From 03cfdf36ad855b678c522023064d878d1197c661 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 29 Jun 2026 09:20:24 +0000 Subject: [PATCH] fix(deps): bump langsmith 0.8.9 -> 0.9.3 to clear GHSA-f4xh-w4cj-qxq8 The SCA gate (scripts/scan.sh, SEC-R13.2) fails on a HIGH advisory in the transitive langsmith pin: GHSA-f4xh-w4cj-qxq8 - LangSmith SDK TracingMiddleware: arbitrary server-side file read (fixed upstream in 0.8.18). langsmith is pulled in transitively via langchain-core. uv resolves the upgrade to 0.9.3, the latest release compatible with the existing langchain-core / langgraph pins; the change is lockfile-only and touches no other package. This advisory is unrelated to the README work on this branch, but it blocks the SCA gate on every PR (and main) until the lock is bumped, so it is included here to get the branch green. It can be split into its own PR if a docs-only change is preferred. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_018NhEyetbQCmnw8obPg7Awp --- uv.lock | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/uv.lock b/uv.lock index bc8e908..1cbcffb 100644 --- a/uv.lock +++ b/uv.lock @@ -886,23 +886,27 @@ wheels = [ [[package]] name = "langsmith" -version = "0.8.9" +version = "0.9.3" source = { registry = "https://pypi.org/simple" } dependencies = [ + { name = "anyio" }, + { name = "distro" }, { name = "httpx" }, { name = "orjson", marker = "platform_python_implementation != 'PyPy'" }, { name = "packaging" }, { name = "pydantic" }, { name = "requests" }, { name = "requests-toolbelt" }, + { name = "sniffio" }, + { name = "typing-extensions" }, { name = "uuid-utils" }, { name = "websockets" }, { name = "xxhash" }, { name = "zstandard" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/e4/dd/f4c8a12987318e505b10760d30c3c2d45e8dc87ba8f47a004c753a9e7b35/langsmith-0.8.9.tar.gz", hash = "sha256:f16e37fcd5a8a2d4db30eae0e399a866a65ce5cc86218825c59409ed57a3bf53", size = 4428684, upload-time = "2026-06-03T17:56:09.448Z" } +sdist = { url = "https://files.pythonhosted.org/packages/7e/b7/43f80940a758ceb48714ccc10c7acb9564be4f0d4786e8ed5d46deb0be39/langsmith-0.9.3.tar.gz", hash = "sha256:868a007b3ecda002914b21212a953c77fcb1d71a8a09a94562c3b57941d3df3a", size = 4577380, upload-time = "2026-06-26T15:56:30.45Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/b5/2f/a701663c9fb4d9630448622a684bc372b4905b9a6dbe2297d55a70fde04e/langsmith-0.8.9-py3-none-any.whl", hash = "sha256:c9519cabc75568d088df045710d1b86eae9780c91054528b2aa7e6cb1fc80c52", size = 403165, upload-time = "2026-06-03T17:56:07.226Z" }, + { url = "https://files.pythonhosted.org/packages/9e/fb/dc9f70b5581371fba7b01ba0704fe859bfcd12c4dad82b42ec12bd4160b1/langsmith-0.9.3-py3-none-any.whl", hash = "sha256:aac85686868a7e61d77858b880230e510583c61ea48ac0a197e6ceff64ffb22b", size = 619927, upload-time = "2026-06-26T15:56:28.301Z" }, ] [[package]]