langchain-ai/langsmith-java
1
0
Fork 0
mirror of https://github.com/langchain-ai/langsmith-java.git synced 2026-08-24 22:01:31 -04:00
Code Issues 2 Packages Projects Releases 11 Wiki Activity

release: 0.1.0-beta.6 (#154)

Browse Source 
* fix: patch security alerts — OTel, Tomcat, Jetty, Logback, Spring, SnakeYAML (#153)

Resolves open Dependabot security alerts across critical+high severity tiers.

Key change: opentelemetry-api/sdk/exporter-otlp 1.32.0 → 1.62.0 (CVE-2026-45292,
published dep). Semconv 1.23.1-alpha → 1.41.1 (stable GA); migrates
ResourceAttributes.SERVICE_* → ServiceAttributes.SERVICE_* (class removed in 1.30+).

Other fixes (test/example scope, non-published):
- Jetty 9.4.57 → 9.4.58.v20250814 (CVE-2025-5115 in http2-common)
- Logback 1.2.13 → 1.5.32 (CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225;
  the 1.2.13 pin was overly conservative — CVE-2023-6481/6378 are fixed since 1.3.12)
- Tomcat 9.0.115 → 9.0.118 in example module (14 alerts, 4 critical)
- Spring 5.3.34 → 5.3.39 + spring-expression constraint (CVE-2024-38809, CVE-2024-38808)
- SnakeYAML 1.31 → 1.32 (CVE-2022-38752, CVE-2022-41854)

Adds SECURITY_FIX_PLAN.md tracking open/stale/no-fix-available alert status.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* release: 0.1.0-beta.6

---------

Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: stainless-app[bot] <142633134+stainless-app[bot]@users.noreply.github.com>
This commit is contained in:
stainless-app[bot]
2026-05-20 11:19:28 -07:00
committed by GitHub
parent 1540e83048
commit c904c2d278
8 changed files with 101 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
langsmith-java-example/build.gradle.kts
+16 -11
View File
@@ -35,19 +35,24 @@ dependencies {
// None of these affect published artifacts (this is a non-published example module).
constraints {
// CVE-2025-24813 (CRITICAL), CVE-2026-24734, CVE-2025-55752, CVE-2025-53506,
// CVE-2025-52520, CVE-2025-48989, CVE-2025-48988, CVE-2024-56337, CVE-2024-50379, CVE-2024-34750
// CVE-2025-52520, CVE-2025-48989, CVE-2025-48988, CVE-2024-56337, CVE-2024-50379, CVE-2024-34750,
// CVE-2026-29145, CVE-2026-29129, CVE-2026-34483, CVE-2026-34487, CVE-2026-34500, CVE-2026-32990,
// CVE-2026-25854, CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513,
// CVE-2026-43514, CVE-2026-43515
// Remove this constraint when upgrading to Spring Boot 3.x (which manages Tomcat 10+).
implementation("org.apache.tomcat.embed:tomcat-embed-core") { version { require("9.0.115") } }
implementation("org.apache.tomcat.embed:tomcat-embed-websocket") { version { require("9.0.115") } }
// CVE-2024-22243, CVE-2024-22259, CVE-2024-22262
implementation("org.apache.tomcat.embed:tomcat-embed-core") { version { require("9.0.118") } }
implementation("org.apache.tomcat.embed:tomcat-embed-websocket") { version { require("9.0.118") } }
// CVE-2024-22243, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, CVE-2024-38808
// Note: CVE-2016-1000027 (CRITICAL) requires spring-web 6.0.0 — needs Spring Boot 3.x upgrade.
implementation("org.springframework:spring-web") { version { require("5.3.34") } }
implementation("org.springframework:spring-webmvc") { version { require("5.3.34") } }
// CVE-2023-6481, CVE-2023-6378
implementation("ch.qos.logback:logback-core") { version { require("1.2.13") } }
implementation("ch.qos.logback:logback-classic") { version { require("1.2.13") } }
// CVE-2022-25857 (note: CVE-2022-1471 requires snakeyaml 2.0 which is incompatible with Spring Boot 2.7.x)
implementation("org.yaml:snakeyaml") { version { require("1.31") } }
implementation("org.springframework:spring-web") { version { require("5.3.39") } }
implementation("org.springframework:spring-webmvc") { version { require("5.3.39") } }
implementation("org.springframework:spring-expression") { version { require("5.3.39") } }
// CVE-2023-6481, CVE-2023-6378, CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225
implementation("ch.qos.logback:logback-core") { version { require("1.5.32") } }
implementation("ch.qos.logback:logback-classic") { version { require("1.5.32") } }
// CVE-2022-25857, CVE-2022-38752, CVE-2022-41854
// (note: CVE-2022-1471 requires snakeyaml 2.0 which is incompatible with Spring Boot 2.7.x)
implementation("org.yaml:snakeyaml") { version { require("1.32") } }
}
}