fix: resolve connect-sqlite3 v0.9.17 breaking change causing Docker startup crash (#6688) - #6706
Conversation
Upstream issue FlowiseAI#6688 reports that flowiseai/flowise:3.1.4 fails to start. The real cause is not 3.1.4 code. It is an unpinned transitive dependency. connect-sqlite3@0.9.17 changed its constructor so `this.db.exec` is no longer a function, so session-store setup throws during boot: TypeError: this.db.exec is not a function at new SQLiteStore (connect-sqlite3/lib/connect-sqlite3.js:56:17) at initializeDBClientAndStore (dist/enterprise/middleware/passport/SessionPersistance.js:96) Because the dependency is unpinned, this affects ANY Flowise container built after 0.9.17 was published -- not just 3.1.4. Reproduced 2026-08-05: official flowiseai/flowise:3.1.3, built earlier -> connect-sqlite3 0.9.16 -> boots fresh build of that same flowise@3.1.3, today -> connect-sqlite3 0.9.17 -> crashes So the "3.1.3 works, 3.1.4 is broken" split people observed is an artifact of WHEN each image was built, not of what changed between the two releases. Pinning to 0.9.16 -- the last working constructor, and what every functioning official image actually shipped -- makes container builds reproducible again. Verified: a fresh flowise@3.1.3 image with this pin reaches "Flowise Server is listening at :3000". Upstream PR FlowiseAI#6706 (PiedPiper911) fixes the same defect in the TypeScript source for source builds. This pin covers npm-installed container builds. Both should land; they address different install paths.
|
Confirming this diagnosis independently — Reproduced 2026-08-05:
Because the dependency is unpinned, every Flowise container built after Your fix is the correct one for source builds. For npm-installed container builds the equivalent is pinning at install time: RUN npm --prefix "$(npm root -g)/flowise" install --no-save connect-sqlite3@0.9.16Both are needed — they cover different install paths. Given upstream froze on 2026-07-29 and this repository is archived on 2026-08-10, this PR is unlikely to be merged here. I've carried the fix into a community continuation fork at https://github.com/dblagbro/flow-wiser, with attribution to this PR and to you in the changelog and release notes. If you'd like it applied as your commit rather than referenced, open a PR there and it will land with you as author — that's how the two adopted CVE fixes from @anupamme (#6682, #6683) were handled. Unofficial fork, not affiliated with FlowiseAI or Workday. Thanks for tracking this down. |
|
Thanks for the independent verification @dblagbro! Good to know the diagnosis is confirmed from your side as well. @FlowiseAI maintainers — the fix pins Let me know if there's anything else needed to get this merged. Thanks! |
upstream-archive/ preserves 347 open pull requests from FlowiseAI/Flowise, captured 2026-08-05 before the 2026-08-10 archive lock, as git am-able patches with original authorship intact. Three have been acted on -- FlowiseAI#6682 and FlowiseAI#6683 (CVEs, with anupamme preserved as commit author) and FlowiseAI#6706 (connect-sqlite3). The other 344 have never been reviewed. MANIFEST.md is explicit that the snapshot exists so the backlog stays "reviewable and re-appliable". It was captured, not fulfilled. Nothing was lost; nothing was gained either. These are the last contributions the upstream community will ever make to this codebase -- upstream is archived and will accept nothing further. They are Apache-2.0, they carry their authors' names, and Flow-Wiser exists as a continuation fork. They are also the cheapest fixes this project will ever get: 129 titles begin with "fix", already written and tested by someone else. Records the shape (129 fix / 173 feat / 5 security / 7 chore / 21 draft), the age skew toward 2026-06 and 2026-07 which suggests most still apply cleanly, and names the three unadopted security PRs as the place to start: FlowiseAI#6672, FlowiseAI#5371 and FlowiseAI#5255 -- contributor-authored hardening that the 116-advisory sweep would not have caught. Two constraints stated plainly. Fifteen patches are permanently incomplete: they touched enterprise/ or IdentityManager.ts, and 196 hunk bodies totalling 14,224 lines were redacted on 2026-08-06 because diff context carries licensed file fragments. They must not be reconstructed -- that is reading licensed content, which ADR-0002 forbids. And apply with --keep-non-patch so authorship survives; a contribution merged without its author's name is a contribution stolen. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ill merging (#18) The 2026-08-05 snapshot was taken because "upstream repository moves to public archive on 2026-08-10, which locks issues and pull requests". That did not happen. Verified 2026-08-12: archived=false, disabled=false, comments still working, and three pull requests merged on 2026-08-07 -- after the documented 2026-07-29 code freeze and after the snapshot was taken. Upstream is frozen, not closed. Contributions can still be commented on and, on this evidence, still merged. This contradicts docs/PROJECT-LOG.md, docs/product.md and docs/STATUS.md, which all assert the archive happened. It also makes a public comment on upstream FlowiseAI#6706 wrong. Both are flagged in DELTA-2026-08-12.md rather than corrected here, because the licensing narrative is REVIEW REQUIRED and belongs to a human. Synced: * 3 new PRs captured as git am-able patches -- FlowiseAI#6714, FlowiseAI#6723, FlowiseAI#6725 * 3 upstream-MERGED fixes this fork does not have, captured to merged-after-snapshot/ -- FlowiseAI#6680, FlowiseAI#6708, FlowiseAI#6709, all maintainer-authored * prs/index.json refreshed 347 -> 346, issues 698 -> 701 * both indexes normalised to a single JSON array; the originals were 11 concatenated per-page arrays that parse only with jq -s. Data was complete in both, only the shape changed. Licence check applied to all six new patches: no diff hunks against packages/server/src/enterprise/ or IdentityManager.ts. All clean, no stripping required, and no hunk content was read to determine it -- decisions made on the diff --git path headers alone, per docs/CLEANROOM-PROTOCOL.md. DELTA-2026-08-12.md also records where Flow-Wiser has already solved a still-open upstream PR, with the fork's fix being the more complete one in every confirmed case: FlowiseAI#6670 and FlowiseAI#6642 (the unpinned Docker version -- this fork's founding defect, still open upstream from two independent reporters), FlowiseAI#6706 (connect-sqlite3), and FlowiseAI#4805 (Node 22, open since 2025-07-06 for the change ADR-0004 completed this week across ten locations rather than three). Contributing any of it back is an outward action and is left for authorization. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rebased fix/docker-sqlite3-breaking-change-6688 onto latest upstream main.
012b10d to
76224c9
Compare
Problem
v0.9.17 changed its API: must now be an already-opened instance instead of a string filename. This causes the Docker image to crash on startup with a fatal error (#6688).
Solution
Updated to create an opened instance before passing it to .
Changes
Fixes #6688