Update dependency langchain to v0.2.5 [SECURITY] #29
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's Guide by SourceryThis PR updates the langchain dependency from version 0.1.4 to 0.2.5 to address a security vulnerability (CVE-2024-2965) in the SitemapLoader component. The vulnerability could allow denial of service attacks through infinite recursion in sitemap parsing. No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.1.4->==0.2.5GitHub Vulnerability Alerts
CVE-2024-2965
Denial of service in
SitemapLoaderDocument Loader in thelangchain-communitypackage, affecting versions below 0.2.5. Theparse_sitemapmethod, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.CVE-2024-8309
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
Release Notes
langchain-ai/langchain (langchain)
v0.1.16Compare Source
What's Changed
_load_sql_databse_chainby @B-Step62 in https://github.com/langchain-ai/langchain/pull/19908New Contributors
Full Changelog: langchain-ai/langchain@v0.1.15...v0.1.16
v0.1.15Compare Source
What's Changed
afrom_texts&afrom_embeddingsby @crispyricepc in https://github.com/langchain-ai/langchain/pull/20009LocalFileStoreto allow directory/file permissions to be specified by @chrispy-snps in https://github.com/langchain-ai/langchain/pull/18857graphsupdate by @leo-gan in https://github.com/langchain-ai/langchain/pull/19675integrations/providersupdate 10 by @leo-gan in https://github.com/langchain-ai/langchain/pull/19970integrations/providers/unstructuredupdate by @leo-gan in https://github.com/langchain-ai/langchain/pull/19892integrations/providersupdate 9 by @leo-gan in https://github.com/langchain-ai/langchain/pull/19941cross_encodersflatten namespaces by @leo-gan in https://github.com/langchain-ai/langchain/pull/20183ElasticsearchStore.BM25RetrievalStrategyby @g-votte in https://github.com/langchain-ai/langchain/pull/20098New Contributors
Full Changelog: langchain-ai/langchain@v0.1.14...v0.1.15
v0.1.14Compare Source
What's Changed
by @efriis in https://github.com/langchain-ai/langchain/pull/19452
api_docs_cleanfix by @leo-gan in https://github.com/langchain-ai/langchain/pull/19405Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.