mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-03-16 04:17:49 +08:00
7c79602c77
### What problem does this PR solve? This PR fixes two security vulnerabilities in web dependencies identified by Trivy: 1. CVE-2025-13465 (lodash): Prototype pollution vulnerability in _.unset and _.omit functions 2. CVE-2026-0540 (dompurify): Cross-site scripting (XSS) vulnerability **Changes:** - Upgraded lodash from 4.17.21 to 4.17.23 - Upgraded dompurify from 3.3.1 to 3.3.2 - Added npm override to force monaco-editor's transitive dependency on dompurify to use 3.3.2 (monaco-editor still depends on vulnerable 3.2.7) Both upgrades are backward-compatible patch versions. Build verified successfully with no breaking changes. ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue)
Install front-end dependencies
npm install
Launch front-end
npm run dev
The following output confirms a successful launch of the system:
Login to RAGFlow web UI
Open your browser and navigate to:
http://localhost:9222 or http://[YOUR_MACHINE_IP]:9222
Replace [YOUR_MACHINE_IP] with your actual machine IP address (e.g., http://192.168.1.49:9222).
Login to RAGFlow web admin UI
Open your browser and navigate to:
http://localhost:9222/admin or http://[YOUR_MACHINE_IP]:9222/admin
Replace [YOUR_MACHINE_IP] with your actual machine IP address (e.g., http://192.168.1.49:9222/admin).
Shutdown front-end
Ctrl + C or
kill -f "umi dev"