[PR #2] [MERGED] fix: resolve 6 Dependabot security vulnerabilities #2

New Issue

2026-06-05T16:38:09-04:00

yindo commented

2026-06-05 16:38:09 -04:00

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/agent-inbox-langgraphjs-example/pull/2
Author: @jkennedyvz
Created: 4/1/2026
Status: ✅ Merged
Merged: 4/1/2026
Merged by: @jkennedyvz

Base: main ← Head: fix/dependabot-vulnerabilities

📝 Commits (1)

e8f7d3e fix: resolve 6 Dependabot security vulnerabilities

📊 Changes

2 files changed (+53 additions, -39 deletions)

View changed files

📝 package.json (+11 -1)
📝 yarn.lock (+42 -38)

📄 Description

Summary

Bump @langchain/core from ^0.3.36 to ^0.3.80 (fixes high severity alert #7)
Add yarn resolutions to force patched versions of transitive dependencies:
- flatted → ^3.4.2 (high, alert #16, via eslint → flat-cache)
- minimatch → ^3.1.3 / ^5.1.8 (high, alerts #14 and #13, via eslint/jest/filelist)
- js-yaml → ^4.1.1 / ^3.14.2 (medium, alerts #6 and #5, via eslint/istanbul)

Test plan

yarn install succeeds
yarn build passes
Verify Dependabot alerts close after merge

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/agent-inbox-langgraphjs-example/pull/2 **Author:** [@jkennedyvz](https://github.com/jkennedyvz) **Created:** 4/1/2026 **Status:** ✅ Merged **Merged:** 4/1/2026 **Merged by:** [@jkennedyvz](https://github.com/jkennedyvz) **Base:** `main` ← **Head:** `fix/dependabot-vulnerabilities` --- ### 📝 Commits (1) - [`e8f7d3e`](https://github.com/langchain-ai/agent-inbox-langgraphjs-example/commit/e8f7d3e915a76eb809f036b328390c056265c187) fix: resolve 6 Dependabot security vulnerabilities ### 📊 Changes **2 files changed** (+53 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+11 -1) 📝 `yarn.lock` (+42 -38) </details> ### 📄 Description ## Summary - Bump `@langchain/core` from `^0.3.36` to `^0.3.80` (fixes high severity alert #7) - Add yarn `resolutions` to force patched versions of transitive dependencies: - `flatted` → `^3.4.2` (high, alert #16, via eslint → flat-cache) - `minimatch` → `^3.1.3` / `^5.1.8` (high, alerts #14 and #13, via eslint/jest/filelist) - `js-yaml` → `^4.1.1` / `^3.14.2` (medium, alerts #6 and #5, via eslint/istanbul) ## Test plan - [x] `yarn install` succeeds - [x] `yarn build` passes - [ ] Verify Dependabot alerts close after merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-05 16:38:09 -04:00

yindo closed this issue

2026-06-05 16:38:09 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: langchain-ai/agent-inbox-langgraphjs-example#2