Dockerfile"Repository: langflow-ai/langflow
Length of output: 234
🏁 Script executed:
# Read the specific lines mentioned in the review (85-95)
sed -n '85,95p' docker/build_and_push_base.DockerfileRepository: langflow-ai/langflow
Length of output: 689
🏁 Script executed:
# Check if Node.js dist provides SHASUMS256.txt
# Test with a sample Node.js release URL
curl -fsSL --head https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt | head -5Repository: langflow-ai/langflow
Length of output: 205
🌐 Web query:
Node.js official verification tarball checksum SHASUMS256.txt best practices
💡 Result:
Best practices for verifying an official Node.js tarball with SHASUMS256.txt
- Prefer signature verification over “checksum-only”
- Don’t just compare your tarball hash against
SHASUMS256.txt; first verify that the checksum file itself is authentic by validating its GPG signature (SHASUMS256.txt.sig, sometimes also.asc). Current/LTS releases publish a detached signature; Nightlies generally don’t. [2]
- Get release signing keys from a trusted source (and lock them down)
- Use the official Node.js release signing keys (and ideally the prebuilt keyring) from the Node.js Release Keys repo, and consider cross-checking key fingerprints with an independent source. The repo includes a ready-to-use
gpg/keyring and instructions. [1]
- Verify
SHASUMS256.txtsignature
# download checksums + signature for a specific version
curl -O https://nodejs.org/dist/vX.Y.Z/SHASUMS256.txt
curl -O https://nodejs.org/dist/vX.Y.Z/SHASUMS256.txt.sig
# verify signature using the Node release keyring
git clone https://github.com/nodejs/release-keys.git
GNUPGHOME=$PWD/release-keys/gpg gpg --verify SHASUMS256.txt.sig SHASUMS256.txt(Using an isolated GNUPGHOME helps avoid “wrong key” / polluted keyring issues.) [1]
- Verify the tarball matches the (now-trusted) checksum entry
- Check a single artifact:
grep ' node-vX.Y.Z.tar.gz$' SHASUMS256.txt | sha256sum -c -- Or verify all downloaded artifacts listed (ignoring ones you don’t have):
sha256sum -c SHASUMS256.txt --ignore-missing[2]
- Operational hygiene
- Pin the exact version (
vX.Y.Z) and fetch over HTTPS fromnodejs.org. - Treat any GPG warnings about unknown/untrusted keys as a sign you haven’t properly anchored trust (import/verify the correct release keys rather than “accepting” the result). [1]
Sources: Node.js release signing keys + verification workflow [1], Node.js “Verifying binaries” instructions (checksums + SHASUMS256.txt.sig) [2].
References:
[1] (github.com)
[2] (chromium.googlesource.com)
Citations:
- 1: https://github.com/nodejs/release-keys?utm_source=openai
- 2: https://chromium.googlesource.com/external/github.com/v8/node.git/%2B/9ec278772335ad9f8f225afd80d4dfbb8a7b9c6c/README.md?utm_source=openai
Add checksum verification for Node.js tarball download.
The current download/extract does not verify tarball integrity, creating a supply-chain vulnerability. Download SHASUMS256.txt and verify the tarball checksum before extraction. For complete security, also verify the GPG signature of SHASUMS256.txt.sig against the official Node.js release keys, but at minimum:
Checksum verification
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
- && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
- | tar -xJ -C /usr/local --strip-components=1 \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
+ && grep " node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz$" SHASUMS256.txt | sha256sum -c - \
+ && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \
+ && rm -f "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" SHASUMS256.txt \
&& npm install -g npm@latest \
&& npm cache clean --force📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN ARCH=$(dpkg --print-architecture) \ | |
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | |
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | |
| else NODE_ARCH="$ARCH"; fi \ | |
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | |
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | |
| | head -1) \ | |
| && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | |
| | tar -xJ -C /usr/local --strip-components=1 \ | |
| && npm install -g npm@latest \ | |
| && npm cache clean --force | |
| RUN ARCH=$(dpkg --print-architecture) \ | |
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | |
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | |
| else NODE_ARCH="$ARCH"; fi \ | |
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | |
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | |
| | head -1) \ | |
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \ | |
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | |
| && grep " node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz$" SHASUMS256.txt | sha256sum -c - \ | |
| && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \ | |
| && rm -f "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" SHASUMS256.txt \ | |
| && npm install -g npm@latest \ | |
| && npm cache clean --force |
🤖 Prompt for AI Agents
In `@docker/build_and_push_base.Dockerfile` around lines 85 - 95, Download the
matching SHASUMS256.txt for the selected NODE_VERSION and NODE_ARCH (the same
base URL used to fetch the tarball), compute the SHA256 of the downloaded
tarball and compare it against the expected checksum from SHASUMS256.txt before
running the tar -xJ extraction; update the block that sets
NODE_VERSION/NODE_ARCH and performs the curl | tar pipeline to first curl and
save the tarball and the SHASUMS256.txt, verify the tarball checksum matches the
entry for node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz, and only then extract
and run npm install; optionally add steps to download and verify
SHASUMS256.txt.sig with Node.js release GPG keys for stronger validation.
