langflow v1.12.7 — 1.12.7

Ten of the sixteen changes in Langflow 1.12.7 are labelled security fixes, and the largest group tightens one specific check: the scanner Langflow runs over generated component code before that code is turned into a component. The scanner, scan_code_security, reads the code's syntax tree, follows imports and the aliases they are assigned to, and rejects calls and modules on its forbidden lists. Three pull requests extend those lists. #15758 adds source runners and package tooling such as runpy, pip, venv and setuptools, site-package loaders, torch.load, process pools and process signals. #15873 blocks using the garbage collector to recover objects from the running server process. #15879 blocks further runtime loaders and byte-level environment access through os.environb, os.getenvb and os.get_exec_path. A test in the first of these checks that code importing runpy is rejected before any component is constructed.

Two of those pull requests also close the same gap in how the scanner tracks names. Their commit messages explain that when a class was defined inside a function and a name was deleted in the class body, the scanner restored names from the function's scope, while Python actually looks them up in module globals. A local variable could therefore hide a module-level alias for gc or os from every check, so calls such as os.system could pass the scan and still reach the real module when run. The fix records module-level aliases on entry to the outermost function and adds regression tests for those shapes.

The other security-related changes each address a narrower path, judging by their titles and commits. Public flows, which anonymous visitors can run, now honor the admin-only custom-component policy before building, because public execution never carries administrator rights (#15874). On deployments served under a URL prefix, the saved store API key cookie had been set without a path, which made it visible to sibling Langflow instances on the same hostname; it is now scoped like the login cookie (#15880). Graph overrides by someone other than a flow's owner now require shared write authorization and fall back to the stored graph if the authorization check itself fails. The OpenSearch connector validates URLs, with tests named for server-side request forgery, and the S3 uploader scopes which original files it can upload. The release notes do not say whether any of these was reported or exploited in practice.