diff --git a/src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json b/src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json
index 4ef18f6a3dd1..f71c5bcbbd06 100644
--- a/src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json	
+++ b/src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json	
@@ -864,21 +864,17 @@
             "legacy": false,
             "lf_version": "1.4.2",
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -888,7 +884,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -980,7 +976,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
diff --git a/src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json b/src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json
index 57e2b448267d..233fcaee9ec1 100644
--- a/src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json	
+++ b/src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json	
@@ -921,21 +921,17 @@
             "legacy": false,
             "lf_version": "1.6.0",
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -945,7 +941,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -1035,7 +1031,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
@@ -1318,21 +1314,17 @@
             "legacy": false,
             "lf_version": "1.6.0",
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -1342,7 +1334,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -1432,7 +1424,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
@@ -1721,21 +1713,17 @@
             "legacy": false,
             "lf_version": "1.6.0",
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -1745,7 +1733,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -1835,7 +1823,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
diff --git a/src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json b/src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json
index 31d32818ac29..40a6f20ca2b8 100644
--- a/src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json	
+++ b/src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json	
@@ -1530,21 +1530,17 @@
             "last_updated": "2026-02-12T20:48:13.882Z",
             "legacy": false,
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -1554,7 +1550,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -1636,7 +1632,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
diff --git a/src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json b/src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json
index 127b87c91328..e7969703a9c9 100644
--- a/src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json	
+++ b/src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json	
@@ -820,21 +820,17 @@
             "legacy": false,
             "lf_version": "1.2.0",
             "metadata": {
-              "code_hash": "d5cd3660cc15",
+              "code_hash": "2e225a90043a",
               "dependencies": {
                 "dependencies": [
                   {
-                    "name": "requests",
-                    "version": "2.34.2"
+                    "name": "httpx",
+                    "version": "0.28.1"
                   },
                   {
                     "name": "bs4",
                     "version": "4.12.3"
                   },
-                  {
-                    "name": "langchain_community",
-                    "version": "0.4.2"
-                  },
                   {
                     "name": "markitdown",
                     "version": "0.1.6"
@@ -844,7 +840,7 @@
                     "version": null
                   }
                 ],
-                "total_dependencies": 5
+                "total_dependencies": 4
               },
               "module": "lfx.components.data_source.url.URLComponent"
             },
@@ -924,7 +920,7 @@
                 "show": true,
                 "title_case": false,
                 "type": "code",
-                "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+                "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
               },
               "continue_on_failure": {
                 "_input_type": "BoolInput",
diff --git a/src/backend/tests/unit/components/data_source/test_dns_rebinding.py b/src/backend/tests/unit/components/data_source/test_dns_rebinding.py
index ac25f635f724..b20eee0dde59 100644
--- a/src/backend/tests/unit/components/data_source/test_dns_rebinding.py
+++ b/src/backend/tests/unit/components/data_source/test_dns_rebinding.py
@@ -1,7 +1,8 @@
-"""Test DNS rebinding protection in API Request component.
+"""Test DNS rebinding protection in API Request and URL components.
 
 This test suite verifies that the DNS pinning implementation prevents
-DNS rebinding attacks that could bypass SSRF protection.
+DNS rebinding attacks that could bypass SSRF protection in both the
+API Request component and the URL component.
 """
 # ruff: noqa: ARG001, SIM117
 
@@ -13,6 +14,7 @@
 import httpx
 import pytest
 from lfx.components.data_source.api_request import APIRequestComponent
+from lfx.components.data_source.url import URLComponent
 from lfx.schema import Data
 
 
@@ -426,3 +428,393 @@ async def mock_connect_tcp(self, host, port, **kwargs):
         # The redirect target was resolved exactly once (validation only); httpx never
         # re-resolved it, so a rebinding flip after validation has no effect.
         assert resolved.count("rebind.example.com") == 1, resolved
+
+
+class TestURLComponentDNSRebindingProtection:
+    """Test DNS rebinding attack prevention in URL component.
+
+    This test suite verifies that the URL component is protected against DNS rebinding
+    attacks where an attacker controls a DNS server that returns different IPs on
+    successive queries.
+    """
+
+    @pytest.mark.asyncio
+    async def test_url_component_prevents_dns_rebinding_attack(self):
+        """Test that URL component prevents DNS rebinding attacks via DNS pinning.
+
+        This is a regression test for the SSRF vulnerability reported in the security disclosure.
+        It verifies that only ONE DNS query occurs during the entire fetch operation.
+
+        Attack scenario:
+        1. First DNS query: attacker.test -> 1.1.1.1 (public IP, passes validation)
+        2. Attacker changes DNS with TTL=0
+        3. Second DNS query: attacker.test -> 127.0.0.1 (localhost, should be blocked)
+        4. Without DNS pinning: fetch reaches localhost (SSRF bypass)
+        5. With DNS pinning: fetch uses pinned 1.1.1.1 (attack prevented)
+        """
+        call_count = 0
+        connected_to_ip = None
+
+        def mock_getaddrinfo(_hostname, _port, *_args, **_kwargs):
+            """Mock DNS resolution to simulate rebinding attack."""
+            nonlocal call_count
+            call_count += 1
+
+            if call_count == 1:
+                # First call (during validation): return public IP
+                return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("1.1.1.1", 0))]
+            # Second call (during httpx request): return localhost
+            # This simulates the DNS rebinding attack
+            # With DNS pinning, this should NOT be called
+            return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 0))]
+
+        # Mock the network backend's connect_tcp to capture the actual IP being connected to
+        async def mock_connect_tcp(self, host, port, **kwargs):
+            """Capture the IP that's actually being connected to."""
+            nonlocal connected_to_ip
+            connected_to_ip = host
+            # Return a mock stream with HTML content
+            return httpcore.AsyncMockStream(
+                [
+                    b"HTTP/1.1 200 OK\r\n",
+                    b"Content-Type: text/html\r\n",
+                    b"Content-Length: 38\r\n",
+                    b"\r\n",
+                    b"<html><body>Test content</body></html>",
+                ]
+            )
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+            patch.object(httpcore.AnyIOBackend, "connect_tcp", mock_connect_tcp),
+        ):
+            # Create URL component
+            component = URLComponent()
+            component.urls = ["http://attacker.test/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = [{"key": "User-Agent", "value": "Test"}]
+            component.timeout = 30
+            component.prevent_outside = True
+            component.use_async = True
+            component.filter_text_html = False
+            component.continue_on_failure = False
+            component.check_response_status = False
+            component.autoset_encoding = True
+
+            # Execute the component
+            result = await component.fetch_url_contents()
+
+            # Verify results
+            assert len(result) == 1
+            assert "Test content" in result[0]["text"]
+
+            # CRITICAL VERIFICATION: Only ONE DNS query should have occurred
+            assert call_count == 1, (
+                f"DNS rebinding attack NOT prevented! "
+                f"Expected 1 DNS query (during validation), but {call_count} occurred. "
+                f"The URL component is vulnerable to DNS rebinding attacks."
+            )
+
+            # Verify the connection was made to the pinned IP
+            assert connected_to_ip is not None, "No TCP connection was made"
+            assert connected_to_ip == "1.1.1.1", (
+                f"Connection should be to pinned IP 1.1.1.1, but was to {connected_to_ip}. DNS pinning failed!"
+            )
+
+    @pytest.mark.asyncio
+    async def test_url_component_blocks_localhost_on_first_query(self):
+        """Test that localhost is blocked even on the first DNS query."""
+
+        def mock_getaddrinfo_localhost(hostname, port, *args, **kwargs):
+            """Return localhost immediately."""
+            return [
+                (
+                    socket.AF_INET,
+                    socket.SOCK_STREAM,
+                    6,
+                    "",
+                    ("127.0.0.1", port or 0),
+                )
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo_localhost),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            component = URLComponent()
+            component.urls = ["http://localhost-test.example/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+
+            # Should raise ValueError due to SSRF protection
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.fetch_url_contents()
+
+    @pytest.mark.asyncio
+    async def test_url_component_blocks_aws_metadata_on_first_query(self):
+        """Test that AWS metadata endpoint is blocked even on the first DNS query."""
+
+        def mock_getaddrinfo_metadata(hostname, port, *args, **kwargs):
+            """Return AWS metadata IP immediately."""
+            return [
+                (
+                    socket.AF_INET,
+                    socket.SOCK_STREAM,
+                    6,
+                    "",
+                    ("169.254.169.254", port or 0),
+                )
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo_metadata),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            component = URLComponent()
+            component.urls = ["http://metadata.example/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+
+            # Should raise ValueError due to SSRF protection
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.fetch_url_contents()
+
+    @pytest.mark.asyncio
+    async def test_url_component_revalidates_discovered_links(self):
+        """Test that each discovered link during recursive crawling is re-validated.
+
+        This ensures that even if the initial URL is safe, any links discovered
+        during crawling are also validated before being fetched.
+        """
+        call_count = 0
+        validated_hosts = []
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Track which hosts are validated."""
+            nonlocal call_count
+            call_count += 1
+            validated_hosts.append(hostname)
+
+            # First host (safe.com) resolves to public IP
+            if hostname == "safe.com":
+                return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("1.1.1.1", 0))]
+            # Second host (evil.com) resolves to localhost - should be blocked
+            if hostname == "evil.com":
+                return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 0))]
+            return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("8.8.8.8", 0))]
+
+        async def mock_connect_tcp(self, host, port, **kwargs):
+            """Return HTML with a link to evil.com."""
+            return httpcore.AsyncMockStream(
+                [
+                    b"HTTP/1.1 200 OK\r\n",
+                    b"Content-Type: text/html\r\n",
+                    b"Content-Length: 61\r\n",
+                    b"\r\n",
+                    b'<html><body><a href="http://evil.com/">Link</a></body></html>',
+                ]
+            )
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+            patch.object(httpcore.AnyIOBackend, "connect_tcp", mock_connect_tcp),
+        ):
+            component = URLComponent()
+            component.urls = ["http://safe.com/"]
+            component.max_depth = 2  # Allow following links
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+            component.prevent_outside = False  # Allow external links
+            component.continue_on_failure = True  # Continue even if evil.com is blocked
+
+            # Execute - should fetch safe.com but block evil.com
+            result = await component.fetch_url_contents()
+
+            # Verify safe.com was fetched
+            assert len(result) >= 1
+
+            # Verify both hosts were validated
+            assert "safe.com" in validated_hosts, "Initial URL should be validated"
+            assert "evil.com" in validated_hosts, "Discovered link should be validated"
+
+            # Verify evil.com was blocked (only safe.com content returned)
+            assert len(result) == 1, "evil.com should have been blocked, only safe.com content returned"
+
+    @pytest.mark.asyncio
+    async def test_url_component_blocks_mixed_safe_unsafe_dns_answers(self):
+        """Test that hostnames resolving to both safe and unsafe IPs are blocked.
+
+        This prevents attacks where a hostname resolves to multiple IPs including
+        both public (safe) and private/localhost (unsafe) addresses. The entire
+        hostname must be blocked if ANY resolved IP is unsafe.
+        """
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return both safe and unsafe IPs for the same hostname."""
+            return [
+                # First IP: safe public address
+                (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("8.8.8.8", 0)),
+                # Second IP: unsafe localhost
+                (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 0)),
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            component = URLComponent()
+            component.urls = ["http://mixed-dns.example/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+
+            # Should raise ValueError due to SSRF protection blocking the unsafe IP
+            with pytest.raises(ValueError, match=r"SSRF Protection.*127\.0\.0\.1"):
+                await component.fetch_url_contents()
+
+    @pytest.mark.asyncio
+    async def test_url_component_blocks_ipv4_mapped_ipv6_localhost(self):
+        """Test that IPv4-mapped IPv6 localhost addresses are blocked.
+
+        IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1 are a common SSRF bypass
+        technique. The protection must recognize and block these.
+        """
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return IPv4-mapped IPv6 localhost."""
+            return [
+                (
+                    socket.AF_INET6,
+                    socket.SOCK_STREAM,
+                    6,
+                    "",
+                    ("::ffff:127.0.0.1", 0),
+                )
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            component = URLComponent()
+            component.urls = ["http://ipv4-mapped.example/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+
+            # Should raise ValueError due to SSRF protection
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.fetch_url_contents()
+
+    @pytest.mark.asyncio
+    async def test_url_component_blocks_ipv4_mapped_ipv6_private_network(self):
+        """Test that IPv4-mapped IPv6 private network addresses are blocked.
+
+        Tests ::ffff:192.168.1.1 (IPv4-mapped private network).
+        """
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return IPv4-mapped IPv6 private network address."""
+            return [
+                (
+                    socket.AF_INET6,
+                    socket.SOCK_STREAM,
+                    6,
+                    "",
+                    ("::ffff:192.168.1.1", 0),
+                )
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            component = URLComponent()
+            component.urls = ["http://ipv4-mapped-private.example/"]
+            component.max_depth = 1
+            component.format = "Text"
+            component.headers = []
+            component.timeout = 30
+
+            # Should raise ValueError due to SSRF protection
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.fetch_url_contents()
+
+
+class TestAPIRequestDNSRebindingEdgeCases:
+    """Additional edge case tests for API Request component DNS rebinding protection."""
+
+    @pytest.fixture
+    def component(self):
+        """Create a basic API request component."""
+        return APIRequestComponent(
+            url_input="http://test.example:8080/api",
+            method="GET",
+            headers=[],
+            body=[],
+            timeout=30,
+            follow_redirects=False,
+            save_to_file=False,
+            include_httpx_metadata=False,
+            mode="URL",
+            curl_input="",
+            query_params={},
+        )
+
+    @pytest.mark.asyncio
+    async def test_api_request_blocks_mixed_safe_unsafe_dns_answers(self, component):
+        """Test that hostnames resolving to both safe and unsafe IPs are blocked."""
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return both safe and unsafe IPs."""
+            return [
+                (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("8.8.8.8", 0)),
+                (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 0)),
+            ]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            with pytest.raises(ValueError, match=r"SSRF Protection.*127\.0\.0\.1"):
+                await component.make_api_request()
+
+    @pytest.mark.asyncio
+    async def test_api_request_blocks_ipv4_mapped_ipv6_localhost(self, component):
+        """Test that IPv4-mapped IPv6 localhost is blocked."""
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return IPv4-mapped IPv6 localhost."""
+            return [(socket.AF_INET6, socket.SOCK_STREAM, 6, "", ("::ffff:127.0.0.1", 0))]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.make_api_request()
+
+    @pytest.mark.asyncio
+    async def test_api_request_blocks_ipv4_mapped_ipv6_metadata(self, component):
+        """Test that IPv4-mapped IPv6 AWS metadata is blocked."""
+
+        def mock_getaddrinfo(hostname, port, *args, **kwargs):
+            """Return IPv4-mapped IPv6 AWS metadata address."""
+            return [(socket.AF_INET6, socket.SOCK_STREAM, 6, "", ("::ffff:169.254.169.254", 0))]
+
+        with (
+            patch("socket.getaddrinfo", side_effect=mock_getaddrinfo),
+            patch.dict(os.environ, {"LANGFLOW_SSRF_PROTECTION_ENABLED": "true"}),
+        ):
+            with pytest.raises(ValueError, match="SSRF Protection"):
+                await component.make_api_request()
diff --git a/src/backend/tests/unit/components/data_source/test_url_component.py b/src/backend/tests/unit/components/data_source/test_url_component.py
index 856f16b826a3..4695b11a5dd7 100644
--- a/src/backend/tests/unit/components/data_source/test_url_component.py
+++ b/src/backend/tests/unit/components/data_source/test_url_component.py
@@ -1,14 +1,50 @@
-import os
-from unittest.mock import Mock, patch
+"""Tests for the URL component.
+
+The URL component fetches pages with ``httpx`` and enforces DNS-pinned SSRF
+protection (see ``test_dns_rebinding.py`` for the rebinding-specific coverage).
+These tests exercise content extraction, output formats, URL normalization, and
+the SSRF guard without making real network requests by stubbing the per-URL
+fetch (``_fetch_url_with_pinning``) and, for SSRF, validating direct IPs.
+"""
 
