[pull] main from FlowiseAI:main

package.json

@@ -86,14 +86,20 @@
             "rollup": "4.45.0",
             "semver": "7.7.1",
             "set-value": "4.1.0",
-            "solid-js": "1.9.7",
-            "tar-fs": "3.1.0",
+            "solid-js": "1.9.11",
+            "protobufjs": ">=7.5.5",
+            "tar-fs": "3.1.1",
             "unset-value": "2.0.1",
             "webpack-dev-middleware": "7.4.2",
             "ws": "8.18.3",
             "xlsx": "0.18.5",
             "uuid": "^10.0.0",
-            "request>uuid": "^3.4.0"
+            "request>uuid": "^3.4.0",
+            "@tootallnate/once": ">=3.0.1",
+            "tmp": ">=0.2.4",
+            "@elastic/transport": ">=8.9.3",
+            "@modelcontextprotocol/sdk": ">=1.25.2",
+            "multer": ">=2.1.1"
         }
     },
     "engines": {
@@ -107,7 +113,7 @@
         "@langchain/core": "1.1.20",
         "@qdrant/openapi-typescript-fetch": "1.2.6",
         "openai": "6.19.0",
-        "protobufjs": "7.4.0",
+        "protobufjs": "7.5.5",
         "uuid": "^10.0.0"
     },
     "eslintIgnore": [

packages/components/jest.config.js

@@ -21,6 +21,10 @@ module.exports = {
         // multer-azure-blob-storage transitively pulls in azure-storage -> request@2.88.2 -> uuid/v4.
         // The uuid/v4 sub-path no longer exists in modern uuid versions, breaking module resolution.
         // Tests don't exercise Azure storage, so stubbing it out avoids the chain entirely.
-        '^multer-azure-blob-storage$': '<rootDir>/__mocks__/esm-stub.js'
+        '^multer-azure-blob-storage$': '<rootDir>/__mocks__/esm-stub.js',
+        // @tootallnate/once@3+ ships ESM-only; it is pulled in transitively by
+        // http-proxy-agent → jsdom. Jest cannot parse its `export default` syntax
+        // in the default CJS environment, so stub it out.
+        '^@tootallnate/once$': '<rootDir>/__mocks__/esm-stub.js'
     }
 }

packages/components/nodes/chatmodels/ChatCloudflareWorkersAI/ChatCloudflareWorkersAI.ts

@@ -1,6 +1,7 @@
 import { ChatCloudflareWorkersAI, type CloudflareWorkersAIInput } from '@langchain/cloudflare'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatCloudflareWorkersAI_ChatModels implements INode {
     label: string
@@ -70,6 +71,7 @@ class ChatCloudflareWorkersAI_ChatModels implements INode {
         }
 
         if (baseUrl) {
+            await checkDenyList(baseUrl)
             obj.baseUrl = baseUrl
         }
 

packages/components/nodes/chatmodels/ChatGoogleGenerativeAI/ChatGoogleGenerativeAI.ts

@@ -6,6 +6,7 @@ import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../
 import { getModels, MODEL_TYPE } from '../../../src/modelLoader'
 import { GoogleGenerativeAIChatInput } from '@langchain/google-genai'
 import { ChatGoogleGenerativeAI } from './FlowiseChatGoogleGenerativeAI'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class GoogleGenerativeAI_ChatModels implements INode {
     label: string
@@ -275,7 +276,10 @@ class GoogleGenerativeAI_ChatModels implements INode {
         if (topK) obj.topK = parseFloat(topK)
         if (cache) obj.cache = cache
         if (temperature) obj.temperature = parseFloat(temperature)
-        if (baseUrl) obj.baseUrl = baseUrl
+        if (baseUrl) {
+            await checkDenyList(baseUrl)
+            obj.baseUrl = baseUrl
+        }
         if (thinkingLevel) {
             obj.thinkingConfig = {
                 thinkingLevel: thinkingLevel,

packages/components/nodes/chatmodels/ChatLitellm/ChatLitellm.ts

@@ -4,6 +4,7 @@ import { BaseLLMParams } from '@langchain/core/language_models/llms'
 import { ICommonObject, IMultiModalOption, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
 import { ChatOpenAI } from '../ChatOpenAI/FlowiseChatOpenAI'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatLitellm_ChatModels implements INode {
     label: string
@@ -126,6 +127,7 @@ class ChatLitellm_ChatModels implements INode {
         }
 
