## Summary
- Updates `stlc-sync-from-production.yml` to check out `main` (instead
of `next`) and open back-sync PRs targeting `main`
- Aligns with the removal of the `next` branch and the shift to a
direct-to-main flow
## Test plan
- [ ] Trigger `stlc: sync from production` via workflow_dispatch and
confirm the PR it creates targets `main`
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Removes `.github/workflows/stlc-promote-to-main.yml`, which triggered
a `next → main` ff-only merge in `langchainplus` whenever the next→main
PR in this repo was approved or CI passed on `next`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Changes the `check-stainless-file-modification` workflow trigger from
PRs targeting `next` to PRs targeting `main`
## Why
The check was not running on PRs that target `main` directly (e.g.
[#45](https://github.com/langchain-ai/langsmith-java-staging/pull/45)),
leaving Stainless-generated file modifications undetected on that path.
## Test plan
- [ ] Verify the check runs on a future PR targeting `main`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
This PR is part of migrating stlc to land SDK commits directly on `main`
instead of going through the `next` buffer branch.
- Update `stlc-seal-custom-code.yml` trigger from `branches: [next]` to
`branches: [main]` so the seal workflow fires on pushes to `main`
- Delete `stlc-promote-to-main.yml` entirely — this workflow promoted
sealed commits from `next` into `main`, which is no longer needed once
`next` is removed from the flow
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Security Alert Patch
Resolves all 6 open high-severity Dependabot alerts in the Maven
dependency graph.
### Packages Updated
| Package | Resolved change | Strategy | Scope | CVEs resolved |
|---|---|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | 2.15.3 -> 2.18.8; 2.21.0
-> 2.21.4 | Parent bump for Palantir plus constrained Dokka classpaths |
Build/dev only | CVE-2026-54512, CVE-2026-54513 |
| org.bouncycastle:bcpg-jdk18on | 1.80 -> 1.84 | Constraint on Kotlin
publishing validation | Build/dev only | CVE-2026-3505 |
| org.codehaus.plexus:plexus-utils | 4.0.2 -> 4.0.3 | Constraint on
Shadow plugin classpath | Test/build only | CVE-2025-67030 |
### Strategy Notes
- Palantir Java Format moves from 2.89.0 to 2.93.0, the first release
that declares patched Jackson 2.21.4.
- Dokka 2.2.0 is the latest release and still declares Jackson 2.15.3,
so its buildscript and worker configurations are constrained to 2.18.8.
Remove the constraint when Dokka publishes a patched dependency graph.
- Kotlin publishing validation selects Bouncy Castle 1.80 internally, so
that isolated configuration is constrained to 1.84.
- Shadow 8.3.8 still declares Plexus Utils 4.0.2. Shadow 9.4.3 was
assessed but failed the repository R8 compatibility test, so the plugin
remains at 8.3.8 with a buildscript-only Plexus constraint.
### Advisory Details
- CVE-2026-54512 / GHSA-j3rv-43j4-c7qm: Jackson polymorphic type
validator bypass via generic type parameters.
- CVE-2026-54513 / GHSA-rmj7-2vxq-3g9f: Jackson array subtype allowlist
bypass.
- CVE-2026-3505 / GHSA-cj8j-37rh-8475: Bouncy Castle uncontrolled
resource consumption.
- CVE-2025-67030 / GHSA-6fmv-xxpf-w3cw: Plexus Utils directory traversal
in extractFile.
### Linear Tickets
No matching open Linear tickets found.
### Verification
- [x] All project dependency reports contain no affected vulnerable
versions
- [x] Kotlin and Java lint pass
- [x] Full Gradle test suite passes
- [x] ProGuard and R8 compatibility checks pass
- [x] Dokka Javadoc generation passes
- [x] git diff --check passes
KiewanVillatel