 import pytest
 from lfx.components.data_source.url import URLComponent
 from lfx.schema import DataFrame
-from lfx.utils.ssrf_protection import SSRFProtectionError
 
 from tests.base import ComponentTestBaseWithoutClient
 
 
+def _static_fetch(html: str, metadata: dict):
+    """Build an async stand-in for ``URLComponent._fetch_url_with_pinning``.
+
+    Returns the same ``(html, metadata)`` for every URL so tests can drive the
+    extraction / formatting logic without any network access.
+    """
+
+    async def _fetch(_self, _url, _validated_ips, _headers):
+        return html, metadata
+
+    return _fetch
+
+
+def _per_url_fetch(pages: dict):
+    """Async stand-in returning ``(html, metadata)`` keyed by the requested URL.
+
+    Unknown URLs yield empty content (treated as "nothing fetched").
+    """
+
+    async def _fetch(_self, url, _validated_ips, _headers):
+        return pages.get(url, ("", {}))
+
+    return _fetch
+
+
+@pytest.fixture
+def disable_ssrf(monkeypatch):
+    """Disable SSRF protection so ``ensure_url`` skips DNS resolution."""
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "false")
+
+
 class TestURLComponent(ComponentTestBaseWithoutClient):
     @pytest.fixture
     def component_class(self):
@@ -36,30 +72,26 @@ def file_names_mapping(self):
             {"version": "1.2.0", "module": "data", "file_name": "url"},
         ]
 
-    @pytest.fixture
-    def mock_recursive_loader(self):
-        """Mock the RecursiveUrlLoader.load method."""
-        with patch("langchain_community.document_loaders.RecursiveUrlLoader.load") as mock:
-            yield mock
-
-    def test_url_component_basic_functionality(self, mock_recursive_loader):
-        """Test basic URLComponent functionality."""
-        component = URLComponent()
-        component.set_attributes({"urls": ["https://example.com"], "max_depth": 2})
-
-        mock_doc = Mock(
-            page_content="test content",
-            metadata={
-                "source": "https://example.com",
-                "title": "Test Page",
-                "description": "Test Description",
-                "content_type": "text/html",
-                "language": "en",
-            },
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_basic_functionality(self, monkeypatch):
+        """Fetched content and metadata are surfaced on the output DataFrame."""
+        metadata = {
+            "source": "https://example.com",
+            "title": "Test Page",
+            "description": "Test Description",
+            "content_type": "text/html",
+            "language": "en",
+        }
+        monkeypatch.setattr(
+            URLComponent,
+            "_fetch_url_with_pinning",
+            _static_fetch("<html><body>test content</body></html>", metadata),
         )
-        mock_recursive_loader.return_value = [mock_doc]
+        component = URLComponent()
+        component.set_attributes({"urls": ["https://example.com"], "max_depth": 1, "format": "Text"})
 
-        data_frame = component.fetch_content()
+        data_frame = await component.fetch_content()
         assert isinstance(data_frame, DataFrame)
         assert len(data_frame) == 1
 
@@ -71,375 +103,168 @@ def test_url_component_basic_functionality(self, mock_recursive_loader):
         assert row["content_type"] == "text/html"
         assert row["language"] == "en"
 
