chore(deps): update dependency langchain to v0.0.329 [security] #1267
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![plural-renovate[bot]](https://avatars.githubusercontent.com/in/259360?s=60&v=4){kind=small}
plural-renovate
bot
added
the
dependencies
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
5442201 to
04899f2
Compare
plural-renovate
bot
changed the title
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
2 times, most recently
from
93623ac to
56b7e93
Compare
plural-renovate
bot
changed the title
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
5 times, most recently
from
c74f1ed to
7a56bc4
Compare
plural-renovate
bot
changed the title
plural-renovate
bot
deleted the
renovate/pypi-langchain-vulnerability
branch
plural-renovate
bot
changed the title
plural-renovate
bot
restored the
renovate/pypi-langchain-vulnerability
branch
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
2 times, most recently
from
71d2232 to
0166bbd
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
4 times, most recently
from
568adec to
148af90
Compare
michaeljguarino
approved these changes
Jan 5, 2024
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
148af90 to
18a4054
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.0.312->==0.0.329GitHub Vulnerability Alerts
CVE-2023-46229
LangChain before 0.0.317 allows SSRF via
document_loaders/recursive_url_loader.pybecause crawling can proceed from an external server to an internal server.CVE-2023-39659
An issue in langchain langchain-ai before version 0.0.325 allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
CVE-2023-32786
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Release Notes
langchain-ai/langchain (langchain)
v0.0.329Compare Source
What's Changed
ruff formatinstead of black for code formatting. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12585actions/checkout@v4in the docs lint job. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12581print()statements which seemed leftover from debugging. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12648rufffor both linting and formatting inlangchain-cli. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12672templateswith ruff v0.1.3. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12676YahooFinanceNewsToolby @leo-gan in https://github.com/langchain-ai/langchain/pull/12665_test_release.ymlworkflow. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12668blackcaching config from CI lint workflow. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12594ruffautoformatter. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12691New Contributors
CVEs
CVE-2023-32786 -- resolved by APIChain add restrictions to domains (GHSA-6h8p-4hx9-w66c) by @eyurtsev in https://github.com/langchain-ai/langchain/pull/12747
Full Changelog: langchain-ai/langchain@v0.0.327...v0.0.329
v0.0.327Compare Source
What's Changed
poetry lock --no-updatefor all templates by @dqbd in https://github.com/langchain-ai/langchain/pull/12531New Contributors
Full Changelog: langchain-ai/langchain@v0.0.326...v0.0.327
v0.0.326Compare Source
What's Changed
_dalle_image_urlreturns list of urls if n>1 by @silvhua in https://github.com/langchain-ai/langchain/pull/11800New Contributors
Full Changelog: langchain-ai/langchain@v0.0.325...v0.0.326
v0.0.325Compare Source
What's Changed
New Contributors
CVEs
CVE-2023-39659 resolved in https://github.com/langchain-ai/langchain/pull/12427
Full Changelog: langchain-ai/langchain@v0.0.324...v0.0.325
v0.0.324Compare Source
What's Changed
New Contributors
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.