Starstruk Logo MarkStarstruk

v1.10.3

nextjs/saas-starterv1.10.3Jul 23, 2026by github-actions[bot]

AI Summary

A security-focused release that hardens the platform against various vulnerabilities including component code bypasses, MCP stdio execution, and SQL runtime configuration. It also resolves Docker build issues and deprecated model settings.

Key Highlights

  • Extensive security hardening (Docling, MCP stdio, FFI, SQL)
  • Fix broken npm self-upgrade in Docker
  • Verify current password on password changes
  • Compare API keys in constant time
  • Rate limit public flow builds

New Features

  • Security hardening updates

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v1.10.3 -->

## What's Changed
### 🐛 Bug Fixes
* fix(docker): remove broken npm self-upgrade by @erichare in https://github.com/langflow-ai/langflow/pull/14052
* fix(security): protect Docling Serve outbound requests by @erichare in https://github.com/langflow-ai/langflow/pull/14033
* fix(auth): verify current password on password changes by @erichare in https://github.com/langflow-ai/langflow/pull/14034
* fix(security): harden MCP stdio configuration by @erichare in https://github.com/langflow-ai/langflow/pull/14036
* fix(security): harden component code module access by @erichare in https://github.com/langflow-ai/langflow/pull/14032
* fix: correct deprecated model settings behavior by @erichare in https://github.com/langflow-ai/langflow/pull/14047
* fix(voice): enforce flow authorization on websocket by @erichare in https://github.com/langflow-ai/langflow/pull/14043
* fix(security): block native FFI imports in generated code by @erichare in https://github.com/langflow-ai/langflow/pull/14040
* fix(security): confine AssemblyAI audio file access by @erichare in https://github.com/langflow-ai/langflow/pull/14037
* fix: track assignment aliases in component code scanner by @erichare in https://github.com/langflow-ai/langflow/pull/14041
* fix(kb): enforce per-user component path containment by @erichare in https://github.com/langflow-ai/langflow/pull/14065
* fix(security): consolidate release-1.10.3 hardening backports by @erichare in https://github.com/langflow-ai/langflow/pull/14071
* fix(security): protect SQL runtime configuration by @erichare in https://github.com/langflow-ai/langflow/pull/14076
* fix(kb): enforce server-owned folder connector limits by @erichare in https://github.com/langflow-ai/langflow/pull/14039
* fix(lfx): deduplicate Google embedding model aliases by @erichare in https://github.com/langflow-ai/langflow/pull/14081
* fix: expose stable Langfuse trace IO for evaluators by @erichare in https://github.com/langflow-ai/langflow/pull/14087
* fix(voice): preserve public flow websocket access by @erichare in https://github.com/langflow-ai/langflow/pull/14097
* fix(security): require docker run for MCP stdio by @erichare in https://github.com/langflow-ai/langflow/pull/14122
* fix(security): block indirect component code bypasses by @erichare in https://github.com/langflow-ai/langflow/pull/14121
* fix(security): close remaining indirect code bypasses (1.10.3) by @erichare in https://github.com/langflow-ai/langflow/pull/14132
* fix(security): compare API keys in constant time by @erichare in https://github.com/langflow-ai/langflow/pull/14127
* fix(security): redact secret component inputs from traces by @erichare in https://github.com/langflow-ai/langflow/pull/14128
* fix(security): bind MCP SSE sessions to users by @erichare in https://github.com/langflow-ai/langflow/pull/14129
* fix(security): default access token cookie to HttpOnly by @erichare in https://github.com/langflow-ai/langflow/pull/14131
* fix(security): rate limit public flow builds (1.10.3) by @erichare in https://github.com/langflow-ai/langflow/pull/14134
* fix(security): isolate lfx serve request logs by @erichare in https://github.com/langflow-ai/langflow/pull/14130
* fix(security): bind MCP stdio to code-exec lockdown by @erichare in https://github.com/langflow-ai/langflow/pull/14149
### ✅ Tests
* test(mcp): isolate timeout tests from SSRF validation by @erichare in https://github.com/langflow-ai/langflow/pull/14075
### Others
* chore: bump versions by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14077


**Full Changelog**: https://github.com/langflow-ai/langflow/compare/v1.10.2...v1.10.3