-    def test_url_component_multiple_urls(self, mock_recursive_loader):
-        """Test URLComponent with multiple URL inputs."""
-        # Setup component with multiple URLs
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_multiple_urls(self, monkeypatch):
+        """Each provided URL produces its own row."""
+        pages = {
+            "https://example.com": ("<html><body>first</body></html>", {"source": "https://example.com"}),
+            "https://example.org": ("<html><body>second</body></html>", {"source": "https://example.org"}),
+        }
+        monkeypatch.setattr(URLComponent, "_fetch_url_with_pinning", _per_url_fetch(pages))
         component = URLComponent()
-        urls = ["https://example1.com", "https://example2.com"]
-        component.set_attributes({"urls": urls})
-
-        # Create mock documents for each URL
-        mock_docs = [
-            Mock(
-                page_content="Content from first URL",
-                metadata={
-                    "source": "https://example1.com",
-                    "title": "First Page",
-                    "description": "First Description",
-                    "content_type": "text/html",
-                    "language": "en",
-                },
-            ),
-            Mock(
-                page_content="Content from second URL",
-                metadata={
-                    "source": "https://example2.com",
-                    "title": "Second Page",
-                    "description": "Second Description",
-                    "content_type": "text/html",
-                    "language": "en",
-                },
-            ),
-        ]
-
-        # Configure mock to return both documents
-        mock_recursive_loader.return_value = mock_docs
-
-        # Execute component
-        result = component.fetch_content()
-
-        # Verify results
-        assert isinstance(result, DataFrame)
-        assert len(result) == 4
-
-        # Verify first URL content
-        first_row = result.iloc[0]
-        assert first_row["text"] == "Content from first URL"
-        assert first_row["url"] == "https://example1.com"
-        assert first_row["title"] == "First Page"
-        assert first_row["description"] == "First Description"
-
-        # Verify second URL content
-        second_row = result.iloc[1]
-        assert second_row["text"] == "Content from second URL"
-        assert second_row["url"] == "https://example2.com"
-        assert second_row["title"] == "Second Page"
-        assert second_row["description"] == "Second Description"
-
-    def test_url_component_text_format(self, mock_recursive_loader):
-        """Test URLComponent with text format."""
+        component.set_attributes({"urls": ["https://example.com", "https://example.org"], "max_depth": 1})
+
+        data_frame = await component.fetch_content()
+        assert len(data_frame) == 2
+        texts = set(data_frame["text"])
+        assert texts == {"first", "second"}
+
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_text_format(self, monkeypatch):
+        """Text format strips HTML tags to plain text."""
+        html = "<html><body><h1>Heading</h1><p>Hello world</p></body></html>"
+        monkeypatch.setattr(
+            URLComponent, "_fetch_url_with_pinning", _static_fetch(html, {"source": "https://example.com"})
+        )
         component = URLComponent()
         component.set_attributes({"urls": ["https://example.com"], "format": "Text"})
 
-        mock_recursive_loader.return_value = [
-            Mock(
-                page_content="extracted text",
-                metadata={
-                    "source": "https://example.com",
-                    "title": "Test Page",
-                    "description": "Test Description",
-                    "content_type": "text/html",
-                    "language": "en",
-                },
-            )
-        ]
-        data_frame = component.fetch_content()
-        assert data_frame.iloc[0]["text"] == "extracted text"
-        assert data_frame.iloc[0]["content_type"] == "text/html"
-
-    def test_url_component_html_format(self, mock_recursive_loader):
-        """Test URLComponent with different format options."""
+        data_frame = await component.fetch_content()
+        text = data_frame.iloc[0]["text"]
+        assert "<h1>" not in text
+        assert "Heading" in text
+        assert "Hello world" in text
+
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_html_format(self, monkeypatch):
+        """HTML format preserves the raw markup."""
+        html = "<html><body><h1>Heading</h1><p>Hello world</p></body></html>"
+        monkeypatch.setattr(
+            URLComponent, "_fetch_url_with_pinning", _static_fetch(html, {"source": "https://example.com"})
+        )
         component = URLComponent()
-
-        # Test with HTML format
         component.set_attributes({"urls": ["https://example.com"], "format": "HTML"})
-        mock_recursive_loader.return_value = [
-            Mock(
-                page_content="<html>raw html</html>",
-                metadata={
-                    "source": "https://example.com",
-                    "title": "Test Page",
-                    "description": "Test Description",
-                    "content_type": "text/html",
-                    "language": "en",
-                },
-            )
-        ]
-        data_frame = component.fetch_content()
-        assert data_frame.iloc[0]["text"] == "<html>raw html</html>"
-        assert data_frame.iloc[0]["content_type"] == "text/html"
 
-    def test_url_component_markdown_format(self, mock_recursive_loader):
-        """Test URLComponent with Markdown format."""
+        data_frame = await component.fetch_content()
+        text = data_frame.iloc[0]["text"]
+        assert "<h1>Heading</h1>" in text
+
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_markdown_format(self, monkeypatch):
+        """Markdown format converts HTML headings/paragraphs to markdown."""
+        html = "<html><body><h1>Heading</h1><p>Hello world</p></body></html>"
+        monkeypatch.setattr(
+            URLComponent, "_fetch_url_with_pinning", _static_fetch(html, {"source": "https://example.com"})
+        )
         component = URLComponent()
-
         component.set_attributes({"urls": ["https://example.com"], "format": "Markdown"})
-        mock_recursive_loader.return_value = [
-            Mock(
-                page_content="# Header\n\nParagraph with a [link](https://link.com).\n",
-                metadata={
-                    "source": "https://example.com",
-                    "title": "Test Page",
-                    "description": "Test Description",
-                    "content_type": "text/html",
-                    "language": "en",
-                },
-            )
-        ]
 
-        data_frame = component.fetch_content()
-        assert data_frame.iloc[0]["text"] == "# Header\n\nParagraph with a [link](https://link.com).\n"
-        assert data_frame.iloc[0]["content_type"] == "text/html"
-
-    def test_url_component_missing_metadata(self, mock_recursive_loader):
-        """Test URLComponent with missing metadata fields."""
+        data_frame = await component.fetch_content()
+        text = data_frame.iloc[0]["text"]
+        assert "# Heading" in text
+        assert "Hello world" in text
+
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_missing_metadata(self, monkeypatch):
+        """Missing metadata fields default to empty strings."""
+        monkeypatch.setattr(
+            URLComponent,
+            "_fetch_url_with_pinning",
+            _static_fetch("<html><body>test content</body></html>", {"source": "https://example.com"}),
+        )
         component = URLComponent()
         component.set_attributes({"urls": ["https://example.com"]})
 
-        mock_doc = Mock(
-            page_content="test content",
-            metadata={"source": "https://example.com"},  # Only source is provided
-        )
-        mock_recursive_loader.return_value = [mock_doc]
-
-        data_frame = component.fetch_content()
+        data_frame = await component.fetch_content()
         row = data_frame.iloc[0]
         assert row["text"] == "test content"
         assert row["url"] == "https://example.com"
-        assert row["title"] == ""  # Default empty string
-        assert row["description"] == ""  # Default empty string
-        assert row["content_type"] == ""  # Default empty string
-        assert row["language"] == ""  # Default empty string
-
-    def test_url_component_error_handling(self, mock_recursive_loader):
-        """Test error handling in URLComponent."""
+        assert row["title"] == ""
+        assert row["description"] == ""
+        assert row["content_type"] == ""
+        assert row["language"] == ""
+
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_error_handling_empty_urls(self):
+        """An empty URL list raises a clear error."""
         component = URLComponent()
-
-        # Test empty URLs
         component.set_attributes({"urls": []})
         with pytest.raises(ValueError, match="Error loading documents:"):
-            component.fetch_content()
+            await component.fetch_content()
 
-        # Test request exception
+    @pytest.mark.asyncio
+    @pytest.mark.usefixtures("disable_ssrf")
+    async def test_url_component_error_handling_no_documents(self, monkeypatch):
+        """When no page yields content, a 'no documents' error is raised."""
+        monkeypatch.setattr(URLComponent, "_fetch_url_with_pinning", _static_fetch("", {}))
+        component = URLComponent()
         component.set_attributes({"urls": ["https://example.com"]})
-        mock_recursive_loader.side_effect = Exception("Connection error")
-        with pytest.raises(ValueError, match="Error loading documents:"):
-            component.fetch_content()
-
-        # Test no documents found
-        mock_recursive_loader.side_effect = None
-        mock_recursive_loader.return_value = []
         with pytest.raises(ValueError, match="Error loading documents:"):
-            component.fetch_content()
+            await component.fetch_content()
 
+    @pytest.mark.usefixtures("disable_ssrf")
     def test_url_component_ensure_url(self):
-        """Test URLComponent's ensure_url method."""
+        """ensure_url normalizes the scheme and rejects malformed URLs."""
         component = URLComponent()
 
-        # Test URL without protocol
-        url = "example.com"
-        fixed_url = component.ensure_url(url)
-        assert fixed_url == "https://example.com"
+        # Missing scheme defaults to https; returns (url, pinned_ips).
+        url, ips = component.ensure_url("example.com")
+        assert url == "https://example.com"
+        assert ips == []
 
-        # Test URL with protocol
-        url = "https://example.com"
-        fixed_url = component.ensure_url(url)
-        assert fixed_url == "https://example.com"
+        # Existing scheme is preserved.
+        url, _ips = component.ensure_url("https://example.com")
+        assert url == "https://example.com"
 
-        # Test URL with https protocol
-        url = "https://example.com"
-        fixed_url = component.ensure_url(url)
-        assert fixed_url == "https://example.com"
-
-        # Test invalid URL
+        # Malformed URL is rejected.
         with pytest.raises(ValueError, match="Invalid URL"):
             component.ensure_url("not a url")
 
 
 class TestURLComponentSSRFProtection:
-    """Test SSRF protection in URLComponent."""
+    """SSRF protection is enforced when ensuring and fetching URLs."""
 
