Removed outdated and vulnerable dependencies from the project for security and maintenance purposes. Updated rimraf to remove the inflight package due to a security vulnerability.
Added
No new features added.
Changed
Updated rimraf to a higher version to remove the inflight dependency and improve security.
Deprecated
No deprecated features removed.
Removed
Removed opencv-python-headless version 4.11.0.86.
Removed rapidocr-onnxruntime version 1.4.4.
Removed python-jose version 3.4.0.
Removed inflight NPM package version 1.0.6.
Removed @sveltejs/adapter-node version 2.1.2.
Fixed
Removal of dependencies that had security vulnerabilities such as memory leaks and out-of-bounds write issues.
Security
Fixed memory leaks in the inflight NPM package.
Addressed security vulnerabilities in opencv-python-headless related to CVE-2019-9423.
Removed packages (opencv, rapidocr-onnxruntime, python-jose) that are flagged as high-risk.
Updated rimraf to remove the inflight package due to a memory leak issue [1].
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/14733
**Author:** [@mgicala](https://github.com/mgicala)
**Created:** 6/6/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `dev`
---
### 📝 Commits (4)
- [`ac3fe50`](https://github.com/open-webui/open-webui/commit/ac3fe5080387355f028ecd2d95613afe774689d5) build: remove adapter node
- [`9f756af`](https://github.com/open-webui/open-webui/commit/9f756af85389e5fa27156739ab4d87bdb84e532a) build: force higher rimraf version to remove inflight
- [`e933e1f`](https://github.com/open-webui/open-webui/commit/e933e1fbbc39b02be4049c35d15f6e09134b1593) build: remove unused python-jose
- [`7e49232`](https://github.com/open-webui/open-webui/commit/7e49232c38a3de409e48dfc8f5056d1ad70f0a30) build: remove opencv dependencies
### 📊 Changes
**5 files changed** (+111 additions, -621 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/requirements.txt` (+0 -3)
📝 `package-lock.json` (+106 -479)
📝 `package.json` (+3 -1)
📝 `pyproject.toml` (+0 -3)
📝 `uv.lock` (+2 -135)
</details>
### 📄 Description
# Changelog Entry
### Description
- Removed outdated and vulnerable dependencies from the project for security and maintenance purposes. Updated `rimraf` to remove the `inflight` package due to a security vulnerability.
### Added
- No new features added.
### Changed
- Updated `rimraf` to a higher version to remove the `inflight` dependency and improve security.
### Deprecated
- No deprecated features removed.
### Removed
- Removed `opencv-python-headless` version 4.11.0.86.
- Removed `rapidocr-onnxruntime` version 1.4.4.
- Removed `python-jose` version 3.4.0.
- Removed `inflight` NPM package version 1.0.6.
- Removed `@sveltejs/adapter-node` version 2.1.2.
### Fixed
- Removal of dependencies that had security vulnerabilities such as memory leaks and out-of-bounds write issues.
### Security
- Fixed memory leaks in the `inflight` NPM package.
- Addressed security vulnerabilities in `opencv-python-headless` related to CVE-2019-9423.
- Removed packages (`opencv`, `rapidocr-onnxruntime`, `python-jose`) that are flagged as high-risk.
- Updated `rimraf` to remove the `inflight` package due to a memory leak issue [1].
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/14733
Author: @mgicala
Created: 6/6/2025
Status: ❌ Closed
Base:
dev← Head:dev📝 Commits (4)
ac3fe50build: remove adapter node9f756afbuild: force higher rimraf version to remove inflighte933e1fbuild: remove unused python-jose7e49232build: remove opencv dependencies📊 Changes
5 files changed (+111 additions, -621 deletions)
View changed files
📝
backend/requirements.txt(+0 -3)📝
package-lock.json(+106 -479)📝
package.json(+3 -1)📝
pyproject.toml(+0 -3)📝
uv.lock(+2 -135)📄 Description
Changelog Entry
Description
rimrafto remove theinflightpackage due to a security vulnerability.Added
Changed
rimrafto a higher version to remove theinflightdependency and improve security.Deprecated
Removed
opencv-python-headlessversion 4.11.0.86.rapidocr-onnxruntimeversion 1.4.4.python-joseversion 3.4.0.inflightNPM package version 1.0.6.@sveltejs/adapter-nodeversion 2.1.2.Fixed
Security
inflightNPM package.opencv-python-headlessrelated to CVE-2019-9423.opencv,rapidocr-onnxruntime,python-jose) that are flagged as high-risk.rimrafto remove theinflightpackage due to a memory leak issue [1].Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.