| RUN ARCH=$(dpkg --print-architecture) \ | ||
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | ||
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | ||
| else NODE_ARCH="$ARCH"; fi \ | ||
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | ||
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | ||
| | head -1) \ | ||
| && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | ||
| | tar -xJ -C /usr/local --strip-components=1 \ | ||
| && npm install -g npm@latest \ | ||
| && npm cache clean --force |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check the file exists and read the specific lines
cd /tmp && find . -name "build_and_push.Dockerfile" 2>/dev/null | head -5Repository: langflow-ai/langflow
Length of output: 46
🏁 Script executed:
# Let's search in common Docker paths
find . -name "*Dockerfile*" -type f 2>/dev/null | head -20Repository: langflow-ai/langflow
Length of output: 666
🏁 Script executed:
# Search for the Dockerfile content
fd -e Dockerfile -e dockerfile 2>/dev/nullRepository: langflow-ai/langflow
Length of output: 499
🏁 Script executed:
# Read the specific Dockerfile to verify the lines 84-94
head -100 docker/build_and_push.Dockerfile | tail -20Repository: langflow-ai/langflow
Length of output: 1081
🏁 Script executed:
# Get exact context around lines 84-94
sed -n '80,95p' docker/build_and_push.DockerfileRepository: langflow-ai/langflow
Length of output: 926
🌐 Web query:
Node.js official distribution SHASUMS256.txt verification downloads
💡 Result:
Where to download the official checksum files (per release)
For a specific Node.js version vX.Y.Z, the official artifacts live in the release directory, which includes:
SHASUMS256.txt(SHA-256 checksums)SHASUMS256.txt.sig(GPG detached signature)- sometimes also
SHASUMS256.txt.asc(ASCII-armored signature file)
Example directory listing:.../download/release/v24.0.0/shows these files. [1]
Download + verify (recommended: verify the signed checksums, then verify your binary)
# 1) Download the Node.js binary you want + the checksum + signature
curl -O https://nodejs.org/download/release/vX.Y.Z/node-vX.Y.Z-linux-x64.tar.xz
curl -O https://nodejs.org/download/release/vX.Y.Z/SHASUMS256.txt
curl -O https://nodejs.org/download/release/vX.Y.Z/SHASUMS256.txt.sig# 2) Get trusted release signing keys (recommended source: nodejs/release-keys)
git clone https://github.com/nodejs/release-keys.git# 3) Verify SHASUMS256.txt is signed by an authorized release key
GNUPGHOME="$PWD/release-keys/gpg" gpg --verify SHASUMS256.txt.sig SHASUMS256.txt# 4) Verify your download matches the published checksum
sha256sum -c SHASUMS256.txt --ignore-missingThe gpg --verify ... flow and the checksum verification flow above are the standard Node.js instructions, and nodejs/release-keys provides a ready-to-use keyring for verification. [2] [3]
Notes
- Current/LTS releases provide the GPG signature (
SHASUMS256.txt.sig) forSHASUMS256.txt. [2] - Nightly builds may not have the same signature guarantees; always check the specific directory you’re downloading from. [2]
Sources
[1] Node.js release directory listing (example) showing SHASUMS256.txt, .sig, .asc files
[2] Node.js README “Verifying binaries” instructions (download checksums + verify with gpg + verify with sha256sum)
[3] nodejs/release-keys repository instructions for verifying release packages using the provided keyring
🏁 Script executed:
# Check if there are similar checksum verification patterns elsewhere in the codebase
rg -i "shasums\|sha256sum\|checksum" docker/Repository: langflow-ai/langflow
Length of output: 46
🏁 Script executed:
# Check the base Dockerfile to see if there are related security concerns
cat docker/build_and_push_base.Dockerfile | head -150Repository: langflow-ai/langflow
Length of output: 4458
Verify Node.js tarball integrity before extraction.
Checksum verification is missing for the downloaded Node.js tarball. Node.js releases provide SHASUMS256.txt files for this exact purpose, and integrity verification should be performed before extraction to ensure supply-chain security.