-    def test_ssrf_validation_called_on_ensure_url(self):
-        """Test that SSRF validation is called when ensuring URL."""
-        component = URLComponent()
+    @pytest.fixture(autouse=True)
+    def enable_ssrf(self, monkeypatch):
+        """Enable SSRF protection with an empty allowlist for these tests."""
+        monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+        monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
 
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            component.ensure_url("https://example.com")
-            mock_validate.assert_called_once_with("https://example.com", warn_only=False)
-
-    def test_ssrf_blocks_localhost(self):
-        """Test that localhost is blocked when SSRF validation raises."""
+    def test_ensure_url_blocks_localhost(self):
+        """Loopback addresses are blocked."""
         component = URLComponent()
+        with pytest.raises(ValueError, match="SSRF Protection"):
+            component.ensure_url("http://127.0.0.1:8080")
 
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            mock_validate.side_effect = SSRFProtectionError("Access to IP address 127.0.0.1 is blocked")
-
-            with pytest.raises(ValueError, match="SSRF Protection"):
-                component.ensure_url("http://127.0.0.1:8080")
-
-    def test_ssrf_blocks_private_ip(self):
-        """Test that private IPs are blocked when SSRF validation raises."""
+    def test_ensure_url_blocks_private_ip(self):
+        """RFC 1918 private addresses are blocked."""
         component = URLComponent()
+        with pytest.raises(ValueError, match="SSRF Protection"):
+            component.ensure_url("http://192.168.1.1/admin")
 
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            mock_validate.side_effect = SSRFProtectionError("Access to IP address 192.168.1.1 is blocked")
-
-            with pytest.raises(ValueError, match="SSRF Protection"):
-                component.ensure_url("http://192.168.1.1/admin")
-
-    def test_ssrf_blocks_metadata_endpoint(self):
-        """Test that cloud metadata endpoints are blocked when SSRF validation raises."""
+    def test_ensure_url_blocks_metadata_endpoint(self):
+        """The cloud metadata endpoint is blocked."""
         component = URLComponent()
+        with pytest.raises(ValueError, match="SSRF Protection"):
+            component.ensure_url("http://169.254.169.254/latest/meta-data/")
 
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            mock_validate.side_effect = SSRFProtectionError("Access to IP address 169.254.169.254 is blocked")
-
-            with pytest.raises(ValueError, match="SSRF Protection"):
-                component.ensure_url("http://169.254.169.254/latest/meta-data/")
-
-    def test_ssrf_allows_public_urls(self):
-        """Test that public URLs are allowed when validation passes."""
+    def test_ensure_url_allows_public_ip(self):
+        """A public IP passes and is returned for DNS pinning."""
         component = URLComponent()
+        url, ips = component.ensure_url("http://8.8.8.8/")
+        assert url == "http://8.8.8.8/"
+        assert ips == ["8.8.8.8"]
 
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            mock_validate.return_value = None
-
-            url = component.ensure_url("https://www.google.com")
-            assert url == "https://www.google.com"
-            mock_validate.assert_called_once()
-
-    def test_ssrf_blocking_mode(self):
-        """Test that warn_only=False is passed to validation for actual blocking."""
-        component = URLComponent()
-
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            component.ensure_url("https://example.com")
-
-            # Verify warn_only=False is passed to enforce blocking when SSRF protection is enabled
-            mock_validate.assert_called_with("https://example.com", warn_only=False)
-
-    def test_ssrf_protection_in_fetch_content(self):
-        """Test that SSRF protection is applied during fetch_content."""
+    @pytest.mark.asyncio
+    async def test_ssrf_protection_in_fetch_content(self):
+        """A blocked URL surfaces the SSRF error from fetch_content (not a generic message)."""
         component = URLComponent()
         component.set_attributes({"urls": ["http://127.0.0.1:9999"]})
-
-        with patch("lfx.components.data_source.url.validate_url_for_ssrf") as mock_validate:
-            mock_validate.side_effect = SSRFProtectionError("Access to IP address 127.0.0.1 is blocked")
-
-            with pytest.raises(ValueError, match="SSRF Protection"):
-                component.fetch_content()
-
-
-class TestURLComponentProxyHandling:
-    """Test proxy detection in URLComponent._create_loader."""
-
-    @staticmethod
-    def _default_attributes() -> dict:
-        return {
-            "urls": ["https://example.com"],
-            "use_async": True,
-            "max_depth": 1,
-            "timeout": 30,
-            "format": "Text",
-            "prevent_outside": True,
-            "headers": [{"key": "User-Agent", "value": "test"}],
-        }
-
-    @patch.dict(os.environ, {}, clear=True)
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_proxy_disabled_when_no_proxy_env(self, mock_recursive_loader_class):
-        """use_async stays True when no proxy environment variable is set."""
-        component = URLComponent()
-        component.set_attributes(self._default_attributes())
-
-        component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is True
-
-    @patch.dict(os.environ, {"HTTP_PROXY": "http://127.0.0.1:8080"}, clear=True)
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    @patch("lfx.components.data_source.url.logger")
-    def test_url_component_proxy_forces_sync_mode(self, mock_logger, mock_recursive_loader_class):
-        """A populated proxy var forces use_async=False and emits a warning."""
-        component = URLComponent()
-        component.set_attributes(self._default_attributes())
-
-        component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is False
-
-        mock_logger.warning.assert_called_once()
-        assert "Proxy environment variables detected" in mock_logger.warning.call_args[0][0]
-
-    @pytest.mark.parametrize(
-        "env_var",
-        ["http_proxy", "HTTP_PROXY", "https_proxy", "HTTPS_PROXY", "all_proxy", "ALL_PROXY"],
-    )
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_each_proxy_variant_forces_sync_mode(self, mock_recursive_loader_class, env_var):
-        """All supported proxy environment variable spellings disable async mode."""
-        with patch.dict(os.environ, {env_var: "http://proxy.local:3128"}, clear=True):
-            component = URLComponent()
-            component.set_attributes(self._default_attributes())
-            component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is False
-
-    @patch.dict(os.environ, {"HTTPS_PROXY": ""}, clear=True)
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_empty_proxy_is_ignored(self, mock_recursive_loader_class):
-        """An empty proxy environment variable does not disable async mode."""
-        component = URLComponent()
-        component.set_attributes(self._default_attributes())
-
-        component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is True
-
-    @patch.dict(os.environ, {"HTTP_PROXY": "   ", "HTTPS_PROXY": " \t "}, clear=True)
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_whitespace_proxy_is_ignored(self, mock_recursive_loader_class):
-        """Whitespace-only proxy environment variables do not disable async mode."""
-        component = URLComponent()
-        component.set_attributes(self._default_attributes())
-
-        component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is True
-
-    @patch.dict(
-        os.environ,
-        {"HTTP_PROXY": "http://primary:3128", "HTTPS_PROXY": "http://secondary:3128"},
-        clear=True,
-    )
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_multiple_proxies_set_disables_async(self, mock_recursive_loader_class):
-        """Multiple simultaneous proxy variables still disable async mode."""
-        component = URLComponent()
-        component.set_attributes(self._default_attributes())
-
-        component._create_loader("https://example.com")
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is False
-
-    @patch.dict(os.environ, {"HTTP_PROXY": "http://proxy.local:3128"}, clear=True)
-    @patch("lfx.components.data_source.url.RecursiveUrlLoader")
-    def test_url_component_use_async_false_stays_false_with_proxy(self, mock_recursive_loader_class):
-        """When use_async is already False, no warning is logged and the value is preserved."""
-        component = URLComponent()
-        attributes = self._default_attributes()
-        attributes["use_async"] = False
-        component.set_attributes(attributes)
-
-        with patch("lfx.components.data_source.url.logger") as mock_logger:
-            component._create_loader("https://example.com")
-            mock_logger.warning.assert_not_called()
-
-        mock_recursive_loader_class.assert_called_once()
-        assert mock_recursive_loader_class.call_args.kwargs["use_async"] is False
+        with pytest.raises(ValueError, match="SSRF Protection"):
+            await component.fetch_url_contents()
diff --git a/src/backend/tests/unit/components/processing/test_split_text_component.py b/src/backend/tests/unit/components/processing/test_split_text_component.py
index e8fb5417b9f8..230b7d854887 100644
--- a/src/backend/tests/unit/components/processing/test_split_text_component.py
+++ b/src/backend/tests/unit/components/processing/test_split_text_component.py
@@ -272,11 +272,11 @@ def test_split_text_with_dataframe_input(self):
         assert "Another text" in results["text"][2], f"Expected 'Another text', got '{results['text'][2]}'"
         assert "Another line" in results["text"][3], f"Expected 'Another line', got '{results['text'][3]}'"
 
-    def test_with_url_loader(self):
+    async def test_with_url_loader(self):
         """Test splitting text with URL loader."""
         component = SplitTextComponent()
         url = ["https://en.wikipedia.org/wiki/London", "https://en.wikipedia.org/wiki/Paris"]
-        data_frame = URLComponent(urls=url, format="Text").fetch_content()
+        data_frame = await URLComponent(urls=url, format="Text").fetch_content()
         assert isinstance(data_frame, DataFrame), "Expected DataFrame instance"
         assert len(data_frame) == 2, f"Expected DataFrame with 2 rows, got {len(data_frame)}"
 
