## Security Alert Patch (medium-tier follow-up)
Follow-up to #2329, which patched the critical+high tier. This PR
resolves the remaining **6 medium-severity Dependabot alerts** via
`pnpm.overrides` plus one published-path constraint bump. All fixes are
patch/minor bumps within the current major — no breaking changes.
### Packages Updated
| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |
|---------|---------------|----------------|----------|-------|---------------|
| `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved
1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts`
devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175
(cloud metadata exfiltration) |
| `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override);
resolved **3.4.0** | C (override) | dev-only (private
`@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS
bypasses FORBID_TAGS) |
| `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new
override); resolved **1.16.0** | C (override) | dev-only (via
`@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on
cross-domain redirect) |
| `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in
`libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest
bump)** | **published** — direct dep of `@langchain/langgraph-api` |
CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming
redaction bypass) |
| `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via
`@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19
<1` (new override) | C (override) | dev-only | same as above (flushes
vulnerable transitive copies) |
*Strategy C overrides follow the existing repo pattern — axios, qs,
undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and
defu are already overridden the same way.*
### Published-path rationale
`@langchain/langgraph-api` exercises `langsmith` at runtime for tracing
and streaming, which touches the affected internal code paths (lodash
`set()` prototype-pollution guard, token-event redaction). Therefore the
fix is Strategy A (raise the published lower bound) rather than
A-lockfile — this protects end users who pin `@langchain/langgraph-api`.
The lockfile already resolved `langsmith@0.5.20` before this change, so
installs are unchanged at HEAD; the bump is a downstream-safety
constraint tightening.
### Deferred (not fixed in this PR)
- **`protobufjs@6.11.5`** (CRITICAL, CVE-2026-41242) — reached via
`@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps +
examples. `@xenova/transformers` is abandoned; the successor is
`@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross
a breaking API boundary. **Upstream issue — requires a manual migration,
tracked separately.** (See #2329 body for full context.)
- **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) —
`first_patched_version` is `null`; upstream has not released a fix.
Defer until a patched version ships.
### CVE Details
- **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname
Normalization Bypass Leads to SSRF —
https://github.com/advisories/GHSA-3p68-rc4w-qgx5
- **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud
Metadata Exfiltration via Header Injection Chain —
https://github.com/advisories/GHSA-fvcv-3m26-pcqx
- **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS`
via short-circuit evaluation —
https://github.com/advisories/GHSA-39q2-94rc-95cp
- **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication
headers to cross-domain redirect targets —
https://github.com/advisories/GHSA-r4q5-vmmm-2653
- **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` —
https://github.com/advisories/GHSA-fw9q-39r9-c252
- **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass
output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv
### Linear Tickets
Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No
ticket IDs included in the title.
### Verification
- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — **No known vulnerabilities found**
- [x] `pnpm typecheck` on `libs/langgraph-api` — clean
- [x] No staged secrets (`gitleaks git --staged`)
🤖 Submitted by langster-patch
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
## Security Alert Patch
Resolves **7 Dependabot security alerts** in the critical + high
severity tier via `pnpm.overrides` in the root `package.json`. All fixes
are patch/minor bumps within the current major — no breaking changes.
### Packages Updated
| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |
|---------|---------------|----------------|----------|-------|---------------|
| `protobufjs` | (transitive, resolved 7.5.4) | `>=7.5.5 <8` | C
(override) | dev-only (testcontainers chain + `@xenova/transformers`
devDeps) | CVE-2026-41242 |
| `basic-ftp` | (transitive, resolved 5.2.0) | `>=5.3.0 <6` | C
(override) | effectively dev-only (reached only via `@vitest/browser` —
an optional peerDep of vitest — through webdriverio→proxy-agent) |
GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg, CVE-2026-39983 |
| `vite` (7.x only) | (transitive via vitest peer, resolved 7.3.1) |
`>=7.3.2` | C (override, scoped to vite@7) | effectively dev-only (vite
is a peerDependency of vitest — end users supply their own vite) |
CVE-2026-39363, CVE-2026-39364 |
| `defu` | (transitive, resolved 6.1.4) | `>=6.1.5 <7` | C (override) |
dev-only (`internal/build` via tsdown) | CVE-2026-35209 |
*Strategy C (pnpm.overrides) follows the existing pattern in this repo —
axios, qs, undici, minimatch, brace-expansion, etc. are already
overridden the same way.*
### Side-effect Fixes
Bumping `vite@7` to 7.3.2 also resolves one **medium** alert that wasn't
in the primary batch:
- CVE-2026-39365 / GHSA-4w7w-66w2-5vf9 — vite Path Traversal in
Optimized Deps `.map` Handling
### Upstream / Design Issues (NOT fixed in this PR)
- **`protobufjs@6.11.x`** persists in the dependency graph via
`@xenova/transformers@2.17.2` (`libs/langgraph-core` devDep + 9 example
apps). `@xenova/transformers` is abandoned and rebranded as
`@huggingface/transformers@3`; a migration would be a separate manual
dev-only upgrade. The 6.x line is in devDependencies only and does not
ship to published package consumers. Dependabot may continue to flag the
6.x range because the advisory's `vulnerable_range` is `< 7.5.5`.
- **Published-path caveat for `basic-ftp` and `vite`:** Both transit
through `@langchain/langgraph-checkpoint-validation`'s
`dependencies.vitest`. However, `vite` is declared as a
**peerDependency** of vitest (end users supply their own), and
`basic-ftp` reaches end users only through `@vitest/browser` — an
**optional peerDependency** that users must explicitly opt into.
Overrides in this PR protect local dev and CI; end users of
`@langchain/langgraph-checkpoint-validation` are not exposed unless they
independently install and configure the browser-testing chain.
### Deferred (medium + low tier)
Per security-alert-patch policy, only the highest active severity tier
was patched in this PR. The following remain open and would be addressed
in a follow-up batch:
- 6 medium: axios ×2 (SSRF + cloud-metadata exfil — existing `axios:
>=1.13.5` override doesn't cover 1.15.0), dompurify, langsmith ×2,
follow-redirects
- 1 low: elliptic (no `first_patched_version` published — upstream has
not released a fix)
### Verification
- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — 0 critical, 0 high remaining (3 moderates =
the deferred medium alerts)
- [x] No staged secrets (gitleaks)
### Linear Tickets
Linear ticket lookup skipped — CLI not authenticated in this
environment. No ticket IDs included in title.
🤖 Submitted by langster-patch
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
## Summary
This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.
## Changes
### `@langchain/langgraph` (`libs/langgraph-core`)
- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
- `thread_id`
- `checkpoint_id`
- `checkpoint_ns`
- `task_id`
- `run_id`
- `assistant_id`
- `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
Turns out that `moduleResolution: node10` will achieve the same result as setting `src/package.json` to `{}` (verified via git worktrees).
Also switching `moduleResolution: bundler` for ESM build, after which I've compared the build output of `libs/checkpoint` via `diff -r -q`.
* Define StateGraph State in a single delcaration, from which both reducers and state and update interfaces are inferred
This more closely matches python, where a single declaration gives you all three
* Use type guard instead of instanceof
* Fix build by bumping core dep
---------
Co-authored-by: jacoblee93 <jacoblee93@gmail.com>
Christian Bromann