chore(deps): bump chainlit from 2.11.1 to 2.12.0 in /adapters/chainlit

[dependabot]

Bumps chainlit from 2.11.1 to 2.12.0.

Release notes

Sourced from chainlit's releases.

2.12.0

⚠️ Security release — breaking changes, action required if you use MCP

This release fixes two vulnerabilities in the /mcp endpoint, both exploitable by an unauthenticated attacker whenever features.mcp.enabled = true.

CVE	Advisory	CVSS v3.1	Severity	Issue
CVE-2026-45018	SPL-2026-001	9.8	Critical	Command injection via the MCP stdio transport
CVE-2026-45019	SPL-2026-002	7.2	High	SSRF via the MCP streamable-http / SSE transports

Affected: v2.4.0rc0 – v2.11.x. MCP has been disabled by default since v2.7.0, which limits real-world exposure — if you never set features.mcp.enabled = true, you were not vulnerable.

If you cannot upgrade immediately, set features.mcp.enabled = false (the default). This fully prevents exploitation of both issues.

📄 Full technical detail, impact analysis and mitigations: docs/security-advisory-2026-mcp.md

The fix for the command injection is architectural rather than filtering — no argument-level validation can sandbox a command whose full argument list the attacker controls. fullCommand is removed from the client request entirely: stdio servers are now declared only in server-side config, and the client sends just a name.

---

🔧 Migration guide

1. MCP config (.chainlit/config.toml)

Legacy MCP keys now abort startup instead of being silently ignored. If your config contains [features.mcp.sse], [features.mcp.stdio], [features.mcp.streamable-http] or allowed_executables, the app will refuse to start until you migrate.

Before (v2.11.x):

[features.mcp]
enabled = true
[features.mcp.stdio]
enabled = true
allowed_executables = ["npx", "uvx"]
[features.mcp.sse]
enabled = true
allowed_urls = ["https://mcp.example.com"]

After (v2.12.0):

[features.mcp]
enabled = true
Developer-configured servers (replaces allowed_executables / allowed_urls)
[[features.mcp.servers]]
name = "github"
</tr></table>

... (truncated)

Changelog

Sourced from chainlit's changelog.

[2.12.0] - 2026-08-25

Security Advisory

IMPORTANT — this release contains breaking changes. Action is required if you use MCP.

• This release fixes a critical command injection (CVE-2026-45018, SPL-2026-001, CVSS v3.1 9.8) and a high-severity SSRF (CVE-2026-45019, SPL-2026-002, CVSS v3.1 7.2) in the /mcp endpoint. Both are exploitable by an unauthenticated attacker whenever features.mcp.enabled = true. All versions from v2.4.0rc0 through v2.11.x are affected; MCP has been disabled by default since v2.7.0.
• The fix cannot be applied without config changes. Legacy MCP config keys now abort startup instead of being ignored, and the @chainlit/react-client connection API changed. Before upgrading, follow the MCP config migration guide and the @chainlit/react-client migration guide at the end of this section.
• If you cannot upgrade immediately, set features.mcp.enabled = false (the default). This fully prevents exploitation of both vulnerabilities.
• Full technical detail, impact analysis and additional mitigations: https://github.com/Chainlit/chainlit/blob/main/docs/security-advisory-2026-mcp.md.

Both vulnerabilities were reported by Vipin and Stephen at SPL Security (security@spl.team) under coordinated disclosure, with working proof-of-concept exploits for each. We thank them for a thorough and responsibly disclosed report.

Security

• Fix critical command injection (CVE-2026-45018, SPL-2026-001) and SSRF (CVE-2026-45019, SPL-2026-002) in the /mcp endpoint — stdio MCP servers are now defined server-side and the client supplies only a name; see the migration guides below and https://github.com/Chainlit/chainlit/blob/main/docs/security-advisory-2026-mcp.md
• Filter Cookie, Host, Forwarded, X-Forwarded-*, X-Real-IP, Via, Proxy-Authorization and the method/URL override headers from user-provided MCP connections
• Stop disclosing the user_servers allowlist and server details through /project/settings
• Reject MCP URLs containing ./.. segments, encoded separators, double-encoded sequences, backslashes or non-ASCII characters
• Raise backend minimum versions for mcp, pydantic, pydantic-settings, pyjwt and python-multipart, and pin more than thirty vulnerable JS dependencies — including lodash, postcss, micromatch, form-data, undici, ws and rollup — to patched ranges across all four workspaces
• Upgrade react-router-dom to 6.30.6, clearing an open-redirect to XSS advisory that covered every previously shipped 6.30.x
• Upgrade socket.io-client to 4.8.3 in the published @chainlit/react-client, moving its engine.io-client/ws chain onto patched versions — the one dependency change here that reaches downstream npm consumers

... (truncated)

Commits

• 0565fd0 Merge commit from fork
• b8506a4 chore(deps): upgrade dependencies with known vulnerabilities (#2999)
• 0318d88 fix(auth): redirect OAuth login failures to login page instead of raw JSON (#...
• f5f3fa8 fix(deps): bump lodash to 4.18.1 for prototype pollution fix (#3012)
• 4128bb9 fix(auth): expose cookie OAuth model for OpenAPI (#2968)
• 8a128b4 fix(cli): avoid lint-translations UnicodeEncodeError on legacy consoles (#3006)
• ec4eeaa fix(cache): scope entries by function identity (#2987)
• f2266b2 chore(deps): drop unused audioop-lts core dependency (#2980)
• 643863b fix(elements): reconstruct uploaded PDFs as Pdf elements in Element.from_dict...
• b617196 Fix: Resolve transparent UI issue in Copilot Light Mode (#2977)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.