diff --git a/src/lfx/src/lfx/_assets/component_index.json b/src/lfx/src/lfx/_assets/component_index.json
index c67a21592afe..a4d59e2003b7 100644
--- a/src/lfx/src/lfx/_assets/component_index.json
+++ b/src/lfx/src/lfx/_assets/component_index.json
@@ -58880,21 +58880,17 @@
           "icon": "layout-template",
           "legacy": false,
           "metadata": {
-            "code_hash": "d5cd3660cc15",
+            "code_hash": "2e225a90043a",
             "dependencies": {
               "dependencies": [
                 {
-                  "name": "requests",
-                  "version": "2.34.2"
+                  "name": "httpx",
+                  "version": "0.28.1"
                 },
                 {
                   "name": "bs4",
                   "version": "4.12.3"
                 },
-                {
-                  "name": "langchain_community",
-                  "version": "0.4.2"
-                },
                 {
                   "name": "markitdown",
                   "version": "0.1.6"
@@ -58904,7 +58900,7 @@
                   "version": null
                 }
               ],
-              "total_dependencies": 5
+              "total_dependencies": 4
             },
             "module": "lfx.components.data_source.url.URLComponent"
           },
@@ -58999,7 +58995,7 @@
               "show": true,
               "title_case": false,
               "type": "code",
-              "value": "import importlib\nimport io\nimport os\nimport re\n\nimport requests\nfrom bs4 import BeautifulSoup\nfrom langchain_community.document_loaders import RecursiveUrlLoader\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> str:\n        \"\"\"Ensures the given string is a valid URL.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            str: The normalized URL\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # SSRF Protection: Validate URL to prevent access to internal resources\n        # Blocks requests to private IPs, localhost, and cloud metadata endpoints\n        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true\n        try:\n            validate_url_for_ssrf(url, warn_only=False)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n\n        return url\n\n    def _create_loader(self, url: str) -> RecursiveUrlLoader:\n        \"\"\"Creates a RecursiveUrlLoader instance with the configured settings.\n\n        Args:\n            url: The URL to load\n\n        Returns:\n            RecursiveUrlLoader: Configured loader instance\n        \"\"\"\n        headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n\n        proxy_env_keys = (\n            \"http_proxy\",\n            \"HTTP_PROXY\",\n            \"https_proxy\",\n            \"HTTPS_PROXY\",\n            \"all_proxy\",\n            \"ALL_PROXY\",\n        )\n        has_proxy = any((os.environ.get(key) or \"\").strip() for key in proxy_env_keys)\n\n        final_use_async = self.use_async\n        if has_proxy and self.use_async:\n            logger.warning(\n                \"Proxy environment variables detected. Disabling 'use_async' in URLComponent \"\n                \"as the underlying async loader does not reliably respect system proxies. \"\n                \"Crawling will proceed synchronously (which may be slower).\"\n            )\n            final_use_async = False\n\n        return RecursiveUrlLoader(\n            url=url,\n            max_depth=self.max_depth,\n            prevent_outside=self.prevent_outside,\n            use_async=final_use_async,\n            extractor=extractor,\n            timeout=self.timeout,\n            headers=headers_dict,\n            check_response_status=self.check_response_status,\n            continue_on_failure=self.continue_on_failure,\n            base_url=url,  # Add base_url to ensure consistent domain crawling\n            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection\n            exclude_dirs=[],  # Allow customization of excluded directories\n            link_regex=None,  # Allow customization of link filtering\n        )\n\n    def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs.\n\n        Returns:\n            List[Data]: List of Data objects containing the fetched content\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})\n            logger.debug(f\"URLs: {urls}\")\n            if not urls:\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            all_docs = []\n            for url in urls:\n                logger.debug(f\"Loading documents from {url}\")\n\n                try:\n                    loader = self._create_loader(url)\n                    docs = loader.load()\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} documents from {url}\")\n                    all_docs.extend(docs)\n\n                except requests.exceptions.RequestException as e:\n                    logger.exception(f\"Error loading documents from {url}: {e}\")\n                    continue\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]\n            data = [\n                {\n                    \"text\": safe_convert(doc.page_content, clean_data=True),\n                    \"url\": doc.metadata.get(\"source\", \"\"),\n                    \"title\": doc.metadata.get(\"title\", \"\"),\n                    \"description\": doc.metadata.get(\"description\", \"\"),\n                    \"content_type\": doc.metadata.get(\"content_type\", \"\"),\n                    \"language\": doc.metadata.get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else e\n            msg = f\"Error loading documents: {error_msg!s}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n        return data\n\n    def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        return DataFrame(data=self.fetch_url_contents())\n\n    def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
+              "value": "import importlib.util\nimport io\nimport re\nfrom urllib.parse import urljoin, urlparse\n\nimport httpx\nfrom bs4 import BeautifulSoup\nfrom markitdown import MarkItDown\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.field_typing.range_spec import RangeSpec\nfrom lfx.helpers.data import safe_convert\nfrom lfx.io import BoolInput, DropdownInput, IntInput, MessageTextInput, Output, SliderInput, TableInput\nfrom lfx.log.logger import logger\nfrom lfx.schema.dataframe import DataFrame\nfrom lfx.schema.message import Message\nfrom lfx.utils.request_utils import get_user_agent\nfrom lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url\nfrom lfx.utils.ssrf_transport import create_ssrf_protected_client\n\n# Constants\nDEFAULT_TIMEOUT = 30\nDEFAULT_MAX_DEPTH = 1\nDEFAULT_FORMAT = \"Text\"\n\n\nURL_REGEX = re.compile(\n    r\"^(https?:\\/\\/)?\" r\"(www\\.)?\" r\"([a-zA-Z0-9.-]+)\" r\"(\\.[a-zA-Z]{2,})?\" r\"(:\\d+)?\" r\"(\\/[^\\s]*)?$\",\n    re.IGNORECASE,\n)\n\nUSER_AGENT = None\n# Check if langflow is installed using importlib.util.find_spec(name))\nif importlib.util.find_spec(\"langflow\"):\n    langflow_installed = True\n    USER_AGENT = get_user_agent()\nelse:\n    langflow_installed = False\n    USER_AGENT = \"lfx\"\n\n\nclass URLComponent(Component):\n    \"\"\"A component that loads and parses content from web pages recursively.\n\n    This component allows fetching content from one or more URLs, with options to:\n    - Control crawl depth\n    - Prevent crawling outside the root domain\n    - Use async loading for better performance\n    - Extract either raw HTML or clean text\n    - Configure request headers and timeouts\n    \"\"\"\n\n    display_name = \"URL\"\n    description = \"Fetch content from one or more web pages, following links recursively.\"\n    documentation: str = \"https://docs.langflow.org/url\"\n    icon = \"layout-template\"\n    name = \"URLComponent\"\n\n    inputs = [\n        MessageTextInput(\n            name=\"urls\",\n            display_name=\"URLs\",\n            info=\"Enter one or more URLs to crawl recursively, by clicking the '+' button.\",\n            is_list=True,\n            tool_mode=True,\n            placeholder=\"Enter a URL...\",\n            list_add_label=\"Add URL\",\n            input_types=[\"Message\"],\n        ),\n        SliderInput(\n            name=\"max_depth\",\n            display_name=\"Depth\",\n            info=(\n                \"Controls how many 'clicks' away from the initial page the crawler will go:\\n\"\n                \"- depth 1: only the initial page\\n\"\n                \"- depth 2: initial page + all pages linked directly from it\\n\"\n                \"- depth 3: initial page + direct links + links found on those direct link pages\\n\"\n                \"Note: This is about link traversal, not URL path depth.\"\n            ),\n            value=DEFAULT_MAX_DEPTH,\n            range_spec=RangeSpec(min=1, max=5, step=1),\n            required=False,\n            min_label=\" \",\n            max_label=\" \",\n            min_label_icon=\"None\",\n            max_label_icon=\"None\",\n            # slider_input=True\n        ),\n        BoolInput(\n            name=\"prevent_outside\",\n            display_name=\"Prevent Outside\",\n            info=(\n                \"If enabled, only crawls URLs within the same domain as the root URL. \"\n                \"This helps prevent the crawler from going to external websites.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"use_async\",\n            display_name=\"Use Async\",\n            info=(\n                \"If enabled, uses asynchronous loading which can be significantly faster \"\n                \"but might use more system resources.\"\n            ),\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        DropdownInput(\n            name=\"format\",\n            display_name=\"Output Format\",\n            info=(\n                \"Output Format. Use 'Text' to extract the text from the HTML, \"\n                \"'Markdown' to parse the HTML into Markdown format, or 'HTML' \"\n                \"for the raw HTML content.\"\n            ),\n            options=[\"Text\", \"HTML\", \"Markdown\"],\n            value=DEFAULT_FORMAT,\n            advanced=True,\n        ),\n        IntInput(\n            name=\"timeout\",\n            display_name=\"Timeout\",\n            info=\"Timeout for the request in seconds.\",\n            value=DEFAULT_TIMEOUT,\n            required=False,\n            advanced=True,\n        ),\n        TableInput(\n            name=\"headers\",\n            display_name=\"Headers\",\n            info=\"The headers to send with the request\",\n            table_schema=[\n                {\n                    \"name\": \"key\",\n                    \"display_name\": \"Header\",\n                    \"type\": \"str\",\n                    \"description\": \"Header name\",\n                },\n                {\n                    \"name\": \"value\",\n                    \"display_name\": \"Value\",\n                    \"type\": \"str\",\n                    \"description\": \"Header value\",\n                },\n            ],\n            value=[{\"key\": \"User-Agent\", \"value\": USER_AGENT}],\n            advanced=True,\n            input_types=[\"DataFrame\", \"Table\"],\n        ),\n        BoolInput(\n            name=\"filter_text_html\",\n            display_name=\"Filter Text/HTML\",\n            info=\"If enabled, filters out text/css content type from the results.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"continue_on_failure\",\n            display_name=\"Continue on Failure\",\n            info=\"If enabled, continues crawling even if some requests fail.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"check_response_status\",\n            display_name=\"Check Response Status\",\n            info=\"If enabled, checks the response status of the request.\",\n            value=False,\n            required=False,\n            advanced=True,\n        ),\n        BoolInput(\n            name=\"autoset_encoding\",\n            display_name=\"Autoset Encoding\",\n            info=\"If enabled, automatically sets the encoding of the request.\",\n            value=True,\n            required=False,\n            advanced=True,\n        ),\n    ]\n\n    outputs = [\n        Output(display_name=\"Extracted Pages\", name=\"page_results\", method=\"fetch_content\"),\n        Output(display_name=\"Raw Content\", name=\"raw_results\", method=\"fetch_content_as_message\", tool_mode=False),\n    ]\n\n    @staticmethod\n    def _html_extractor(x: str) -> str:\n        \"\"\"Extract raw HTML content.\"\"\"\n        return x\n\n    @staticmethod\n    def _text_extractor(x: str) -> str:\n        \"\"\"Extract clean text from HTML.\"\"\"\n        return BeautifulSoup(x, \"lxml\").get_text()\n\n    @staticmethod\n    def _markdown_extractor(x: str) -> str:\n        \"\"\"Convert HTML to Markdown format.\"\"\"\n        stream = io.BytesIO(x.encode(\"utf-8\"))\n        result = MarkItDown(enable_plugins=False).convert_stream(stream)\n        return result.markdown\n\n    @staticmethod\n    def validate_url(url: str) -> bool:\n        \"\"\"Validates if the given string matches URL pattern.\n\n        Args:\n            url: The URL string to validate\n\n        Returns:\n            bool: True if the URL is valid, False otherwise\n        \"\"\"\n        return bool(URL_REGEX.match(url))\n\n    def ensure_url(self, url: str) -> tuple[str, list[str]]:\n        \"\"\"Ensures the given string is a valid URL and returns validated IPs for DNS pinning.