SIGN IN SIGN UP
langflow-ai / langflow UNCLAIMED

Langflow is a powerful tool for building and deploying AI-powered agents and workflows.

0 0 1 Python

fix: Updates the CI workflow to handle known dependency conflicts. (#12691)

* fix: upgrade playwright to 1.58.0 to address Chromium CVEs

- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
  CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches

* fix: update npm to latest version to address brace-expansion CVE-2026-33750

- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool

* revert: remove npm update from Dockerfile

- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)

* CI: Filter cuga/playwright dependency conflict in release workflow

- Filter cuga/playwright conflict (we override playwright>=1.58.0 for CVE fixes)
- Still fails CI if other genuine dependency issues are detected
- Applied to both base and main package build steps

---------

Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
J
Janardan Singh Kavia committed
9029c4b61e6c4e08449be529270b02c099b8ef3d
Parent: 68a8990
Committed by GitHub <noreply@github.com> on 4/14/2026, 3:29:28 PM