✓ No known CVEs patched
This release patches 1 known CVE
Topics
analytics
autogen
evaluation
langchain
large-language-models
llama-index
+12 more
llm
llm-evaluation
llm-observability
llmops
monitoring
observability
openai
playground
prompt-engineering
prompt-management
self-hosted
ycombinator
Summary
AI summarySelf-service SSO config supports DNS‑verified domains.
Full changelog
What's Changed
Features
- feat(experiments): show metadata in overview by @wochinge in https://github.com/langfuse/langfuse/pull/13456
- feat(worker): add secondary otel ingestion queue by @Steffen911 in https://github.com/langfuse/langfuse/pull/13490
- feat(sso): self-service SSO config with DNS-verified domains by @marksalpeter in https://github.com/langfuse/langfuse/pull/13507
Fixes / Improvements
- fix(evals): do not drop langfuseObject on config on template upgrades by @hassiebp in https://github.com/langfuse/langfuse/pull/13429
- fix(evals): validate evaluator mapping target server-side by @hassiebp in https://github.com/langfuse/langfuse/pull/13430
- fix(batch-actions): compute count subject to searchQuery and searchType by @marliessophie in https://github.com/langfuse/langfuse/pull/13441
- fix(web): Improve toast title for
ClickHouseResourceErrorerrors by @bezbac in https://github.com/langfuse/langfuse/pull/13373 - fix(organizations): add margin to separator when no project is selected by @bezbac in https://github.com/langfuse/langfuse/pull/13445
- fix(widgets): render latency metrics in scaled units in custom dashboard widgets by @marksalpeter in https://github.com/langfuse/langfuse/pull/13242
- fix(web): include today in Prompts table observation count window by @jannikmaierhoefer in https://github.com/langfuse/langfuse/pull/13415
- fix(worker): keep spend alert billing skips healthy by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13467
- fix(docker): remove corepack cache from runtime-base stage by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13470
- fix(evals): add evaluator filter validation and handling by @marliessophie in https://github.com/langfuse/langfuse/pull/13474
- fix(web): Prisma also returns "Unique constraint failed", so check lowercase string by @deejay1 in https://github.com/langfuse/langfuse/pull/13477
- fix(events): stringify batchIO metadata for tRPC by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13457
- fix(trace-ui): prevent image flicker on validateImgUrl false by @seokjin0414 in https://github.com/langfuse/langfuse/pull/13440
- fix(shared): harden outbound URL validation against SSRF bypasses by @wochinge in https://github.com/langfuse/langfuse/pull/13485
- fix(web): Saved views UX improvements by @bezbac in https://github.com/langfuse/langfuse/pull/13454
- fix(scim): write audit log on user creation via SCIM POST by @Steffen911 in https://github.com/langfuse/langfuse/pull/13496
- fix(public-api): rate-limit project apiKeys admin and prompt POST by @Steffen911 in https://github.com/langfuse/langfuse/pull/13498
- fix(traces): Create synthetic traces from events consistently by @bezbac in https://github.com/langfuse/langfuse/pull/13450
- fix(worker): preserve encrypted webhook headers on disable by @wochinge in https://github.com/langfuse/langfuse/pull/13503
- fix(web): validate image URL redirects by @wochinge in https://github.com/langfuse/langfuse/pull/13501
- fix(projects): persist parsed metadata on project create/update by @Steffen911 in https://github.com/langfuse/langfuse/pull/13497
- fix(web): remove Request Chart button from home screen by @marliessophie in https://github.com/langfuse/langfuse/pull/13509
- fix(shared): reject DNS-failing hostnames in outbound URL validation by @wochinge in https://github.com/langfuse/langfuse/pull/13512
Chores
- chore: upgrade bullmq to 5.76.3 by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13442
- chore(deps): upgrade uuid v9 → v14 by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13443
- chore: Increase admin access webhook dedupe window to 24 hours by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13414
- refactor(model-match): remove redis parse span by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13182
- chore(web): Remove unused unified & remark dependencies by @bezbac in https://github.com/langfuse/langfuse/pull/13409
- chore(web): Remove unused
graphqldependency by @bezbac in https://github.com/langfuse/langfuse/pull/13410 - chore(deps): remove redundant @types/uuid devDependency by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13448
- chore: add migration hints for legacy public ClickHouse APIs by @maxdeichmann in https://github.com/langfuse/langfuse/pull/13475
- refactor(web): Create new design system dir & extract
Spinnerby @bezbac in https://github.com/langfuse/langfuse/pull/13428 - chore(deps): web - build migrate binary with Go 1.26 by @vkael in https://github.com/langfuse/langfuse/pull/13486
- chore(deps): bump posthog 5.32 / 1.372 by @nimarb in https://github.com/langfuse/langfuse/pull/13487
- chore: Create eslint plugin package by @bezbac in https://github.com/langfuse/langfuse/pull/13444
- chore(web): Setup in-source testing with Vitest by @bezbac in https://github.com/langfuse/langfuse/pull/13484
- chore(deps): bump ip-addresses to 10.2.0 by @nimarb in https://github.com/langfuse/langfuse/pull/13505
- chore(deps): bump nextjs to 16.2.6 by @nimarb in https://github.com/langfuse/langfuse/pull/13516
- ci: harden prettier check file arguments by @wochinge in https://github.com/langfuse/langfuse/pull/13513
New Contributors
- @vkael made their first contribution in https://github.com/langfuse/langfuse/pull/13486
- @seokjin0414 made their first contribution in https://github.com/langfuse/langfuse/pull/13440
Full Changelog: https://github.com/langfuse/langfuse/compare/v3.172.1...v3.173.0
Security Fixes
- Hardened outbound URL validation against SSRF bypasses and rejected DNS‑failing hostnames
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About langfuse
🪢 Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, playground, datasets. Integrates with OpenTelemetry, Langchain, OpenAI SDK, LiteLLM, and more. YC W23
Related context
Related tools
Beta — feedback welcome: [email protected]