https://raw.githubusercontent.com/OrcVole/langfuse-cloudron/main/CloudronVersions.json
Description
`4.27.0
Langfuse is an open-source LLM engineering platform. It gives you observability and tracing for LLM applications, evaluations, prompt management, a prompt playground, datasets, and usage/cost metrics — all self-hosted on your own Cloudron.
This package runs the open-source (MIT) edition. It integrates with OpenTelemetry, the OpenAI SDK, LangChain, LiteLLM, LlamaIndex, and most LLM tooling, so it can act as the observability sink for the rest of your stack.
On this Cloudron:
- Langfuse keeps its own login (email/password plus optional single sign-on through your Cloudron users via OIDC). It is not fronted by the Cloudron SSO proxy.
- Trace ingestion uses Langfuse project API keys (a public/secret key pair you create in the UI),
sent to the open
/api/public/*endpoints — including the OpenTelemetry endpoint/api/public/otel/v1/traces. - ClickHouse and MinIO are bundled and managed for you; PostgreSQL and Redis come from Cloudron addons. All trace data and object storage live in the app's backed-up data directory.
The enterprise (/ee) features (RBAC, audit logs, data retention policies, SCIM) are intentionally
not included.
Recent Changes
Update langfuse 4.15.0 -> 4.27.0
Security: prevents SSRF via crafted analytics export URLs, PII exposure in Sentry session replays, credential leakage to unintended endpoints, unauthorised deletion of project API keys, authentication flow bypasses, denial of service via oversized OTLP payloads, unauthorised access to audit-log exports and blob-storage endpoints, prototype-chain clobbering in OTel attribute mapping, customer data leakage to third-party analytics, and unauthorised access to restricted prompts and historical data
Breaking changes: v4 migration UI now shown by default in dual-write mode; LANGFUSE_AWS_BEDROCK_* env vars replaced by LANGFUSE_AI_*; default JWT session max age reduced to 14 days; in-app agent now gated behind LANGFUSE_IN_APP_AGENT_ENABLED; unstable evaluator API endpoints sunset; LANGFUSE_AI_PROVIDER now required; evaluation RBAC scope names renamed; self-hosted entrypoints now respect DATABASE_PORT
Other: routine features and fixes across 12 release chunks
No packaging changes: version and web/worker image digests re-pinned; base and built images digest-pinned