Hello Team, I am currently using the Self-Managed Community version of Airbyte Platform v1.7.1 on a GKE cluster, deployed via Helm chart. I needed to upgrade it with the latest version v1.9.2. I have identified a critical serialization injection vulnerability in connector-builder-server v0.67.17, specifically in the langchain-core v0.1.42 package through the Security report on the Artifact HUB page. Could you please advise when the latest Airbyte Platform Helm chart with langchain-core version 1.2.5 will be available? Additionally, is there a way to disable this module in the meantime?

Hi Shail, In the V2 Helm chart,

connector-builder-server

component has been replaced by

manifest-server

which is built from the CDK and does NOT include langchain-core: https://github.com/airbytehq/airbyte-python-cdk/blob/main/airbyte_cdk/manifest_server/Dockerfile So if you upgrade using V2 Helm charts, it might become not applicable.