GitHub Repo
Langflow 1.12.10 Updates Container Dependencies, Strengthens Brotli and npm Package Checks
Released on November 5, Langflow 1.12.10 backports security updates for container images and Python and npm dependencies. The fixes have been merged and partially tested, but a final image rebuild and scan, as well as confirmation that some packages are fully fixed, are still needed.
On November 5, Langflow released 1.12.10, backporting two dependency security fixes to the 1.12 series. For teams self-hosting this AI workflow and agent framework, the update affects the runtime environment: alongside Python packages, it addresses Node.js, bundled npm packages, and native compression libraries in containers. Release announcement
The first fix pins Node.js to 24.22.2 in three runtime Dockerfiles and raises the minimum versions for Python dependencies including Brotli and PyArrow. The DuckDuckGo integration also requires patched Brotli for each interpreter, because HTTPX prefers that package even in PyPy environments. Updating only the CFFI fallback implementation could leave the old decompression path in place. Fix details
Assessing native dependency versions is another focus of this update. Langflow uses PyArrow 26.0.1, and Apache’s official changelog confirms that this release updated bundled Brotli to 1.2.1 for bundled, vcpkg, and R Windows builds. Maintainers said that if scan data still requires PyArrow 27.0.0, its version threshold should be checked. This highlights the need for engineering teams to trace the native libraries actually packaged with a dependency when evaluating scan results. Apache Arrow release notes
The second fix addresses glob and minimatch bundled with npm. It replaces the package copies and updates the version declarations of their consumers so the dependency tree continues to pass validation. The author reported that 84 dependency and Docker configuration tests passed, and ran local smoke tests covering offline installation, npx, and recursive package version checks. However, an automated review in the PR also questioned whether the selected versions fully fix the issues. That feedback is not, by itself, a definitive vulnerability finding, so the fix’s effectiveness still needs further verification. npm fix and review
Deployment teams should next verify the package inventory in the final images and rerun their own workflows and security scans. The PR still lists a full image rebuild, rescanning, and other unresolved dependency items, so the release confirms that fixes have shipped but does not establish that all container vulnerabilities have been eliminated. Verification limitations