chore(deps): update dependency langchain to v0.1.0 [security] #1297
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![plural-renovate[bot]](https://avatars.githubusercontent.com/in/259360?s=60&v=4){kind=small}
plural-renovate
bot
added
the
dependencies
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
2 times, most recently
from
db2ebdf to
6d68f02
Compare
plural-renovate
bot
changed the title
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
6d68f02 to
e4c3704
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
e4c3704 to
fff8944
Compare
plural-renovate
bot
changed the title
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
2 times, most recently
from
7e144b8 to
44fd267
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
44fd267 to
7ca2bb4
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
7ca2bb4 to
8b91e96
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
4 times, most recently
from
215d1c9 to
c3c1439
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
2 times, most recently
from
cf07268 to
b843ed9
Compare
plural-renovate
bot
force-pushed
the
renovate/pypi-langchain-vulnerability
branch
from
b843ed9 to
f9dd351
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.0.329->==0.1.0GitHub Vulnerability Alerts
CVE-2024-0243
With the following crawler configuration:
An attacker in control of the contents of
https://example.comcould place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even thoughprevent_outside=True.https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51
Resolved in https://github.com/langchain-ai/langchain/pull/15559
CVE-2024-28088
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.
CVE-2024-3571
langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.
Release Notes
langchain-ai/langchain (langchain)
v0.1.0Compare Source
What's Changed
by @efriis in https://github.com/langchain-ai/langchain/pull/15611
New Contributors
Full Changelog: langchain-ai/langchain@v0.0.354...v0.1.0
v0.0.354Compare Source
What's Changed
CallbackManager, missing])by @yhzhu99 in https://github.com/langchain-ai/langchain/pull/15380tracing_v2_enabledby @chyroc in https://github.com/langchain-ai/langchain/pull/15308microsoftpages sort order fix by @leo-gan in https://github.com/langchain-ai/langchain/pull/14771gpt4all.mdxdoc by @169 in https://github.com/langchain-ai/langchain/pull/15392utilsby @leo-gan in https://github.com/langchain-ai/langchain/pull/15432Microsoftplatform page update by @leo-gan in https://github.com/langchain-ai/langchain/pull/15420_get_python_replby @169 in https://github.com/langchain-ai/langchain/pull/15389score_thresholdin SupabaseVectorStore similarity search by @codehound42 in https://github.com/langchain-ai/langchain/pull/14439wasm_chatby @apepkuss in https://github.com/langchain-ai/langchain/pull/14787llms.Mlflowexample by @harupy in https://github.com/langchain-ai/langchain/pull/14386Paramsby @harupy in https://github.com/langchain-ai/langchain/pull/14385New Contributors
Full Changelog: langchain-ai/langchain@v0.0.353...v0.0.354
v0.0.353Compare Source
What's Changed
alibaba cloudby @leo-gan in https://github.com/langchain-ai/langchain/pull/14772Upstash Redis Cachesection of LLM Ca… by @cyai in https://github.com/langchain-ai/langchain/pull/15140Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.