\n\n        Args:\n            url: The URL string to validate and normalize\n\n        Returns:\n            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning\n\n        Raises:\n            ValueError: If the URL is invalid or blocked by SSRF protection\n        \"\"\"\n        url = url.strip()\n        if not url.startswith((\"http://\", \"https://\")):\n            url = \"https://\" + url\n\n        if not self.validate_url(url):\n            msg = f\"Invalid URL: {url}\"\n            raise ValueError(msg)\n\n        # ============================================================================\n        # SSRF Protection with DNS Pinning\n        # ============================================================================\n        # This prevents DNS rebinding attacks by:\n        # 1. Resolving DNS and validating IPs during security check\n        # 2. Returning the validated IP addresses for DNS pinning\n        # 3. Using a custom HTTP transport that forces use of the pinned IPs\n        # 4. Ignoring any new DNS resolutions (prevents rebinding)\n        #\n        # Without DNS pinning, an attacker could:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - Second DNS lookup: returns internal IP (bypasses protection)\n        # - Attack succeeds: accesses internal services\n        #\n        # With DNS pinning:\n        # - First DNS lookup: returns public IP (passes validation)\n        # - IPs are pinned and returned\n        # - HTTP request: uses pinned IPs directly (no new DNS lookup)\n        # - Attack fails: even if DNS changes, we use the validated IPs\n        # ============================================================================\n        try:\n            _validated_url, validated_ips = validate_and_resolve_url(url)\n        except SSRFProtectionError as e:\n            msg = f\"SSRF Protection: {e}\"\n            raise ValueError(msg) from e\n        else:\n            # Log DNS pinning information for security auditing\n            if validated_ips:\n                logger.debug(f\"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}\")\n\n            return url, validated_ips\n\n    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:\n        \"\"\"Create an HTTP client with DNS pinning for SSRF protection.\n\n        Args:\n            url: The request URL whose hostname will be pinned\n            validated_ips: IPs validated by validate_and_resolve_url for this URL\n\n        Returns:\n            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled\n        \"\"\"\n        if is_ssrf_protection_enabled() and validated_ips:\n            hostname = urlparse(url).hostname\n            if hostname:\n                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)\n        return httpx.AsyncClient()\n\n    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:\n        \"\"\"Fetch a single URL with DNS pinning protection.\n\n        Args:\n            url: The URL to fetch\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n\n        Returns:\n            tuple[str, dict]: The HTML content and metadata\n        \"\"\"\n        async with self._build_http_client(url, validated_ips) as client:\n            try:\n                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)\n\n                if self.check_response_status:\n                    response.raise_for_status()\n\n                content_type = response.headers.get(\"content-type\", \"\").lower()\n\n                # Filter out CSS files if requested\n                if self.filter_text_html and \"text/css\" in content_type:\n                    logger.debug(f\"Skipping CSS file: {url}\")\n                    return \"\", {}\n\n                # Get the HTML content\n                html_content = response.text\n\n                # Extract metadata\n                metadata = {\n                    \"source\": str(response.url),\n                    \"title\": \"\",\n                    \"description\": \"\",\n                    \"content_type\": content_type,\n                    \"language\": \"\",\n                }\n\n                # Try to extract title and description from HTML\n                try:\n                    soup = BeautifulSoup(html_content, \"lxml\")\n                except Exception:  # noqa: BLE001\n                    # Broad exception is acceptable here - metadata extraction is optional\n                    # and we don't want to fail the entire request if it fails\n                    logger.debug(f\"Failed to extract metadata from {url}\")\n                else:\n                    if soup.title:\n                        metadata[\"title\"] = soup.title.string or \"\"\n\n                    # Try to get description from meta tags\n                    meta_desc = soup.find(\"meta\", attrs={\"name\": \"description\"})\n                    if meta_desc and meta_desc.get(\"content\"):\n                        metadata[\"description\"] = meta_desc[\"content\"]\n\n                    # Try to get language\n                    html_tag = soup.find(\"html\")\n                    if html_tag and html_tag.get(\"lang\"):\n                        metadata[\"language\"] = html_tag[\"lang\"]\n\n            except httpx.HTTPError as e:\n                if self.continue_on_failure:\n                    logger.warning(f\"Failed to fetch {url}: {e}\")\n                    return \"\", {}\n                raise\n            else:\n                return html_content, metadata\n\n    async def _crawl_recursive(\n        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0\n    ) -> list[dict]:\n        \"\"\"Recursively crawl URLs with DNS pinning protection.\n\n        Args:\n            start_url: The URL to start crawling from\n            validated_ips: Validated IPs for DNS pinning\n            headers: HTTP headers to send\n            visited: Set of already visited URLs\n            depth: Current crawl depth\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n        \"\"\"\n        if depth >= self.max_depth or start_url in visited:\n            return []\n\n        visited.add(start_url)\n        documents = []\n\n        # Fetch the current URL\n        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)\n\n        if not html_content:\n            return documents\n\n        # Extract content based on format\n        extractors = {\n            \"HTML\": self._html_extractor,\n            \"Markdown\": self._markdown_extractor,\n            \"Text\": self._text_extractor,\n        }\n        extractor = extractors.get(self.format, self._text_extractor)\n        extracted_content = extractor(html_content)\n\n        # Add the document\n        documents.append(\n            {\n                \"page_content\": extracted_content,\n                \"metadata\": metadata,\n            }\n        )\n\n        # If we haven't reached max depth, extract and follow links\n        if depth < self.max_depth - 1:\n            try:\n                soup = BeautifulSoup(html_content, \"lxml\")\n                links = soup.find_all(\"a\", href=True)\n\n                for link in links:\n                    href = link[\"href\"]\n                    # Resolve relative URLs\n                    absolute_url = urljoin(start_url, href)\n\n                    # Skip if already visited\n                    if absolute_url in visited:\n                        continue\n\n                    # Check if we should prevent going outside the domain\n                    if self.prevent_outside:\n                        start_domain = urlparse(start_url).netloc\n                        link_domain = urlparse(absolute_url).netloc\n                        if start_domain != link_domain:\n                            continue\n\n                    # Validate and crawl the linked URL\n                    try:\n                        _, link_validated_ips = self.ensure_url(absolute_url)\n                        sub_docs = await self._crawl_recursive(\n                            absolute_url, link_validated_ips, headers, visited, depth + 1\n                        )\n                        documents.extend(sub_docs)\n                    except (ValueError, SSRFProtectionError) as e:\n                        if self.continue_on_failure:\n                            logger.warning(f\"Skipping {absolute_url}: {e}\")\n                            continue\n                        raise\n\n            except Exception:  # noqa: BLE001\n                # Broad exception is acceptable here - link extraction is optional\n                # and we don't want to fail the entire crawl if one page has issues\n                logger.debug(f\"Failed to extract links from {start_url}\")\n\n        return documents\n\n    async def fetch_url_contents(self) -> list[dict]:\n        \"\"\"Load documents from the configured URLs with SSRF protection and DNS pinning.\n\n        This method implements comprehensive SSRF (Server-Side Request Forgery) protection\n        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its\n        DNS resolution is pinned before any HTTP requests are made.\n\n        Returns:\n            list[dict]: List of documents with content and metadata\n\n        Raises:\n            ValueError: If no valid URLs are provided or if there's an error loading documents\n        \"\"\"\n        try:\n            # Validate all URLs and get their validated IPs for DNS pinning\n            validated_urls = []\n            first_validation_error: Exception | None = None\n            for url in self.urls:\n                if not url.strip():\n                    continue\n                try:\n                    normalized_url, validated_ips = self.ensure_url(url)\n                    validated_urls.append((normalized_url, validated_ips))\n                except (ValueError, SSRFProtectionError) as e:\n                    # Remember the first rejection so its real cause (for example an\n                    # SSRF block) can be surfaced if no URL survives validation,\n                    # instead of being hidden behind \"No valid URLs provided\".\n                    if first_validation_error is None:\n                        first_validation_error = e\n                    if self.continue_on_failure:\n                        logger.warning(f\"Skipping invalid URL {url}: {e}\")\n                        continue\n                    raise\n\n            # Remove duplicates while preserving order\n            seen = set()\n            unique_validated_urls = []\n            for url, ips in validated_urls:\n                if url not in seen:\n                    seen.add(url)\n                    unique_validated_urls.append((url, ips))\n\n            logger.debug(f\"Validated {len(unique_validated_urls)} unique URL(s)\")\n\n            if not unique_validated_urls:\n                # Surface the actual reason every candidate URL was rejected (e.g. an\n                # SSRF block) rather than a generic message, so a security failure is\n                # not silently swallowed when continue_on_failure is enabled.\n                if first_validation_error is not None:\n                    raise first_validation_error\n                msg = \"No valid URLs provided.\"\n                raise ValueError(msg)\n\n            # Prepare headers\n            headers_dict = {header[\"key\"]: header[\"value\"] for header in self.headers if header[\"value\"] is not None}\n\n            # Crawl all URLs\n            all_docs = []\n            for url, validated_ips in unique_validated_urls:\n                logger.debug(f\"Crawling {url} with max_depth={self.max_depth}\")\n\n                try:\n                    visited = set()\n                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)\n\n                    if not docs:\n                        logger.warning(f\"No documents found for {url}\")\n                        continue\n\n                    logger.debug(f\"Found {len(docs)} document(s) from {url}\")\n                    all_docs.extend(docs)\n\n                except httpx.HTTPError as e:\n                    if self.continue_on_failure:\n                        logger.warning(f\"Error loading documents from {url}: {e}\")\n                        continue\n                    msg = f\"Error loading documents from {url}: {e}\"\n                    raise ValueError(msg) from e\n\n            if not all_docs:\n                msg = \"No documents were successfully loaded from any URL\"\n                raise ValueError(msg)\n\n            # Convert to output format\n            return [\n                {\n                    \"text\": safe_convert(doc[\"page_content\"], clean_data=True),\n                    \"url\": doc[\"metadata\"].get(\"source\", \"\"),\n                    \"title\": doc[\"metadata\"].get(\"title\", \"\"),\n                    \"description\": doc[\"metadata\"].get(\"description\", \"\"),\n                    \"content_type\": doc[\"metadata\"].get(\"content_type\", \"\"),\n                    \"language\": doc[\"metadata\"].get(\"language\", \"\"),\n                }\n                for doc in all_docs\n            ]\n\n        except Exception as e:\n            error_msg = e.message if hasattr(e, \"message\") else str(e)\n            msg = f\"Error loading documents: {error_msg}\"\n            logger.exception(msg)\n            raise ValueError(msg) from e\n\n    async def fetch_content(self) -> DataFrame:\n        \"\"\"Convert the documents to a DataFrame.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return DataFrame(data=url_contents)\n\n    async def fetch_content_as_message(self) -> Message:\n        \"\"\"Convert the documents to a Message.\"\"\"\n        url_contents = await self.fetch_url_contents()\n        return Message(text=\"\\n\\n\".join([x[\"text\"] for x in url_contents]), data={\"data\": url_contents})\n"
             },
             "continue_on_failure": {
               "_input_type": "BoolInput",
@@ -118849,6 +118845,6 @@
     "num_components": 356,
     "num_modules": 95
   },
-  "sha256": "f04fdf6c7139d4cd3e0eeee868036e3e9778d1fac25a819b389b102c98f0b546",
+  "sha256": "ec1443bfb8b7a8fea57f5aa042847d8ba88f5a4180e4cf62062fbadf19908840",
   "version": "1.10.0"
 }
diff --git a/src/lfx/src/lfx/components/data_source/url.py b/src/lfx/src/lfx/components/data_source/url.py
index db0d6e0c2150..9000234125c1 100644
--- a/src/lfx/src/lfx/components/data_source/url.py
+++ b/src/lfx/src/lfx/components/data_source/url.py
@@ -1,11 +1,10 @@
-import importlib
+import importlib.util
 import io
-import os
 import re
+from urllib.parse import urljoin, urlparse
 
