langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-21 03:45:28 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #2857] [MERGED] fix(deps): patch path-to-regexp and undici vulnerabilities #2945

New Issue
Closed
opened 2026-06-05 18:20:29 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 18:20:29 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/2857
Author: @jkennedyvz
Created: 2/28/2026
Status: ✅ Merged
Merged: 2/28/2026
Merged by: @jkennedyvz

Base: main ← Head: fix/patch-path-to-regexp-undici-vulns

📝 Commits (1)

  • 05681c7 fix(deps): patch path-to-regexp and undici vulnerabilities

📊 Changes

2 files changed (+11 additions, -12 deletions)

View changed files

📝 reference/package.json (+3 -1)
📝 reference/pnpm-lock.yaml (+8 -11)

📄 Description

Summary

  • Add pnpm overrides to resolve the remaining 4 open Dependabot security alerts in reference/pnpm-lock.yaml
  • path-to-regexp >=4.0.0 <6.3.0 → 6.3.0 — fixes high-severity ReDoS via backtracking regular expressions (#1)
  • undici >=4.5.0 <5.29.0 → 5.29.0 — fixes 3 alerts: insufficiently random values (#2), unbounded decompression chain (#9), and bad certificate DoS (#4)

Test plan

  • Verified vulnerable versions (path-to-regexp@6.1.0, undici@5.28.4) are no longer in lockfile
  • Verified patched versions (path-to-regexp@6.3.0, undici@5.29.0) are present
  • pnpm install succeeds without errors

🤖 Generated with Claude Code

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/2857 **Author:** [@jkennedyvz](https://github.com/jkennedyvz) **Created:** 2/28/2026 **Status:** ✅ Merged **Merged:** 2/28/2026 **Merged by:** [@jkennedyvz](https://github.com/jkennedyvz) **Base:** `main` ← **Head:** `fix/patch-path-to-regexp-undici-vulns` --- ### 📝 Commits (1) - [`05681c7`](https://github.com/langchain-ai/docs/commit/05681c7a40ad8ffdb1fc0ac3131c855a6e9f4bb6) fix(deps): patch path-to-regexp and undici vulnerabilities ### 📊 Changes **2 files changed** (+11 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `reference/package.json` (+3 -1) 📝 `reference/pnpm-lock.yaml` (+8 -11) </details> ### 📄 Description ## Summary - Add pnpm overrides to resolve the remaining 4 open Dependabot security alerts in `reference/pnpm-lock.yaml` - **path-to-regexp** `>=4.0.0 <6.3.0` → `6.3.0` — fixes high-severity ReDoS via backtracking regular expressions ([#1](https://github.com/langchain-ai/docs/security/dependabot/1)) - **undici** `>=4.5.0 <5.29.0` → `5.29.0` — fixes 3 alerts: insufficiently random values ([#2](https://github.com/langchain-ai/docs/security/dependabot/2)), unbounded decompression chain ([#9](https://github.com/langchain-ai/docs/security/dependabot/9)), and bad certificate DoS ([#4](https://github.com/langchain-ai/docs/security/dependabot/4)) ## Test plan - [x] Verified vulnerable versions (`path-to-regexp@6.1.0`, `undici@5.28.4`) are no longer in lockfile - [x] Verified patched versions (`path-to-regexp@6.3.0`, `undici@5.29.0`) are present - [x] `pnpm install` succeeds without errors 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 18:20:29 -04:00
yindo closed this issue 2026-06-05 18:20:29 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#2945
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?