Skip to content

langfuse

v3.224.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3d Tracing
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

analytics autogen evaluation langchain large-language-models llama-index
+12 more
llm llm-evaluation llm-observability llmops monitoring observability openai playground prompt-engineering prompt-management self-hosted ycombinator

Affected surfaces

auth

Summary

AI summary

Broad release touches Chores, deps, otel, and worker.

Full changelog

What's Changed

Features

  • feat(preview): enable cloud AI features on PR previews by @LysanderKie in https://github.com/langfuse/langfuse/pull/15264
  • feat(api): reject dataset-run-item surface in events_only mode by @Steffen911 in https://github.com/langfuse/langfuse/pull/15313
  • feat(otel): expose uploaded media bytes by @hassiebp in https://github.com/langfuse/langfuse/pull/15354
  • feat(search-bar): detangle Ask AI system prompt from injected context (LFE-11003) by @nkabardin in https://github.com/langfuse/langfuse/pull/15292

Fixes

  • fix(worker): bound media retention cleanup batches by @sumerman in https://github.com/langfuse/langfuse/pull/15226
  • fix(security): mask analytics integration credentials in get endpoints (LFE-14384) by @niklassemmler in https://github.com/langfuse/langfuse/pull/15296
  • fix(worker): route analytics score-export trace enrichment by v4 write mode (LFE-11009) by @niklassemmler in https://github.com/langfuse/langfuse/pull/15298
  • fix(agent): Instrument user info on in-app agent requests by @bezbac in https://github.com/langfuse/langfuse/pull/15317
  • fix(otel): decode Python bytes media by @hassiebp in https://github.com/langfuse/langfuse/pull/15347
  • fix(filter-sidebar): always show Clear when a filter is active (LFE-14402) by @nkabardin in https://github.com/langfuse/langfuse/pull/15314

Chores

  • chore(pricing): add gemini-3.6-flash and gemini-3.5-flash-lite pricing by @langfuse-bot in https://github.com/langfuse/langfuse/pull/15285
  • revert(deploy): remove ECS task_arn DD_TAGS tagging (LFE-11028) by @niklassemmler in https://github.com/langfuse/langfuse/pull/15335
  • chore(pricing): remove invalid cache pricing from gemini-3.5-flash-lite by @langfuse-bot in https://github.com/langfuse/langfuse/pull/15340
  • chore(deps): bump fast-uri to 3.1.4 by @nimarb in https://github.com/langfuse/langfuse/pull/15355
  • chore(deps): bump @vitest/browser to 4.1.10 by @nimarb in https://github.com/langfuse/langfuse/pull/15356
  • chore(deps): bump next to 16.2.11 by @nimarb in https://github.com/langfuse/langfuse/pull/15358
  • chore(deps): bump turbo to 2.10.5 by @nimarb in https://github.com/langfuse/langfuse/pull/15360
  • chore(deps): bump hono to 4.12.27 by @nimarb in https://github.com/langfuse/langfuse/pull/15363
  • chore(deps): bump dompurify to 3.4.12 by @nimarb in https://github.com/langfuse/langfuse/pull/15364

Full Changelog: https://github.com/langfuse/langfuse/compare/v3.224.0...v3.224.1

Security Fixes

  • Mask analytics integration credentials in get endpoints (LFE-14384)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track langfuse

Get notified when new releases ship.

Sign up free

About langfuse

🪢 Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, playground, datasets. Integrates with OpenTelemetry, Langchain, OpenAI SDK, LiteLLM, and more. YC W23

All releases →

Related context

Beta — feedback welcome: [email protected]