-import requests
+import httpx
 from bs4 import BeautifulSoup
-from langchain_community.document_loaders import RecursiveUrlLoader
 from markitdown import MarkItDown
 
 from lfx.custom.custom_component.component import Component
@@ -16,7 +15,8 @@
 from lfx.schema.dataframe import DataFrame
 from lfx.schema.message import Message
 from lfx.utils.request_utils import get_user_agent
-from lfx.utils.ssrf_protection import SSRFProtectionError, validate_url_for_ssrf
+from lfx.utils.ssrf_protection import SSRFProtectionError, is_ssrf_protection_enabled, validate_and_resolve_url
+from lfx.utils.ssrf_transport import create_ssrf_protected_client
 
 # Constants
 DEFAULT_TIMEOUT = 30
@@ -218,14 +218,14 @@ def validate_url(url: str) -> bool:
         """
         return bool(URL_REGEX.match(url))
 
-    def ensure_url(self, url: str) -> str:
-        """Ensures the given string is a valid URL.
+    def ensure_url(self, url: str) -> tuple[str, list[str]]:
+        """Ensures the given string is a valid URL and returns validated IPs for DNS pinning.
 
         Args:
             url: The URL string to validate and normalize
 
         Returns:
-            str: The normalized URL
+            tuple[str, list[str]]: The normalized URL and list of validated IPs for DNS pinning
 
         Raises:
             ValueError: If the URL is invalid or blocked by SSRF protection
@@ -238,132 +238,314 @@ def ensure_url(self, url: str) -> str:
             msg = f"Invalid URL: {url}"
             raise ValueError(msg)
 
-        # SSRF Protection: Validate URL to prevent access to internal resources
-        # Blocks requests to private IPs, localhost, and cloud metadata endpoints
-        # when LANGFLOW_SSRF_PROTECTION_ENABLED=true
+        # ============================================================================
+        # SSRF Protection with DNS Pinning
+        # ============================================================================
+        # This prevents DNS rebinding attacks by:
+        # 1. Resolving DNS and validating IPs during security check
+        # 2. Returning the validated IP addresses for DNS pinning
+        # 3. Using a custom HTTP transport that forces use of the pinned IPs
+        # 4. Ignoring any new DNS resolutions (prevents rebinding)
+        #
+        # Without DNS pinning, an attacker could:
+        # - First DNS lookup: returns public IP (passes validation)
+        # - Second DNS lookup: returns internal IP (bypasses protection)
+        # - Attack succeeds: accesses internal services
+        #
+        # With DNS pinning:
+        # - First DNS lookup: returns public IP (passes validation)
+        # - IPs are pinned and returned
+        # - HTTP request: uses pinned IPs directly (no new DNS lookup)
+        # - Attack fails: even if DNS changes, we use the validated IPs
+        # ============================================================================
         try:
-            validate_url_for_ssrf(url, warn_only=False)
+            _validated_url, validated_ips = validate_and_resolve_url(url)
         except SSRFProtectionError as e:
             msg = f"SSRF Protection: {e}"
             raise ValueError(msg) from e
+        else:
+            # Log DNS pinning information for security auditing
+            if validated_ips:
+                logger.debug(f"SSRF Protection: Using DNS pinning with {len(validated_ips)} validated IP(s) for {url}")
 
-        return url
+            return url, validated_ips
 
-    def _create_loader(self, url: str) -> RecursiveUrlLoader:
-        """Creates a RecursiveUrlLoader instance with the configured settings.
+    def _build_http_client(self, url: str, validated_ips: list[str]) -> httpx.AsyncClient:
+        """Create an HTTP client with DNS pinning for SSRF protection.
 
         Args:
-            url: The URL to load
+            url: The request URL whose hostname will be pinned
+            validated_ips: IPs validated by validate_and_resolve_url for this URL
 
         Returns:
-            RecursiveUrlLoader: Configured loader instance
+            httpx.AsyncClient: A client with DNS pinning when SSRF protection is enabled
         """
-        headers_dict = {header["key"]: header["value"] for header in self.headers if header["value"] is not None}
+        if is_ssrf_protection_enabled() and validated_ips:
+            hostname = urlparse(url).hostname
+            if hostname:
+                return create_ssrf_protected_client(hostname=hostname, validated_ips=validated_ips)
+        return httpx.AsyncClient()
+
+    async def _fetch_url_with_pinning(self, url: str, validated_ips: list[str], headers: dict) -> tuple[str, dict]:
+        """Fetch a single URL with DNS pinning protection.
+
+        Args:
+            url: The URL to fetch
+            validated_ips: Validated IPs for DNS pinning
+            headers: HTTP headers to send
+
+        Returns:
+            tuple[str, dict]: The HTML content and metadata
+        """
+        async with self._build_http_client(url, validated_ips) as client:
+            try:
+                response = await client.get(url, headers=headers, timeout=self.timeout, follow_redirects=False)
+
+                if self.check_response_status:
+                    response.raise_for_status()
+
+                content_type = response.headers.get("content-type", "").lower()
+
+                # Filter out CSS files if requested
+                if self.filter_text_html and "text/css" in content_type:
+                    logger.debug(f"Skipping CSS file: {url}")
+                    return "", {}
+
+                # Get the HTML content
+                html_content = response.text
+
+                # Extract metadata
+                metadata = {
+                    "source": str(response.url),
+                    "title": "",
+                    "description": "",
+                    "content_type": content_type,
+                    "language": "",
+                }
+
+                # Try to extract title and description from HTML
+                try:
+                    soup = BeautifulSoup(html_content, "lxml")
+                except Exception:  # noqa: BLE001
+                    # Broad exception is acceptable here - metadata extraction is optional
+                    # and we don't want to fail the entire request if it fails
+                    logger.debug(f"Failed to extract metadata from {url}")
+                else:
+                    if soup.title:
+                        metadata["title"] = soup.title.string or ""
+
+                    # Try to get description from meta tags
+                    meta_desc = soup.find("meta", attrs={"name": "description"})
+                    if meta_desc and meta_desc.get("content"):
+                        metadata["description"] = meta_desc["content"]
+
+                    # Try to get language
+                    html_tag = soup.find("html")
+                    if html_tag and html_tag.get("lang"):
+                        metadata["language"] = html_tag["lang"]
+
+            except httpx.HTTPError as e:
+                if self.continue_on_failure:
+                    logger.warning(f"Failed to fetch {url}: {e}")
+                    return "", {}
+                raise
+            else:
+                return html_content, metadata
+
+    async def _crawl_recursive(
+        self, start_url: str, validated_ips: list[str], headers: dict, visited: set, depth: int = 0
+    ) -> list[dict]:
+        """Recursively crawl URLs with DNS pinning protection.
+
+        Args:
+            start_url: The URL to start crawling from
+            validated_ips: Validated IPs for DNS pinning
+            headers: HTTP headers to send
+            visited: Set of already visited URLs
+            depth: Current crawl depth
+
+        Returns:
+            list[dict]: List of documents with content and metadata
+        """
+        if depth >= self.max_depth or start_url in visited:
+            return []
+
+        visited.add(start_url)
+        documents = []
+
+        # Fetch the current URL
+        html_content, metadata = await self._fetch_url_with_pinning(start_url, validated_ips, headers)
+
+        if not html_content:
+            return documents
+
+        # Extract content based on format
         extractors = {
             "HTML": self._html_extractor,
             "Markdown": self._markdown_extractor,
             "Text": self._text_extractor,
         }
         extractor = extractors.get(self.format, self._text_extractor)
-
-        proxy_env_keys = (
-            "http_proxy",
-            "HTTP_PROXY",
-            "https_proxy",
-            "HTTPS_PROXY",
-            "all_proxy",
-            "ALL_PROXY",
-        )
-        has_proxy = any((os.environ.get(key) or "").strip() for key in proxy_env_keys)
-
-        final_use_async = self.use_async
-        if has_proxy and self.use_async:
-            logger.warning(
-                "Proxy environment variables detected. Disabling 'use_async' in URLComponent "
-                "as the underlying async loader does not reliably respect system proxies. "
-                "Crawling will proceed synchronously (which may be slower)."
-            )
-            final_use_async = False
-
-        return RecursiveUrlLoader(
-            url=url,
-            max_depth=self.max_depth,
-            prevent_outside=self.prevent_outside,
-            use_async=final_use_async,
-            extractor=extractor,
-            timeout=self.timeout,
-            headers=headers_dict,
-            check_response_status=self.check_response_status,
-            continue_on_failure=self.continue_on_failure,
-            base_url=url,  # Add base_url to ensure consistent domain crawling
-            autoset_encoding=self.autoset_encoding,  # Enable automatic encoding detection
-            exclude_dirs=[],  # Allow customization of excluded directories
-            link_regex=None,  # Allow customization of link filtering
+        extracted_content = extractor(html_content)
+
+        # Add the document
+        documents.append(
+            {
+                "page_content": extracted_content,
+                "metadata": metadata,
+            }
         )
 
