chore: release v3.167.4

'path-to-regexp' v0.1.13 was released 5 days ago to fix CVE-2026-4867
https://github.com/pillarjs/path-to-regexp/commit/7ccf02cee33402f06ed2125085992ee9cd3a7c45

This PR manually override `path-to-regexp` dependency coming from `dd-trace` to patch the CVE

Co-authored-by: Nimar <l.nimar.b@gmail.com>

.github/workflows/pipeline.yml

@@ -668,8 +668,6 @@ jobs:
     permissions:
       packages: write
       contents: read
-    env:
-      STAGING_TAG_PREFIX: staging-${{ github.run_id }}
 
     steps:
       - name: Checkout
@@ -682,6 +680,11 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Log in to Docker Hub
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Setup Blacksmith Builder
         uses: useblacksmith/setup-docker-builder@5241b2e9423e8b1fa37ed6050ecb62d0fb9a4e38 # v1
       - name: Extract metadata (labels) for Docker
@@ -701,15 +704,46 @@ jobs:
             type=semver,pattern={{major}}.{{minor}},enable=${{ !contains(github.ref, '-rc') }}
             type=semver,pattern={{major}},enable=${{ !contains(github.ref, '-rc') }}
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v3') && !contains(github.ref, '-rc') }}
-      - name: Build and push staged Docker image (${{ matrix.component }}, ${{ matrix.platform_tag }})
+      - name: Build and push image by digest to GitHub Container Registry (${{ matrix.component }}, ${{ matrix.platform_tag }})
+        id: build-ghcr
         uses: useblacksmith/build-push-action@cbd1f60d194a98cb3be5523b15134501eaf0fbf3 # v2
         with:
           context: .
           file: ${{ matrix.dockerfile }}
-          push: true
-          tags: ghcr.io/langfuse/${{ matrix.image_name }}:${{ env.STAGING_TAG_PREFIX }}-${{ matrix.platform_tag }}
+          outputs: type=image,name=ghcr.io/langfuse/${{ matrix.image_name }},push-by-digest=true,name-canonical=true,push=true
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ matrix.platform }}
+          provenance: false
+          sbom: false
+      - name: Build and push image by digest to Docker Hub (${{ matrix.component }}, ${{ matrix.platform_tag }})
+        id: build-dockerhub
+        uses: useblacksmith/build-push-action@cbd1f60d194a98cb3be5523b15134501eaf0fbf3 # v2
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          outputs: type=image,name=langfuse/${{ matrix.image_name }},push-by-digest=true,name-canonical=true,push=true
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: ${{ matrix.platform }}
+          provenance: false
+          sbom: false
+      - name: Record pushed digests
+        run: |
+          if [ -z '${{ steps.build-ghcr.outputs.digest }}' ] || [ -z '${{ steps.build-dockerhub.outputs.digest }}' ]; then
+            echo "Missing registry digest output"
+            exit 1
+          fi
+
+          mkdir -p "$RUNNER_TEMP/digests/ghcr" "$RUNNER_TEMP/digests/dockerhub"
+          printf '%s\n' '${{ steps.build-ghcr.outputs.digest }}' > "$RUNNER_TEMP/digests/ghcr/${{ matrix.platform_tag }}.txt"
+          printf '%s\n' '${{ steps.build-dockerhub.outputs.digest }}' > "$RUNNER_TEMP/digests/dockerhub/${{ matrix.platform_tag }}.txt"
+      - name: Upload release digests
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: release-digests-${{ matrix.component }}-${{ matrix.platform_tag }}
+          path: |
+            ${{ runner.temp }}/digests/ghcr/${{ matrix.platform_tag }}.txt
+            ${{ runner.temp }}/digests/dockerhub/${{ matrix.platform_tag }}.txt
+          if-no-files-found: error
 
   publish-docker-image-release:
     needs:
@@ -728,12 +762,8 @@ jobs:
     permissions:
       packages: write
       contents: read
-    env:
-      STAGING_TAG_PREFIX: staging-${{ github.run_id }}
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Log in to the GitHub Container registry
         uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
         with:
@@ -745,6 +775,14 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@5241b2e9423e8b1fa37ed6050ecb62d0fb9a4e38 # v1
+      - name: Download release digests
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          pattern: release-digests-${{ matrix.component }}-*
+          merge-multiple: true
+          path: ${{ runner.temp }}/digests
       - name: Extract metadata (tags) for GitHub Container Registry
         id: meta-ghcr
         uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
@@ -778,6 +816,8 @@ jobs:
       - name: Publish multi-platform manifest to GitHub Container Registry
         run: |
           ghcr_tags=()
+          ghcr_sources=()
+
           while IFS= read -r tag; do
             [ -n "$tag" ] || continue
             ghcr_tags+=("-t" "$tag")
@@ -785,13 +825,22 @@ jobs:
           ${{ steps.meta-ghcr.outputs.tags }}
           EOF
 