🔐 Suggested checksum verification
RUN ARCH=$(dpkg --print-architecture) \
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
else NODE_ARCH="$ARCH"; fi \
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
| grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \
| head -1) \
- && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
- | tar -xJ -C /usr/local --strip-components=1 \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
+ && grep " node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz$" SHASUMS256.txt | sha256sum -c - \
+ && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \
+ && rm -f "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" SHASUMS256.txt \
&& npm install -g npm@latest \
&& npm cache clean --force📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN ARCH=$(dpkg --print-architecture) \ | |
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | |
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | |
| else NODE_ARCH="$ARCH"; fi \ | |
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | |
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | |
| | head -1) \ | |
| && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | |
| | tar -xJ -C /usr/local --strip-components=1 \ | |
| && npm install -g npm@latest \ | |
| && npm cache clean --force | |
| RUN ARCH=$(dpkg --print-architecture) \ | |
| && if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \ | |
| elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \ | |
| else NODE_ARCH="$ARCH"; fi \ | |
| && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ | |
| | grep -oP "node-v\K[0-9]+\.[0-9]+\.[0-9]+(?=-linux-${NODE_ARCH}\.tar\.xz)" \ | |
| | head -1) \ | |
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \ | |
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ | |
| && grep " node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz$" SHASUMS256.txt | sha256sum -c - \ | |
| && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \ | |
| && rm -f "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" SHASUMS256.txt \ | |
| && npm install -g npm@latest \ | |
| && npm cache clean --force |
🤖 Prompt for AI Agents
In `@docker/build_and_push.Dockerfile` around lines 84 - 94, The Dockerfile
currently downloads and extracts the Node.js tarball without verifying
integrity; update the RUN block that sets ARCH/NODE_ARCH and computes
NODE_VERSION to also fetch the corresponding SHASUMS256.txt (from
https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt), extract the expected
SHA256 for node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz, compute the checksum
of the downloaded tarball (e.g., via sha256sum) and compare it to the expected
value, and fail/exit if they do not match (removing the bad tarball). Keep the
existing variable names (ARCH, NODE_ARCH, NODE_VERSION) and ensure the
verification step runs before the tar -xJ extraction so extraction only happens
on a successful checksum match.
| "overrides": { | ||
| "tar": "^7.5.4", | ||
| "glob": "^11.1.0", | ||
| "test-exclude": "^7.0.0" | ||
| }, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
python - <<'PY'
import json, pathlib
p = pathlib.Path("src/frontend/package-lock.json")
if not p.exists():
print("package-lock.json not found")
raise SystemExit(1)
data = json.loads(p.read_text())
pkgs = data.get("packages", {})
for name in ("tar", "glob", "test-exclude"):
v = pkgs.get(f"node_modules/{name}", {}).get("version")
if v:
print(f"{name}: {v}")
PYRepository: langflow-ai/langflow
Length of output: 96
🏁 Script executed:
#!/bin/bash
python - <<'PY'
import json, pathlib
p = pathlib.Path("src/frontend/package-lock.json")
data = json.loads(p.read_text())
pkgs = data.get("packages", {})
# Check all keys that contain "tar"
print("=== Keys containing 'tar' ===")
tar_keys = [k for k in pkgs.keys() if 'tar' in k.lower()]
for key in tar_keys:
print(f"{key}: {pkgs[key].get('version', 'N/A')}")
# Also check top-level dependencies
print("\n=== Checking dependencies section ===")
deps = data.get("dependencies", {})
if "tar" in deps:
print(f"tar in dependencies: {deps['tar']}")
PYRepository: langflow-ai/langflow
Length of output: 566
🏁 Script executed:
#!/bin/bash
cat src/frontend/package.json | grep -A 50 '"dependencies"' | grep -B 5 -A 5 '"tar"'Repository: langflow-ai/langflow
Length of output: 46
🏁 Script executed:
#!/bin/bash
cat src/frontend/package.jsonRepository: langflow-ai/langflow
Length of output: 5707
Verify npm overrides are captured in the lockfile—tar override not found.
Two of three overrides are properly locked:
glob: 11.1.0 ✓test-exclude: 7.0.1 ✓
However, tar does not appear in the lockfile at all. The override for tar@^7.5.4 has no effect because tar is not a resolved transitive dependency. Verify whether this override is necessary or should be removed.