-    def fetch_url_contents(self) -> list[dict]:
-        """Load documents from the configured URLs.
+        # If we haven't reached max depth, extract and follow links
+        if depth < self.max_depth - 1:
+            try:
+                soup = BeautifulSoup(html_content, "lxml")
+                links = soup.find_all("a", href=True)
+
+                for link in links:
+                    href = link["href"]
+                    # Resolve relative URLs
+                    absolute_url = urljoin(start_url, href)
+
+                    # Skip if already visited
+                    if absolute_url in visited:
+                        continue
+
+                    # Check if we should prevent going outside the domain
+                    if self.prevent_outside:
+                        start_domain = urlparse(start_url).netloc
+                        link_domain = urlparse(absolute_url).netloc
+                        if start_domain != link_domain:
+                            continue
+
+                    # Validate and crawl the linked URL
+                    try:
+                        _, link_validated_ips = self.ensure_url(absolute_url)
+                        sub_docs = await self._crawl_recursive(
+                            absolute_url, link_validated_ips, headers, visited, depth + 1
+                        )
+                        documents.extend(sub_docs)
+                    except (ValueError, SSRFProtectionError) as e:
+                        if self.continue_on_failure:
+                            logger.warning(f"Skipping {absolute_url}: {e}")
+                            continue
+                        raise
+
+            except Exception:  # noqa: BLE001
+                # Broad exception is acceptable here - link extraction is optional
+                # and we don't want to fail the entire crawl if one page has issues
+                logger.debug(f"Failed to extract links from {start_url}")
+
+        return documents
+
+    async def fetch_url_contents(self) -> list[dict]:
+        """Load documents from the configured URLs with SSRF protection and DNS pinning.
+
+        This method implements comprehensive SSRF (Server-Side Request Forgery) protection
+        using DNS pinning to prevent DNS rebinding attacks. Each URL is validated and its
+        DNS resolution is pinned before any HTTP requests are made.
 
         Returns:
-            List[Data]: List of Data objects containing the fetched content
+            list[dict]: List of documents with content and metadata
 
         Raises:
             ValueError: If no valid URLs are provided or if there's an error loading documents
         """
         try:
-            urls = list({self.ensure_url(url) for url in self.urls if url.strip()})
-            logger.debug(f"URLs: {urls}")
-            if not urls:
+            # Validate all URLs and get their validated IPs for DNS pinning
+            validated_urls = []
+            first_validation_error: Exception | None = None
+            for url in self.urls:
+                if not url.strip():
+                    continue
+                try:
+                    normalized_url, validated_ips = self.ensure_url(url)
+                    validated_urls.append((normalized_url, validated_ips))
+                except (ValueError, SSRFProtectionError) as e:
+                    # Remember the first rejection so its real cause (for example an
+                    # SSRF block) can be surfaced if no URL survives validation,
+                    # instead of being hidden behind "No valid URLs provided".
+                    if first_validation_error is None:
+                        first_validation_error = e
+                    if self.continue_on_failure:
+                        logger.warning(f"Skipping invalid URL {url}: {e}")
+                        continue
+                    raise
+
+            # Remove duplicates while preserving order
+            seen = set()
+            unique_validated_urls = []
+            for url, ips in validated_urls:
+                if url not in seen:
+                    seen.add(url)
+                    unique_validated_urls.append((url, ips))
+
+            logger.debug(f"Validated {len(unique_validated_urls)} unique URL(s)")
+
+            if not unique_validated_urls:
+                # Surface the actual reason every candidate URL was rejected (e.g. an
+                # SSRF block) rather than a generic message, so a security failure is
+                # not silently swallowed when continue_on_failure is enabled.
+                if first_validation_error is not None:
+                    raise first_validation_error
                 msg = "No valid URLs provided."
                 raise ValueError(msg)
 
+            # Prepare headers
+            headers_dict = {header["key"]: header["value"] for header in self.headers if header["value"] is not None}
+
+            # Crawl all URLs
             all_docs = []
-            for url in urls:
-                logger.debug(f"Loading documents from {url}")
+            for url, validated_ips in unique_validated_urls:
+                logger.debug(f"Crawling {url} with max_depth={self.max_depth}")
 
                 try:
-                    loader = self._create_loader(url)
-                    docs = loader.load()
+                    visited = set()
+                    docs = await self._crawl_recursive(url, validated_ips, headers_dict, visited, depth=0)
 
                     if not docs:
                         logger.warning(f"No documents found for {url}")
                         continue
 
-                    logger.debug(f"Found {len(docs)} documents from {url}")
+                    logger.debug(f"Found {len(docs)} document(s) from {url}")
                     all_docs.extend(docs)
 
-                except requests.exceptions.RequestException as e:
-                    logger.exception(f"Error loading documents from {url}: {e}")
-                    continue
+                except httpx.HTTPError as e:
+                    if self.continue_on_failure:
+                        logger.warning(f"Error loading documents from {url}: {e}")
+                        continue
+                    msg = f"Error loading documents from {url}: {e}"
+                    raise ValueError(msg) from e
 
             if not all_docs:
                 msg = "No documents were successfully loaded from any URL"
                 raise ValueError(msg)
 
-            # data = [Data(text=doc.page_content, **doc.metadata) for doc in all_docs]
-            data = [
+            # Convert to output format
+            return [
                 {
-                    "text": safe_convert(doc.page_content, clean_data=True),
-                    "url": doc.metadata.get("source", ""),
-                    "title": doc.metadata.get("title", ""),
-                    "description": doc.metadata.get("description", ""),
-                    "content_type": doc.metadata.get("content_type", ""),
-                    "language": doc.metadata.get("language", ""),
+                    "text": safe_convert(doc["page_content"], clean_data=True),
+                    "url": doc["metadata"].get("source", ""),
+                    "title": doc["metadata"].get("title", ""),
+                    "description": doc["metadata"].get("description", ""),
+                    "content_type": doc["metadata"].get("content_type", ""),
+                    "language": doc["metadata"].get("language", ""),
                 }
                 for doc in all_docs
             ]
+
         except Exception as e:
-            error_msg = e.message if hasattr(e, "message") else e
-            msg = f"Error loading documents: {error_msg!s}"
+            error_msg = e.message if hasattr(e, "message") else str(e)
+            msg = f"Error loading documents: {error_msg}"
             logger.exception(msg)
             raise ValueError(msg) from e
-        return data
 
-    def fetch_content(self) -> DataFrame:
+    async def fetch_content(self) -> DataFrame:
         """Convert the documents to a DataFrame."""
-        return DataFrame(data=self.fetch_url_contents())
+        url_contents = await self.fetch_url_contents()
+        return DataFrame(data=url_contents)
 
-    def fetch_content_as_message(self) -> Message:
+    async def fetch_content_as_message(self) -> Message:
         """Convert the documents to a Message."""
-        url_contents = self.fetch_url_contents()
+        url_contents = await self.fetch_url_contents()
         return Message(text="\n\n".join([x["text"] for x in url_contents]), data={"data": url_contents})
diff --git a/src/lfx/tests/unit/test_flow_requirements.py b/src/lfx/tests/unit/test_flow_requirements.py
index 6674c808922f..6fe93a639b2f 100644
--- a/src/lfx/tests/unit/test_flow_requirements.py
+++ b/src/lfx/tests/unit/test_flow_requirements.py
@@ -716,21 +716,19 @@ def test_basic_prompting_with_anthropic_provider(self, basic_prompting_flow):
         assert "lfx" in result
         assert "langchain-anthropic" in result
 
-    def test_simple_agent_has_community(self, simple_agent_flow):
-        """Simple Agent's URLComponent imports langchain_community.
-
-        When lfx provides langchain-community transitively (e.g. via
-        OpenDsStar in some environments) it is filtered out of generated
-        requirements as already-provided; otherwise it should appear.
+    def test_simple_agent_requirements(self, simple_agent_flow):
+        """Simple Agent requires lfx and no longer drags in langchain-community.
+
+        The Simple Agent ships the URL component, which historically imported
+        ``langchain_community`` via ``RecursiveUrlLoader``. The URL component was
+        rewritten to fetch with ``httpx`` plus DNS-pinned SSRF protection and no
+        longer imports ``langchain_community``, so the generated requirements
+        include ``lfx`` but never ``langchain-community`` (regardless of whether
+        lfx happens to provide it transitively in a given environment).
         """
-        from lfx.utils.flow_requirements import _get_lfx_provided_imports
-
         result = generate_requirements_from_flow(simple_agent_flow, pin_versions=False)
         assert "lfx" in result
-        if "langchain_community" in _get_lfx_provided_imports():
-            assert "langchain-community" not in result
-        else:
-            assert "langchain-community" in result
+        assert "langchain-community" not in result
 
     def test_basic_prompting_from_file(self):
         """Test the file-based API.