-          docker buildx imagetools create "${ghcr_tags[@]}" \
-            "ghcr.io/langfuse/${{ matrix.image_name }}:${STAGING_TAG_PREFIX}-amd64" \
-            "ghcr.io/langfuse/${{ matrix.image_name }}:${STAGING_TAG_PREFIX}-arm64"
+          shopt -s nullglob
+          for digest_file in "$RUNNER_TEMP"/digests/ghcr/*.txt; do
+            digest="$(cat "$digest_file")"
+            ghcr_sources+=("ghcr.io/langfuse/${{ matrix.image_name }}@$digest")
+          done
+
+          if [ "${#ghcr_sources[@]}" -lt 2 ]; then
+            echo "Expected amd64 and arm64 GHCR digests for ${{ matrix.component }}"
+            exit 1
+          fi
+
+          docker buildx imagetools create "${ghcr_tags[@]}" "${ghcr_sources[@]}"
       - name: Publish multi-platform manifest to Docker Hub
         run: |
           dockerhub_tags=()
-          ghcr_first_tag=""
+          dockerhub_sources=()
 
           while IFS= read -r tag; do
             [ -n "$tag" ] || continue
@@ -800,20 +849,18 @@ jobs:
           ${{ steps.meta-dockerhub.outputs.tags }}
           EOF
 
-          while IFS= read -r tag; do
-            [ -n "$tag" ] || continue
-            ghcr_first_tag="$tag"
-            break
-          done <<'EOF'
-          ${{ steps.meta-ghcr.outputs.tags }}
-          EOF
+          shopt -s nullglob
+          for digest_file in "$RUNNER_TEMP"/digests/dockerhub/*.txt; do
+            digest="$(cat "$digest_file")"
+            dockerhub_sources+=("langfuse/${{ matrix.image_name }}@$digest")
+          done
 
-          if [ -z "$ghcr_first_tag" ]; then
-            echo "No GHCR tag available to copy to Docker Hub"
+          if [ "${#dockerhub_sources[@]}" -lt 2 ]; then
+            echo "Expected amd64 and arm64 Docker Hub digests for ${{ matrix.component }}"
             exit 1
           fi
 
-          docker buildx imagetools create "${dockerhub_tags[@]}" "$ghcr_first_tag"
+          docker buildx imagetools create "${dockerhub_tags[@]}" "${dockerhub_sources[@]}"
       - name: Inspect published manifests
         run: |
           ghcr_first_tag="$(printf '%s\n' "${{ steps.meta-ghcr.outputs.tags }}" | sed -n '1p')"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "langfuse",
-  "version": "3.167.3",
+  "version": "3.167.4",
   "author": "engineering@langfuse.com",
   "license": "MIT",
   "private": true,
@@ -108,7 +108,8 @@
       "@types/node-fetch": "^2.6.13",
       "@types/react-dom": "19.2.3",
       "glob": "^10.5.0",
-      "qs": "6.14.1"
+      "qs": "6.14.1",
+      "path-to-regexp@0.1.12": "0.1.13"
     },
     "patchedDependencies": {
       "next-auth@4.24.13": "patches/next-auth@4.24.13.patch"

packages/shared/src/constants/VERSION.ts

@@ -1 +1 @@
-export const VERSION = "v3.167.3";
+export const VERSION = "v3.167.4";

pnpm-lock.yaml

@@ -14,6 +14,7 @@ overrides:
   '@types/react-dom': 19.2.3
   glob: ^10.5.0
   qs: 6.14.1
+  path-to-regexp@0.1.12: 0.1.13
 
 patchedDependencies:
   next-auth@4.24.13:
@@ -9619,8 +9620,8 @@ packages:
     resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
     engines: {node: '>=16 || 14 >=14.18'}
 
-  path-to-regexp@0.1.12:
-    resolution: {integrity: sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==}
+  path-to-regexp@0.1.13:
+    resolution: {integrity: sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==}
 
   path-to-regexp@6.3.0:
     resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
@@ -18602,7 +18603,7 @@ snapshots:
       module-details-from-path: 1.0.4
       mutexify: 1.4.0
       opentracing: 0.14.7
-      path-to-regexp: 0.1.12
+      path-to-regexp: 0.1.13
       pprof-format: 2.1.0
       protobufjs: 7.5.4
       retry: 0.13.1
@@ -22143,7 +22144,7 @@ snapshots:
       lru-cache: 10.4.3
       minipass: 7.1.3
 
-  path-to-regexp@0.1.12: {}
+  path-to-regexp@0.1.13: {}
 
   path-to-regexp@6.3.0: {}
 

web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web",
-  "version": "3.167.3",
+  "version": "3.167.4",
   "private": true,
   "license": "MIT",
   "engines": {

web/src/constants/VERSION.ts

@@ -1 +1 @@
-export const VERSION = "v3.167.3";
+export const VERSION = "v3.167.4";

worker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worker",
-  "version": "3.167.3",
+  "version": "3.167.4",
   "description": "",
   "license": "MIT",
   "private": true,

worker/src/constants/VERSION.ts

@@ -1 +1 @@
-export const VERSION = "v3.167.3";
+export const VERSION = "v3.167.4";

worker/src/features/eventPropagation/handleExperimentBackfill.ts

@@ -837,8 +837,9 @@ async function processExperimentBackfill(
 
   if (datasetRunItems.length === 0) {
     logger.info(
-      "[EXPERIMENT BACKFILL] No dataset run items to process, skipping",
+      "[EXPERIMENT BACKFILL] No dataset run items to process, advancing cursor",
     );
+    await updateBackfillTimestamp(upperBound);
     return;
   }