         if (basePath) {
+            await checkDenyList(basePath)
             obj.configuration = {
                 baseURL: basePath
             }

packages/components/nodes/chatmodels/ChatLocalAI/ChatLocalAI.ts

@@ -2,6 +2,7 @@ import { ChatOpenAI, ChatOpenAIFields } from '@langchain/openai'
 import { BaseCache } from '@langchain/core/caches'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatLocalAI_ChatModels implements INode {
     label: string
@@ -123,7 +124,10 @@ class ChatLocalAI_ChatModels implements INode {
             obj.openAIApiKey = localAIApiKey
             obj.apiKey = localAIApiKey
         }
-        if (basePath) obj.configuration = { baseURL: basePath }
+        if (basePath) {
+            await checkDenyList(basePath)
+            obj.configuration = { baseURL: basePath }
+        }
 
         const model = new ChatOpenAI(obj)
 

packages/components/nodes/chatmodels/ChatNemoGuardrails/ChatNemoGuardrails.ts

@@ -6,6 +6,7 @@ import { CallbackManager, CallbackManagerForLLMRun } from '@langchain/core/callb
 import { ChatResult } from '@langchain/core/outputs'
 import { FailedAttemptHandler } from '@langchain/core/utils/async_caller'
 import { getBaseClasses, INode, INodeData, INodeParams } from '../../../src'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 export interface ChatNemoGuardrailsCallOptions extends BaseChatModelCallOptions {
     /**
@@ -109,6 +110,7 @@ class ChatNemoGuardrailsChatModel implements INode {
     async init(nodeData: INodeData): Promise<any> {
         const configurationId = nodeData.inputs?.configurationId
         const baseUrl = nodeData.inputs?.baseUrl
+        if (baseUrl) await checkDenyList(baseUrl)
         const obj: Partial<ChatNemoGuardrailsInput> = {
             configurationId: configurationId,
             baseUrl: baseUrl

packages/components/nodes/chatmodels/ChatNvdiaNIM/ChatNvdiaNIM.ts

@@ -2,6 +2,7 @@ import { BaseCache } from '@langchain/core/caches'
 import { ChatOpenAI, ChatOpenAIFields } from '@langchain/openai'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatNvdiaNIM_ChatModels implements INode {
     label: string
@@ -158,6 +159,8 @@ class ChatNvdiaNIM_ChatModels implements INode {
             }
         }
 
+        if (basePath) await checkDenyList(basePath)
+
         if (basePath || parsedBaseOptions) {
             obj.configuration = {
                 baseURL: basePath,

packages/components/nodes/chatmodels/ChatOllama/ChatOllama.ts

@@ -4,6 +4,7 @@ import { BaseCache } from '@langchain/core/caches'
 import { ICommonObject, IMultiModalOption, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
 import { ChatOllama } from './FlowiseChatOllama'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatOllama_ChatModels implements INode {
     label: string
@@ -252,8 +253,11 @@ class ChatOllama_ChatModels implements INode {
 
         const cache = nodeData.inputs?.cache as BaseCache
 
+        const activeBaseUrl = baseUrl || 'http://localhost:11434'
+        await checkDenyList(activeBaseUrl)
+
         const obj: ChatOllamaInput & BaseChatModelParams = {
-            baseUrl,
+            baseUrl: activeBaseUrl,
             temperature: parseFloat(temperature),
             model: modelName,
             streaming: streaming ?? true

packages/components/nodes/chatmodels/ChatOllama/ChatOllama_LlamaIndex.ts

@@ -1,6 +1,7 @@
 import { INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses } from '../../../src/utils'
 import { OllamaParams, Ollama } from 'llamaindex'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatOllama_LlamaIndex_ChatModels implements INode {
     label: string
@@ -192,6 +193,8 @@ class ChatOllama_LlamaIndex_ChatModels implements INode {
         const stop = nodeData.inputs?.stop as string
         const tfsZ = nodeData.inputs?.tfsZ as string
 
+        if (baseUrl) await checkDenyList(baseUrl)
+
         const obj: OllamaParams = {
             model: modelName,
             options: {},

packages/components/nodes/chatmodels/ChatOpenAICustom/ChatOpenAICustom.ts

@@ -2,6 +2,7 @@ import { ChatOpenAI, ChatOpenAIFields } from '@langchain/openai'
 import { BaseCache } from '@langchain/core/caches'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { getBaseClasses, getCredentialData, getCredentialParam } from '../../../src/utils'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class ChatOpenAICustom_ChatModels implements INode {
     label: string
@@ -160,6 +161,8 @@ class ChatOpenAICustom_ChatModels implements INode {
             }
         }
 
