fix: add ssrf protection to url component

src/backend/tests/unit/components/processing/test_split_text_component.py

@@ -272,11 +272,11 @@ def test_split_text_with_dataframe_input(self):
         assert "Another text" in results["text"][2], f"Expected 'Another text', got '{results['text'][2]}'"
         assert "Another line" in results["text"][3], f"Expected 'Another line', got '{results['text'][3]}'"
 
-    def test_with_url_loader(self):
+    async def test_with_url_loader(self):
         """Test splitting text with URL loader."""
         component = SplitTextComponent()
         url = ["https://en.wikipedia.org/wiki/London", "https://en.wikipedia.org/wiki/Paris"]
-        data_frame = URLComponent(urls=url, format="Text").fetch_content()
+        data_frame = await URLComponent(urls=url, format="Text").fetch_content()
         assert isinstance(data_frame, DataFrame), "Expected DataFrame instance"
         assert len(data_frame) == 2, f"Expected DataFrame with 2 rows, got {len(data_frame)}"
 

src/lfx/tests/unit/test_flow_requirements.py

@@ -716,21 +716,19 @@ def test_basic_prompting_with_anthropic_provider(self, basic_prompting_flow):
         assert "lfx" in result
         assert "langchain-anthropic" in result
 
-    def test_simple_agent_has_community(self, simple_agent_flow):
-        """Simple Agent's URLComponent imports langchain_community.
-
-        When lfx provides langchain-community transitively (e.g. via
-        OpenDsStar in some environments) it is filtered out of generated
-        requirements as already-provided; otherwise it should appear.
+    def test_simple_agent_requirements(self, simple_agent_flow):
+        """Simple Agent requires lfx and no longer drags in langchain-community.
+
+        The Simple Agent ships the URL component, which historically imported
+        ``langchain_community`` via ``RecursiveUrlLoader``. The URL component was
+        rewritten to fetch with ``httpx`` plus DNS-pinned SSRF protection and no
+        longer imports ``langchain_community``, so the generated requirements
+        include ``lfx`` but never ``langchain-community`` (regardless of whether
+        lfx happens to provide it transitively in a given environment).
         """
-        from lfx.utils.flow_requirements import _get_lfx_provided_imports
-
         result = generate_requirements_from_flow(simple_agent_flow, pin_versions=False)
         assert "lfx" in result
-        if "langchain_community" in _get_lfx_provided_imports():
-            assert "langchain-community" not in result
-        else:
-            assert "langchain-community" in result
+        assert "langchain-community" not in result
 
     def test_basic_prompting_from_file(self):
         """Test the file-based API.