IBM Patches 25 Langflow Flaws, Including Critical Dependency Confusion Bug

·6 views

IBM has issued a security bulletin covering 25 vulnerabilities in Langflow OSS versions 1.0.0 through 1.12.2. Two are rated critical and include a dependency confusion flaw (CVE-2026-93675) and injection issues that require no login or user action. Most remaining flaws affect authenticated users and can enable sandbox escapes or deserialization abuse. IBM reports no known exploitation in the wild and recommends upgrading to Langflow 1.12.3. Until patched, operators should restrict internet exposure, limit flow editing permissions, and rotate stored credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Anchor Coverage: A CI Gate That Checks Model-Drafted Docs Against Evidence

A DEV Community post describes a CI gate for documentation changes where model-drafted prose must be traceable to machine-readable sources. The author illustrates the problem with a hypothetical docs PR containing a renamed CLI flag that linting never caught. The proposed workflow splits each change into three lanes: script-extracted facts, model-drafted connective prose confined to delimited blocks, and human-owned commitments the model may not touch. A Python script, anchor_gate.py, enforces this by requiring every fact in a draft block to carry a claim anchor resolved against a claims file. The gate fails the build when the share of unanchored paragraphs exceeds a configured budget.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Argo CD rollback: choosing between git revert and argocd app rollback

A bad image tag merged at 16:50 and auto-sync deployed it, causing 500 errors in the checkout service. Teams facing this must pick between reverting the commit in Git or running an Argo CD rollback directly against the cluster. Both approaches work but differ in how they interact with auto-sync, audit trails, and later fixes. The right choice depends on sync policy, branch protection rules, the scope of affected applications, and whether stateful changes such as migrations are involved. Because sync and history behavior has changed across Argo CD releases, the article advises checking the official documentation for the installed version.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code's allow_large setting: how to read large files without truncation

A guide explains how Claude Code handles oversized file reads and why a read can appear successful while only covering the beginning of a file. Per a Claude Code docs issue, this partial-view behavior arrived around version 2.1.145. Previously, reading an oversized file in full failed with a 'file content exceeds maximum allowed tokens' error, which older tutorials still reference. The guide recommends searching when the target is known, using offset and limit to read specific sections, and using allow_large when the whole file is needed and fits. For heavy reading where only conclusions matter, it suggests delegating to a subagent with its own context window.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Token-heavy spans and slow spans differ in agent runs, so trace ledgers need both rankings

A developer on DEV Community argues that the span that uses the most tokens in an agent run is often not the one that takes the longest. Standard trace viewers sort spans by start time, which hides the cost picture an operator needs. The proposed fix is a per-run span ledger built from six core fields, including token counts logged per span and a retry marker. The author supplies a sample six-span fixture containing a retried tool call and a slow test step, along with a Python script that reads and orders the spans. The approach also adds a deterministic budget breaker that can be tested, so runs halt before exhausting their allowance.

0 comments Read more at DEV Community