+        if (basePath) await checkDenyList(basePath)
+
         if (basePath || parsedBaseOptions) {
             obj.configuration = {
                 baseURL: basePath,

packages/components/nodes/documentloaders/Cheerio/Cheerio.ts

@@ -6,6 +6,7 @@ import { parse } from 'css-what'
 import { SelectorType } from 'cheerio'
 import { ICommonObject, INodeOutputsValue, IDocument, INode, INodeData, INodeParams } from '../../../src/Interface'
 import { handleEscapeCharacters, webCrawl, xmlScrape } from '../../../src/utils'
+import { checkDenyList, secureFetch } from '../../../src/httpSecurity'
 
 class Cheerio_DocumentLoaders implements INode {
     label: string
@@ -148,13 +149,23 @@ class Cheerio_DocumentLoaders implements INode {
 
         async function cheerioLoader(url: string): Promise<any> {
             try {
+                await checkDenyList(url)
                 let docs: IDocument[] = []
                 if (url.endsWith('.pdf')) {
                     if (process.env.DEBUG === 'true')
                         options.logger.info(`[${orgId}]: CheerioWebBaseLoader does not support PDF files: ${url}`)
                     return docs
                 }
                 const loader = new CheerioWebBaseLoader(url, params)
+                loader.scrape = async () => {
+                    const { load } = await CheerioWebBaseLoader.imports()
+                    const response = await secureFetch(url, {
+                        signal: loader.timeout ? AbortSignal.timeout(loader.timeout) : undefined,
+                        headers: loader.headers
+                    } as any)
+                    const html = loader.textDecoder?.decode(await response.arrayBuffer()) ?? (await response.text())
+                    return load(html)
+                }
                 if (textSplitter) {
                     docs = await loader.load()
                     docs = await textSplitter.splitDocuments(docs)

packages/components/nodes/documentloaders/Playwright/Playwright.ts

@@ -10,6 +10,7 @@ import { test } from 'linkifyjs'
 import { omit } from 'lodash'
 import { handleEscapeCharacters, INodeOutputsValue, webCrawl, xmlScrape } from '../../../src'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class Playwright_DocumentLoaders implements INode {
     label: string
@@ -189,6 +190,7 @@ class Playwright_DocumentLoaders implements INode {
 
         async function playwrightLoader(url: string): Promise<Document[] | undefined> {
             try {
+                await checkDenyList(url)
                 let docs = []
 
                 const executablePath = process.env.PLAYWRIGHT_EXECUTABLE_PATH
@@ -224,6 +226,32 @@ class Playwright_DocumentLoaders implements INode {
                     }
                 }
                 const loader = new PlaywrightWebBaseLoader(url, config)
+                loader.scrape = async (): Promise<string> => {
+                    const { chromium } = await PlaywrightWebBaseLoader.imports()
+                    const browser = await chromium.launch({
+                        headless: true,
+                        ...config.launchOptions
+                    })
+                    try {
+                        const page = await browser.newPage()
+                        await page.route('**', async (route, request) => {
+                            try {
+                                await checkDenyList(request.url())
+                                await route.continue()
+                            } catch {
+                                await route.abort('blockedbyclient')
+                            }
+                        })
+                        const response = await page.goto(url, {
+                            timeout: 180000,
+                            waitUntil: 'domcontentloaded',
+                            ...config.gotoOptions
+                        })
+                        return config.evaluate ? await config.evaluate(page, browser, response) : await page.content()
+                    } finally {
+                        await browser.close()
+                    }
+                }
                 if (textSplitter) {
                     docs = await loader.load()
                     docs = await textSplitter.splitDocuments(docs)

packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts

@@ -6,6 +6,7 @@ import { omit } from 'lodash'
 import { PuppeteerLifeCycleEvent } from 'puppeteer'
 import { handleEscapeCharacters, INodeOutputsValue, webCrawl, xmlScrape } from '../../../src'
 import { ICommonObject, INode, INodeData, INodeParams } from '../../../src/Interface'
+import { checkDenyList } from '../../../src/httpSecurity'
 
