-
Notifications
You must be signed in to change notification settings - Fork 0
chore(deps): update dependency langchain to v0.0.329 [security] #23
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8b49e32 to
2a69c9f
Compare
2a69c9f to
06729fe
Compare
06729fe to
84ee9e2
Compare
84ee9e2 to
2039b9e
Compare
2039b9e to
79e69ae
Compare
79e69ae to
6f46c6e
Compare
6f46c6e to
19a4738
Compare
19a4738 to
687679d
Compare
687679d to
29ab50c
Compare
29ab50c to
29a7311
Compare
29a7311 to
37849f0
Compare
37849f0 to
49cdbed
Compare
49cdbed to
8778a47
Compare
8778a47 to
7e3329e
Compare
7e3329e to
aeb124d
Compare
aeb124d to
e10f8af
Compare
e10f8af to
d097ccd
Compare
3436f1a to
b5671db
Compare
b5671db to
014a7ea
Compare
014a7ea to
6196305
Compare
6196305 to
b99ea0e
Compare
benoutram
approved these changes
Dec 7, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.0.267->==0.0.329GitHub Vulnerability Alerts
CVE-2023-39631
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
Patches: Released in v.0.0.308. numexpr dependency is optional for langchain.
CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the
load_promptparameter. This is related to__subclasses__or a template.CVE-2023-46229
LangChain before 0.0.317 allows SSRF via
document_loaders/recursive_url_loader.pybecause crawling can proceed from an external server to an internal server.CVE-2023-39659
An issue in langchain langchain-ai before version 0.0.325 allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
CVE-2023-32786
In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
Release Notes
langchain-ai/langchain (langchain)
v0.0.329Compare Source
What's Changed
ruff formatinstead of black for code formatting. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12585actions/checkout@v4in the docs lint job. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12581print()statements which seemed leftover from debugging. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12648rufffor both linting and formatting inlangchain-cli. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12672templateswith ruff v0.1.3. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12676YahooFinanceNewsToolby @leo-gan in https://github.com/langchain-ai/langchain/pull/12665_test_release.ymlworkflow. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12668blackcaching config from CI lint workflow. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12594ruffautoformatter. by @obi1kenobi in https://github.com/langchain-ai/langchain/pull/12691New Contributors
CVEs
CVE-2023-32786 -- resolved by APIChain add restrictions to domains (GHSA-6h8p-4hx9-w66c) by @eyurtsev in https://github.com/langchain-ai/langchain/pull/12747
Full Changelog: langchain-ai/langchain@v0.0.327...v0.0.329
v0.0.327Compare Source
What's Changed
poetry lock --no-updatefor all templates by @dqbd in https://github.com/langchain-ai/langchain/pull/12531New Contributors
Full Changelog: langchain-ai/langchain@v0.0.326...v0.0.327
v0.0.326Compare Source
What's Changed
_dalle_image_urlreturns list of urls if n>1 by @silvhua in https://github.com/langchain-ai/langchain/pull/11800New Contributors
Full Changelog: langchain-ai/langchain@v0.0.325...v0.0.326
v0.0.325Compare Source
What's Changed
New Contributors
CVEs
CVE-2023-39659 resolved in https://github.com/langchain-ai/langchain/pull/12427
Full Changelog: langchain-ai/langchain@v0.0.324...v0.0.325
v0.0.324Compare Source
What's Changed
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.