Skip to content

langfuse

v3.173.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 26d Tracing
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

analytics autogen evaluation langchain large-language-models llama-index
+12 more
llm llm-evaluation llm-observability llmops monitoring observability openai playground prompt-engineering prompt-management self-hosted ycombinator

Summary

AI summary

Self-service SSO config supports DNS‑verified domains.

Full changelog

What's Changed

Features

  • feat(experiments): show metadata in overview by @wochinge in https://github.com/langfuse/langfuse/pull/13456
  • feat(worker): add secondary otel ingestion queue by @Steffen911 in https://github.com/langfuse/langfuse/pull/13490
  • feat(sso): self-service SSO config with DNS-verified domains by @marksalpeter in https://github.com/langfuse/langfuse/pull/13507

Fixes / Improvements

  • fix(evals): do not drop langfuseObject on config on template upgrades by @hassiebp in https://github.com/langfuse/langfuse/pull/13429
  • fix(evals): validate evaluator mapping target server-side by @hassiebp in https://github.com/langfuse/langfuse/pull/13430
  • fix(batch-actions): compute count subject to searchQuery and searchType by @marliessophie in https://github.com/langfuse/langfuse/pull/13441
  • fix(web): Improve toast title for ClickHouseResourceError errors by @bezbac in https://github.com/langfuse/langfuse/pull/13373
  • fix(organizations): add margin to separator when no project is selected by @bezbac in https://github.com/langfuse/langfuse/pull/13445
  • fix(widgets): render latency metrics in scaled units in custom dashboard widgets by @marksalpeter in https://github.com/langfuse/langfuse/pull/13242
  • fix(web): include today in Prompts table observation count window by @jannikmaierhoefer in https://github.com/langfuse/langfuse/pull/13415
  • fix(worker): keep spend alert billing skips healthy by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13467
  • fix(docker): remove corepack cache from runtime-base stage by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13470
  • fix(evals): add evaluator filter validation and handling by @marliessophie in https://github.com/langfuse/langfuse/pull/13474
  • fix(web): Prisma also returns "Unique constraint failed", so check lowercase string by @deejay1 in https://github.com/langfuse/langfuse/pull/13477
  • fix(events): stringify batchIO metadata for tRPC by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13457
  • fix(trace-ui): prevent image flicker on validateImgUrl false by @seokjin0414 in https://github.com/langfuse/langfuse/pull/13440
  • fix(shared): harden outbound URL validation against SSRF bypasses by @wochinge in https://github.com/langfuse/langfuse/pull/13485
  • fix(web): Saved views UX improvements by @bezbac in https://github.com/langfuse/langfuse/pull/13454
  • fix(scim): write audit log on user creation via SCIM POST by @Steffen911 in https://github.com/langfuse/langfuse/pull/13496
  • fix(public-api): rate-limit project apiKeys admin and prompt POST by @Steffen911 in https://github.com/langfuse/langfuse/pull/13498
  • fix(traces): Create synthetic traces from events consistently by @bezbac in https://github.com/langfuse/langfuse/pull/13450
  • fix(worker): preserve encrypted webhook headers on disable by @wochinge in https://github.com/langfuse/langfuse/pull/13503
  • fix(web): validate image URL redirects by @wochinge in https://github.com/langfuse/langfuse/pull/13501
  • fix(projects): persist parsed metadata on project create/update by @Steffen911 in https://github.com/langfuse/langfuse/pull/13497
  • fix(web): remove Request Chart button from home screen by @marliessophie in https://github.com/langfuse/langfuse/pull/13509
  • fix(shared): reject DNS-failing hostnames in outbound URL validation by @wochinge in https://github.com/langfuse/langfuse/pull/13512

Chores

  • chore: upgrade bullmq to 5.76.3 by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13442
  • chore(deps): upgrade uuid v9 → v14 by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13443
  • chore: Increase admin access webhook dedupe window to 24 hours by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13414
  • refactor(model-match): remove redis parse span by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13182
  • chore(web): Remove unused unified & remark dependencies by @bezbac in https://github.com/langfuse/langfuse/pull/13409
  • chore(web): Remove unused graphql dependency by @bezbac in https://github.com/langfuse/langfuse/pull/13410
  • chore(deps): remove redundant @types/uuid devDependency by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13448
  • chore: add migration hints for legacy public ClickHouse APIs by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13475
  • refactor(web): Create new design system dir & extract Spinner by @bezbac in https://github.com/langfuse/langfuse/pull/13428
  • chore(deps): web - build migrate binary with Go 1.26 by @vkael in https://github.com/langfuse/langfuse/pull/13486
  • chore(deps): bump posthog 5.32 / 1.372 by @nimarb in https://github.com/langfuse/langfuse/pull/13487
  • chore: Create eslint plugin package by @bezbac in https://github.com/langfuse/langfuse/pull/13444
  • chore(web): Setup in-source testing with Vitest by @bezbac in https://github.com/langfuse/langfuse/pull/13484
  • chore(deps): bump ip-addresses to 10.2.0 by @nimarb in https://github.com/langfuse/langfuse/pull/13505
  • chore(deps): bump nextjs to 16.2.6 by @nimarb in https://github.com/langfuse/langfuse/pull/13516
  • ci: harden prettier check file arguments by @wochinge in https://github.com/langfuse/langfuse/pull/13513

New Contributors

  • @vkael made their first contribution in https://github.com/langfuse/langfuse/pull/13486
  • @seokjin0414 made their first contribution in https://github.com/langfuse/langfuse/pull/13440

Full Changelog: https://github.com/langfuse/langfuse/compare/v3.172.1...v3.173.0

Security Fixes

  • Hardened outbound URL validation against SSRF bypasses and rejected DNS‑failing hostnames

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track langfuse

Get notified when new releases ship.

Sign up free

About langfuse

🪢 Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, playground, datasets. Integrates with OpenTelemetry, Langchain, OpenAI SDK, LiteLLM, and more. YC W23

All releases →

Related context

Beta — feedback welcome: [email protected]