 class Puppeteer_DocumentLoaders implements INode {
     label: string
@@ -180,6 +181,7 @@ class Puppeteer_DocumentLoaders implements INode {
 
         async function puppeteerLoader(url: string): Promise<Document[] | undefined> {
             try {
+                await checkDenyList(url)
                 let docs: Document[] = []
 
                 const executablePath = process.env.PUPPETEER_EXECUTABLE_PATH
@@ -215,6 +217,35 @@ class Puppeteer_DocumentLoaders implements INode {
                     }
                 }
                 const loader = new PuppeteerWebBaseLoader(url, config)
+                loader.scrape = async (): Promise<string> => {
+                    const { launch } = await PuppeteerWebBaseLoader.imports()
+                    const browser = await launch({
+                        headless: true,
+                        defaultViewport: null,
+                        ignoreDefaultArgs: ['--disable-extensions'],
+                        ...config.launchOptions
+                    })
+                    try {
+                        const page = await browser.newPage()
+                        await page.setRequestInterception(true)
+                        page.on('request', async (interceptedRequest) => {
+                            try {
+                                await checkDenyList(interceptedRequest.url())
+                                await interceptedRequest.continue()
+                            } catch {
+                                await interceptedRequest.abort('blockedbyclient')
+                            }
+                        })
+                        await page.goto(url, {
+                            timeout: 180000,
+                            waitUntil: 'domcontentloaded',
+                            ...config.gotoOptions
+                        })
+                        return config.evaluate ? await config.evaluate(page, browser) : await page.evaluate(() => document.body.innerHTML)
+                    } finally {
+                        await browser.close()
+                    }
+                }
                 if (textSplitter) {
                     docs = await loader.load()
                     docs = await textSplitter.splitDocuments(docs)

packages/components/nodes/documentloaders/S3Directory/S3Directory.ts

@@ -1,6 +1,6 @@
 import { ICommonObject, INode, INodeData, INodeOptionsValue, INodeOutputsValue, INodeParams } from '../../../src/Interface'
 import { handleDocumentLoaderDocuments, handleDocumentLoaderMetadata, handleDocumentLoaderOutput } from '../../../src/utils'
-import { getAWSCredentialConfig } from '../../../src/awsToolsUtils'
+import { getAWSCredentialConfig, AWSCredentials } from '../../../src/awsToolsUtils'
 import { getSafeFilePath } from '../../../src/validator'
 import { S3Client, GetObjectCommand, S3ClientConfig, ListObjectsV2Command, ListObjectsV2Output } from '@aws-sdk/client-s3'
 import { getRegions, MODEL_TYPE } from '../../../src/modelLoader'
@@ -153,7 +153,7 @@ class S3_DocumentLoaders implements INode {
         const _omitMetadataKeys = nodeData.inputs?.omitMetadataKeys as string
         const output = nodeData.outputs?.output as string
 
-        let credentials: S3ClientConfig['credentials'] | undefined
+        let credentials: AWSCredentials | undefined
         if (nodeData.credential) {
             const credentialConfig = await getAWSCredentialConfig(nodeData, options, region)
             credentials = credentialConfig.credentials

packages/components/nodes/documentloaders/S3File/S3File.ts

@@ -8,7 +8,7 @@ import {
     HiResModelName
 } from '@langchain/community/document_loaders/fs/unstructured'
 import { handleDocumentLoaderDocuments, handleDocumentLoaderMetadata, handleDocumentLoaderOutput } from '../../../src/utils'
-import { getAWSCredentialConfig } from '../../../src/awsToolsUtils'
+import { getAWSCredentialConfig, AWSCredentials } from '../../../src/awsToolsUtils'
 import { getSafeFilePath } from '../../../src/validator'
 import { S3Client, GetObjectCommand, HeadObjectCommand, S3ClientConfig } from '@aws-sdk/client-s3'
 import { getRegions, MODEL_TYPE } from '../../../src/modelLoader'
@@ -576,7 +576,7 @@ class S3_DocumentLoaders implements INode {
             omitMetadataKeys = _omitMetadataKeys.split(',').map((key) => key.trim())
         }
 
-        let credentials: S3ClientConfig['credentials'] | undefined
+        let credentials: AWSCredentials | undefined
         if (nodeData.credential) {
             const credentialConfig = await getAWSCredentialConfig(nodeData, options, region)
             credentials = credentialConfig.credentials