🤖 Prompt for AI Agents
In `@src/frontend/package.json` around lines 8 - 12, The package.json overrides
block includes "tar": "^7.5.4" but the lockfile shows no resolved tar package,
so confirm whether tar is actually a transitive dependency; search dependency
tree for "tar" (e.g., npm ls tar or pnpm why tar) and if no consumer requires it
remove the "tar" override from the overrides block, otherwise update
dependencies so a package pulls in tar@^7.5.4 (or add a direct devDependency)
and then regenerate the lockfile (npm install / npm ci or pnpm install) to
ensure the override is reflected; adjust the overrides entry for "tar" only if
you find a real consumer needing that version.
| "p-debounce": "^4.0.0", | ||
| "pako": "^2.1.0", | ||
| "playwright": "^1.56.0", | ||
| "playwright": "^1.57.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Playwright 1.57.0 release notes breaking changes
💡 Result:
Playwright 1.57.0 breaking changes (from the official release notes):
- Removed accessibility API:
page.accessibility()/page.accessibility/Page#accessibilitywas removed after long deprecation; use an external tool like axe-core instead. [2][3] - URL glob patterns tightened: Glob URL patterns used by APIs like
page.route()no longer support?and[]—use a RegExp instead. [1] route.continue()can’t overrideCookieheader: Any providedCookieheader is now ignored; cookies come from the browser cookie store. UsebrowserContext.addCookies()to set cookies. [1]- macOS 13 WebKit updates deprecated: macOS 13 is deprecated for WebKit updates; upgrade macOS to keep receiving new WebKit versions. [1]
Sources: official Playwright release notes (Node) [1] and language-specific release notes highlighting the removed accessibility API [2][3].
🌐 Web query:
Vite 7.3.1 release notes breaking changes
💡 Result:
Vite v7.3.1 (released Jan 7, 2026) is a patch release, and the project does not list any breaking changes specific to 7.3.1 (the release entry points to the changelog for details, but does not call out breaking changes). [1]
If you’re upgrading to Vite 7 (from Vite 6 or earlier), the main breaking changes to account for are at the Vite 7.0 level—most notably the Node.js requirement change (Node 20.19+ / 22.12+) and the ESM-only distribution. [2] Vite also maintains a central “Breaking Changes” page for cross-version tracking; it doesn’t list anything that would indicate a new breaking change introduced specifically in 7.3.1. [3]
Sources: [1] [2] [3]
🌐 Web query:
@modelcontextprotocol/server-everything 2026.1.14 changelog breaking changes
💡 Result:
For @modelcontextprotocol/server-everything 2026.1.14 (released Jan 14, 2026), there isn’t a dedicated changelog entry or “Breaking Changes” section published for that package/version—release notes for that date only list which packages were bumped. [1]
What the release notes do say (v2026.1.14):
- Updated packages:
@modelcontextprotocol/[email protected]@modelcontextprotocol/[email protected][email protected][1]
Breaking changes: none are explicitly documented for @modelcontextprotocol/[email protected] in the published release notes. [1]
Sources: [1] (github.com) [2] (jsdelivr.com)
Citations:
- 1: https://github.com/modelcontextprotocol/servers/releases/tag/2026.1.14
- 2: https://www.jsdelivr.com/package/npm/%40modelcontextprotocol/server-everything?utm_source=openai
Review Playwright 1.57.0 for breaking changes.
Playwright 1.57.0 introduces breaking changes:
- Removed
page.accessibility()API—use an external tool like axe-core instead - URL glob patterns in
page.route()no longer support?and[]—use RegExp instead route.continue()can no longer override theCookieheader—usebrowserContext.addCookies()instead- macOS 13 is deprecated for WebKit updates
Confirm the codebase handles these changes. Vite 7.3.1 is a patch release with no breaking changes. @modelcontextprotocol/server-everything 2026.1.14 has no documented breaking changes.
Also applies to: 143-145, 175-175
🤖 Prompt for AI Agents
In `@src/frontend/package.json` at line 71, The dependency upgrade to
"playwright": "^1.57.0" can introduce breaking changes—search the codebase for
usages of page.accessibility(), page.route( with glob patterns), and
route.continue( to ensure no code relies on removed page.accessibility(), that
page.route() glob patterns don't use ? or [] (convert those patterns to RegExp
in places where page.route( is called), and that no code expects
route.continue() to override the Cookie header (replace such logic with
browserContext.addCookies() calls). Also run WebKit tests on macOS >=14 or
adjust test targets if you rely on macOS 13. If these changes are unacceptable,
consider pinning or downgrading "playwright" in package.json or add targeted
code changes where the symbols page.accessibility, page.route, route.continue,
and browserContext.addCookies are referenced.
bringing over the 1.7.3 securty patch changes to main. There have already been a few of changes since 1.7.3 release that break cherrypicking/merging the branch directly. So I am creating a fully new branch to go over the security vulnerabilities using the nightlies in the same way I did for 1.7.3 to make sure we catch them all.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.