build(deps): Bump chainlit from 2.11.1 to 2.12.0

[dependabot]

Bumps chainlit from 2.11.1 to 2.12.0.

Release notes

Sourced from chainlit's releases.

2.12.0

⚠️ Security release — breaking changes, action required if you use MCP

This release fixes two vulnerabilities in the /mcp endpoint, both exploitable by an unauthenticated attacker whenever features.mcp.enabled = true.

CVE	Advisory	CVSS v3.1	Severity	Issue
CVE-2026-45018	SPL-2026-001	9.8	Critical	Command injection via the MCP stdio transport
CVE-2026-45019	SPL-2026-002	7.2	High	SSRF via the MCP streamable-http / SSE transports

Affected: v2.4.0rc0 – v2.11.x. MCP has been disabled by default since v2.7.0, which limits real-world exposure — if you never set features.mcp.enabled = true, you were not vulnerable.

If you cannot upgrade immediately, set features.mcp.enabled = false (the default). This fully prevents exploitation of both issues.

📄 Full technical detail, impact analysis and mitigations: docs/security-advisory-2026-mcp.md

The fix for the command injection is architectural rather than filtering — no argument-level validation can sandbox a command whose full argument list the attacker controls. fullCommand is removed from the client request entirely: stdio servers are now declared only in server-side config, and the client sends just a name.

---

🔧 Migration guide

1. MCP config (.chainlit/config.toml)

Legacy MCP keys now abort startup instead of being silently ignored. If your config contains [features.mcp.sse], [features.mcp.stdio], [features.mcp.streamable-http] or allowed_executables, the app will refuse to start until you migrate.

Before (v2.11.x):

[features.mcp]
enabled = true
[features.mcp.stdio]
enabled = true
allowed_executables = ["npx", "uvx"]
[features.mcp.sse]
enabled = true
allowed_urls = ["https://mcp.example.com"]

After (v2.12.0):

[features.mcp]
enabled = true
Developer-configured servers (replaces allowed_executables / allowed_urls)
[[features.mcp.servers]]
name = "github"
</tr></table>

... (truncated)

Changelog

Sourced from chainlit's changelog.

[2.12.0] - 2026-08-25

Security Advisory

IMPORTANT — this release contains breaking changes. Action is required if you use MCP.

• This release fixes a critical command injection (CVE-2026-45018, SPL-2026-001, CVSS v3.1 9.8) and a high-severity SSRF (CVE-2026-45019, SPL-2026-002, CVSS v3.1 7.2) in the /mcp endpoint. Both are exploitable by an unauthenticated attacker whenever features.mcp.enabled = true. All versions from v2.4.0rc0 through v2.11.x are affected; MCP has been disabled by default since v2.7.0.
• The fix cannot be applied without config changes. Legacy MCP config keys now abort startup instead of being ignored, and the @chainlit/react-client connection API changed. Before upgrading, follow the MCP config migration guide and the @chainlit/react-client migration guide at the end of this section.
• If you cannot upgrade immediately, set features.mcp.enabled = false (the default). This fully prevents exploitation of both vulnerabilities.
• Full technical detail, impact analysis and additional mitigations: https://github.com/Chainlit/chainlit/blob/main/docs/security-advisory-2026-mcp.md.

Both vulnerabilities were reported by Vipin and Stephen at SPL Security (security@spl.team) under coordinated disclosure, with working proof-of-concept exploits for each. We thank them for a thorough and responsibly disclosed report.

Security

• Fix critical command injection (CVE-2026-45018, SPL-2026-001) and SSRF (CVE-2026-45019, SPL-2026-002) in the /mcp endpoint — stdio MCP servers are now defined server-side and the client supplies only a name; see the migration guides below and https://github.com/Chainlit/chainlit/blob/main/docs/security-advisory-2026-mcp.md
• Filter Cookie, Host, Forwarded, X-Forwarded-*, X-Real-IP, Via, Proxy-Authorization and the method/URL override headers from user-provided MCP connections
• Stop disclosing the user_servers allowlist and server details through /project/settings
• Reject MCP URLs containing ./.. segments, encoded separators, double-encoded sequences, backslashes or non-ASCII characters
• Raise backend minimum versions for mcp, pydantic, pydantic-settings, pyjwt and python-multipart, and pin more than thirty vulnerable JS dependencies — including lodash, postcss, micromatch, form-data, undici, ws and rollup — to patched ranges across all four workspaces
• Upgrade react-router-dom to 6.30.6, clearing an open-redirect to XSS advisory that covered every previously shipped 6.30.x
• Upgrade socket.io-client to 4.8.3 in the published @chainlit/react-client, moving its engine.io-client/ws chain onto patched versions — the one dependency change here that reaches downstream npm consumers

... (truncated)

Commits

• 0565fd0 Merge commit from fork
• b8506a4 chore(deps): upgrade dependencies with known vulnerabilities (#2999)
• 0318d88 fix(auth): redirect OAuth login failures to login page instead of raw JSON (#...
• f5f3fa8 fix(deps): bump lodash to 4.18.1 for prototype pollution fix (#3012)
• 4128bb9 fix(auth): expose cookie OAuth model for OpenAPI (#2968)
• 8a128b4 fix(cli): avoid lint-translations UnicodeEncodeError on legacy consoles (#3006)
• ec4eeaa fix(cache): scope entries by function identity (#2987)
• f2266b2 chore(deps): drop unused audioop-lts core dependency (#2980)
• 643863b fix(elements): reconstruct uploaded PDFs as Pdf elements in Element.from_dict...
• b617196 Fix: Resolve transparent UI issue in Copilot Light Mode (#2977)
• Additional commits viewable in compare view