## Security Alert Patch (medium-tier follow-up)
Follow-up to #2329, which patched the critical+high tier. This PR
resolves the remaining **6 medium-severity Dependabot alerts** via
`pnpm.overrides` plus one published-path constraint bump. All fixes are
patch/minor bumps within the current major — no breaking changes.
### Packages Updated
| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |
|---------|---------------|----------------|----------|-------|---------------|
| `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved
1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts`
devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175
(cloud metadata exfiltration) |
| `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override);
resolved **3.4.0** | C (override) | dev-only (private
`@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS
bypasses FORBID_TAGS) |
| `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new
override); resolved **1.16.0** | C (override) | dev-only (via
`@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on
cross-domain redirect) |
| `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in
`libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest
bump)** | **published** — direct dep of `@langchain/langgraph-api` |
CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming
redaction bypass) |
| `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via
`@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19
<1` (new override) | C (override) | dev-only | same as above (flushes
vulnerable transitive copies) |
*Strategy C overrides follow the existing repo pattern — axios, qs,
undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and
defu are already overridden the same way.*
### Published-path rationale
`@langchain/langgraph-api` exercises `langsmith` at runtime for tracing
and streaming, which touches the affected internal code paths (lodash
`set()` prototype-pollution guard, token-event redaction). Therefore the
fix is Strategy A (raise the published lower bound) rather than
A-lockfile — this protects end users who pin `@langchain/langgraph-api`.
The lockfile already resolved `langsmith@0.5.20` before this change, so
installs are unchanged at HEAD; the bump is a downstream-safety
constraint tightening.
### Deferred (not fixed in this PR)
- **`protobufjs@6.11.5`** (CRITICAL, CVE-2026-41242) — reached via
`@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps +
examples. `@xenova/transformers` is abandoned; the successor is
`@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross
a breaking API boundary. **Upstream issue — requires a manual migration,
tracked separately.** (See #2329 body for full context.)
- **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) —
`first_patched_version` is `null`; upstream has not released a fix.
Defer until a patched version ships.
### CVE Details
- **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname
Normalization Bypass Leads to SSRF —
https://github.com/advisories/GHSA-3p68-rc4w-qgx5
- **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud
Metadata Exfiltration via Header Injection Chain —
https://github.com/advisories/GHSA-fvcv-3m26-pcqx
- **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS`
via short-circuit evaluation —
https://github.com/advisories/GHSA-39q2-94rc-95cp
- **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication
headers to cross-domain redirect targets —
https://github.com/advisories/GHSA-r4q5-vmmm-2653
- **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` —
https://github.com/advisories/GHSA-fw9q-39r9-c252
- **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass
output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv
### Linear Tickets
Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No
ticket IDs included in the title.
### Verification
- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — **No known vulnerabilities found**
- [x] `pnpm typecheck` on `libs/langgraph-api` — clean
- [x] No staged secrets (`gitleaks git --staged`)
🤖 Submitted by langster-patch
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
## Summary
This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.
## Changes
### `@langchain/langgraph` (`libs/langgraph-core`)
- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
- `thread_id`
- `checkpoint_id`
- `checkpoint_ns`
- `task_id`
- `run_id`
- `assistant_id`
- `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
github-actions[bot]