●Change8

2.12.0

Breaking Changes
📦 chainlitView on GitHub →
⚠ 9 breaking✨ 3 features🐛 13 fixes🔧 37 symbols

Summary

This security release addresses critical vulnerabilities in the `/mcp` endpoint, requiring migration of MCP configuration and client-side connections. It also includes dependency upgrades and various bug fixes.

⚠️ Breaking Changes

  • Legacy MCP config keys (`[features.mcp.sse]`, `[features.mcp.stdio]`, `[features.mcp.streamable-http]`, `allowed_executables`) now abort startup when MCP is enabled instead of being silently ignored. They are replaced by a unified `[[features.mcp.servers]]` array and an optional `[features.mcp.user_servers]` section.
  • Stdio MCP servers must now be declared in `[[features.mcp.servers]]` with `type = "stdio"` and a `command`. A client-supplied `fullCommand` is rejected, and inline `KEY=value` assignments must move to an `env` mapping on the server entry.
  • `type` is now required on every `[[features.mcp.servers]]` entry. `StdioMcpServer`, `SseMcpServer`, and `StreamableHttpMcpServer` no longer default it, so servers constructed in Python must pass it explicitly.
  • User-provided SSE/HTTP connections require an explicit `[features.mcp.user_servers] enabled = true` and a non-empty `allowed_urls`, where they were previously enabled by default.
  • MCP connections no longer follow HTTP redirects for both developer-configured and user-provided servers. Configure the final `https://` URL directly.
  • User-provided MCP connections are re-checked against their allowlist entry on every request rather than only the first.
  • Duplicate, empty, and colliding MCP server names are rejected instead of loading silently.
  • The `/mcp` endpoint now returns `isUserProvided` instead of `url`/`headers` for developer-configured (named) servers.
  • `@chainlit/react-client` 0.5.0 removes `connectStdioMCP()`, `connectSseMCP()`, and `connectStreamableHttpMCP()`. Use `connectMcp()` for named servers and `connectUserMcp()` for user-provided ones.

Migration Steps

  1. If your config contains `[features.mcp.sse]`, `[features.mcp.stdio]`, `[features.mcp.streamable-http]`, or `allowed_executables`, migrate them to the new `[[features.mcp.servers]]` structure and optionally `[features.mcp.user_servers]` section.
  2. For stdio MCP servers, declare them in `[[features.mcp.servers]]` with `type = "stdio"` and a `command`. Move inline `KEY=value` assignments to an `env` mapping on the server entry.
  3. Ensure `type` is explicitly passed for servers constructed in Python using `StdioMcpServer`, `SseMcpServer`, or `StreamableHttpMcpServer`.
  4. If using user-provided SSE/HTTP connections, explicitly enable them with `[features.mcp.user_servers] enabled = true` and provide a non-empty `allowed_urls`.
  5. Update any URLs that relied on HTTP redirects to point to the final `https://` URL directly.
  6. Replace calls to `connectStdioMCP(sessionId, name, fullCommand)` with `connectMcp(sessionId, name)`.
  7. Replace calls to `connectSseMCP(sessionId, name, url, headers?)` with `connectUserMcp(sessionId, name, 'sse', url, headers?)`.
  8. Replace calls to `connectStreamableHttpMCP(sessionId, name, url, headers?)` with `connectUserMcp(sessionId, name, 'streamable-http', url, headers?)`.
  9. When checking `IMcp` properties, use the `isUserProvided` flag directly instead of inferring from `url` or `clientType`.

✨ New Features

  • Added a localized tooltip to the settings icon.
  • Added `SECURITY.md` with a responsible disclosure policy.
  • Support single-tenant Azure Bot registrations for Teams via `TEAMS_APP_TENANT_ID`.

🐛 Bug Fixes

  • Fixed critical command injection (CVE-2026-45018, SPL-2026-001) and SSRF (CVE-2026-45019, SPL-2026-002) in the `/mcp` endpoint. Stdio MCP servers are now defined server-side and the client supplies only a name.
  • Filtered `Cookie`, `Host`, `Forwarded`, `X-Forwarded-*`, `X-Real-IP`, `Via`, `Proxy-Authorization` and the method/URL override headers from user-provided MCP connections.
  • Stopped disclosing the `user_servers` allowlist and server details through `/project/settings`.
  • Rejected MCP URLs containing `.`/`..` segments, encoded separators, double-encoded sequences, backslashes, or non-ASCII characters.
  • Raised backend minimum versions for `mcp`, `pydantic`, `pydantic-settings`, `pyjwt`, and `python-multipart`, and pinned more than thirty vulnerable JS dependencies (including `lodash`, `postcss`, `micromatch`, `form-data`, `undici`, `ws`, and `rollup`) to patched ranges across all four workspaces.
  • Upgraded `react-router-dom` to 6.30.6, clearing an open-redirect to XSS advisory that covered every previously shipped 6.30.x.
  • Upgraded `socket.io-client` to 4.8.3 in the published `@chainlit/react-client`, moving its `engine.io-client`/`ws` chain onto patched versions.
  • Bound the MCP connect handshake so a blocked destination fails fast instead of hanging and leaking its connection task.
  • Kept the existing MCP session until a reconnect has succeeded, so a failed reconnect no longer drops a working connection.
  • Serialized concurrent reconnects to the same MCP server name to avoid leaking a live connection.
  • Reported the underlying cause of an MCP connect failure instead of an empty error.
  • Dropped malformed stored MCP entries instead of letting them break the chat page.
  • Resolved MCP servers declared in a chat profile's `config_`.

Affected Symbols

/mcp endpoint`features.mcp.enabled``features.mcp.sse``features.mcp.stdio``features.mcp.streamable-http``allowed_executables``fullCommand``[features.mcp.servers]``[features.mcp.user_servers]``type` on `[[features.mcp.servers]]``StdioMcpServer``SseMcpServer``StreamableHttpMcpServer``connectStdioMCP``connectSseMCP``connectStreamableHttpMCP``connectMcp``connectUserMcp``IMcp``clientType``isUserProvided``IChainlitConfig.features.mcp``@chainlit/react-client``pydantic``pydantic-settings``pyjwt``python-multipart``lodash``postcss``micromatch``form-data``undici``ws``rollup``react-router-dom``socket.io-client``engine.io-client`