diff --git a/package.json b/package.json index f738fbf..ad0e916 100644 --- a/package.json +++ b/package.json @@ -74,8 +74,10 @@ "immutable": ">=5.1.5", "handlebars": ">=4.7.9", "picomatch": ">=4.0.4", - "@xmldom/xmldom": ">=0.9.10" + "@xmldom/xmldom": ">=0.9.10", + "langsmith": ">=0.6.0 <1.0.0", + "fast-xml-builder": ">=1.1.7 <2.0.0" }, - "comment": "Override @langchain/core to >=1.1.38 <1.2.0 to resolve peer dependency conflicts and ensure the standard_schema export exists (required by @langchain/openai >=1.3.0 and @langchain/anthropic >=1.3.0). langchain >=1.2.39 and fast-xml-parser >=5.5.6 fixes GHSA-8gc5-j5rx-235r (numeric entity expansion bypass). qs >=6.14.1 fixes GHSA-6rw7-vpxm-498p (DoS via memory exhaustion) in express. @langchain/langgraph-sdk <2.0.0 avoids the deprecated 2.0.0 release. underscore >=1.13.8 fixes GHSA-qpx9-hpmf-5gmw. immutable >=5.1.5 fixes GHSA-wf6x-7x77-mvgw. handlebars >=4.7.9 fixes GHSA-3mfm-83xf-c92r. picomatch >=4.0.4 fixes GHSA-c2c7-rcm5-vvqj. @xmldom/xmldom >=0.9.10 fixes 4 GHSA advisories (GHSA-2v35-w6hq-6mfw uncontrolled recursion, GHSA-f6ww-3ggp-fr8h XML injection, GHSA-x6wf-f3px-wcqx XML node injection, GHSA-j759-j44w-7fr8 XML node injection); previous >=0.8.12 was too lax — pnpm resolved it to 0.9.9 (vulnerable). Note: path-to-regexp override removed — Express 4 bundles 0.1.x which is unaffected, and overriding to >=0.1.13 resolves to v8+ which breaks Express's API." + "comment": "Override @langchain/core to >=1.1.38 <1.2.0 to resolve peer dependency conflicts and ensure the standard_schema export exists (required by @langchain/openai >=1.3.0 and @langchain/anthropic >=1.3.0). langchain >=1.2.39 and fast-xml-parser >=5.5.6 fixes GHSA-8gc5-j5rx-235r (numeric entity expansion bypass). qs >=6.14.1 fixes GHSA-6rw7-vpxm-498p (DoS via memory exhaustion) in express. @langchain/langgraph-sdk <2.0.0 avoids the deprecated 2.0.0 release. underscore >=1.13.8 fixes GHSA-qpx9-hpmf-5gmw. immutable >=5.1.5 fixes GHSA-wf6x-7x77-mvgw. handlebars >=4.7.9 fixes GHSA-3mfm-83xf-c92r. picomatch >=4.0.4 fixes GHSA-c2c7-rcm5-vvqj. @xmldom/xmldom >=0.9.10 fixes 4 GHSA advisories (GHSA-2v35-w6hq-6mfw uncontrolled recursion, GHSA-f6ww-3ggp-fr8h XML injection, GHSA-x6wf-f3px-wcqx XML node injection, GHSA-j759-j44w-7fr8 XML node injection); previous >=0.8.12 was too lax — pnpm resolved it to 0.9.9 (vulnerable). langsmith >=0.6.0 fixes GHSA-3644-q5cj-c5c7 (public prompt pull deserializes untrusted manifests); kept <1.0.0 to stay within @langchain/core@1.1.38's declared langsmith range (>=0.5.0 <1.0.0). fast-xml-builder >=1.1.7 fixes the attribute-value quote-bypass advisory (vulnerable <=1.1.6), pulled transitively via @langchain/anthropic. Note: path-to-regexp override removed — Express 4 bundles 0.1.x which is unaffected, and overriding to >=0.1.13 resolves to v8+ which breaks Express's API." } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a030132..2714e29 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -30,6 +30,8 @@ overrides: handlebars: '>=4.7.9' picomatch: '>=4.0.4' '@xmldom/xmldom': '>=0.9.10' + langsmith: '>=0.6.0 <1.0.0' + fast-xml-builder: '>=1.1.7 <2.0.0' importers: @@ -3344,10 +3346,6 @@ packages: resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==} engines: {node: '>=10'} - chalk@5.6.2: - resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==} - engines: {node: ^12.17.0 || ^14.13 || >=16.0.0} - character-entities-html4@2.1.0: resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==} @@ -3489,9 +3487,6 @@ packages: console-control-strings@1.1.0: resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==} - console-table-printer@2.15.0: - resolution: {integrity: sha512-SrhBq4hYVjLCkBVOWaTzceJalvn5K1Zq5aQA6wXC/cYjI3frKWNPEMK3sZsJfNNQApvCQmgBcc13ZKmFj8qExw==} - content-disposition@0.5.4: resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==} engines: {node: '>= 0.6'} @@ -3957,8 +3952,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-xml-builder@1.1.4: - resolution: {integrity: sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==} + fast-xml-builder@1.2.0: + resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} fast-xml-parser@5.5.7: resolution: {integrity: sha512-LteOsISQ2GEiDHZch6L9hB0+MLoYVLToR7xotrzU0opCICBkxOPgHAy1HxAvtxfJNXDJpgAsQN30mkrfpO2Prg==} @@ -4621,8 +4616,8 @@ packages: peerDependencies: '@langchain/core': '>=1.1.38 <1.2.0' - langsmith@0.5.11: - resolution: {integrity: sha512-Yio502Ow2vbVt16P1sybNMNpMsr5BMqoeonoi4flrcDsP55No/aCe2zydtBNOv0+kjKQw4WSKAzTsNwenDeD5w==} + langsmith@0.7.4: + resolution: {integrity: sha512-EGYCw85etSarYazeTgj8DICVIFg+26gsVZ0zq8V7kjIb59huURJpZZJqVFkvRpZFxmfyYrpIhtk2qtHgGR8K+w==} peerDependencies: '@opentelemetry/api': '*' '@opentelemetry/exporter-trace-otlp-proto': '*' @@ -5388,6 +5383,10 @@ packages: resolution: {integrity: sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==} engines: {node: '>=14.0.0'} + path-expression-matcher@1.5.0: + resolution: {integrity: sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==} + engines: {node: '>=14.0.0'} + path-is-absolute@1.0.1: resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==} engines: {node: '>=0.10.0'} @@ -5986,9 +5985,6 @@ packages: simple-swizzle@0.2.4: resolution: {integrity: sha512-nAu1WFPQSMNr2Zn9PGSZK9AGn4t/y97lEm+MXTtUDwfP0ksAIX4nO+6ruD9Jwut4C49SB1Ws+fbXsm/yScWOHw==} - simple-wcswidth@1.1.2: - resolution: {integrity: sha512-j7piyCjAeTDSjzTSQ7DokZtMNwNlEAyxqSZeCS+CXH7fJ4jx3FuJ/mTW3mE+6JLs4VJBbcll0Kjn+KXI5t21Iw==} - slash@3.0.0: resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==} engines: {node: '>=8'} @@ -6694,6 +6690,10 @@ packages: utf-8-validate: optional: true + xml-naming@0.1.0: + resolution: {integrity: sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==} + engines: {node: '>=16.0.0'} + xmlbuilder@10.1.1: resolution: {integrity: sha512-OyzrcFLL/nb6fMGHbiRDuPup9ljBycsdCypwuyg5AAHvyWzGfChJpCXMG88AGTIMFhGZ9RccFN1e6lhg3hkwKg==} engines: {node: '>=4.0'} @@ -8170,7 +8170,7 @@ snapshots: yaml: 2.8.3 zod: 4.3.6 optionalDependencies: - langsmith: 0.5.11(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) + langsmith: 0.7.4(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) transitivePeerDependencies: - '@opentelemetry/api' - '@opentelemetry/exporter-trace-otlp-proto' @@ -8186,7 +8186,7 @@ snapshots: camelcase: 6.3.0 decamelize: 1.2.0 js-tiktoken: 1.0.21 - langsmith: 0.5.11(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) + langsmith: 0.7.4(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) mustache: 4.2.0 p-queue: 6.6.2 uuid: 11.1.0 @@ -10185,8 +10185,6 @@ snapshots: ansi-styles: 4.3.0 supports-color: 7.2.0 - chalk@5.6.2: {} - character-entities-html4@2.1.0: {} character-entities-legacy@3.0.0: {} @@ -10307,10 +10305,6 @@ snapshots: console-control-strings@1.1.0: {} - console-table-printer@2.15.0: - dependencies: - simple-wcswidth: 1.1.2 - content-disposition@0.5.4: dependencies: safe-buffer: 5.2.1 @@ -10873,13 +10867,14 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-xml-builder@1.1.4: + fast-xml-builder@1.2.0: dependencies: - path-expression-matcher: 1.1.3 + path-expression-matcher: 1.5.0 + xml-naming: 0.1.0 fast-xml-parser@5.5.7: dependencies: - fast-xml-builder: 1.1.4 + fast-xml-builder: 1.2.0 path-expression-matcher: 1.1.3 strnum: 2.2.1 @@ -11527,7 +11522,7 @@ snapshots: '@langchain/core': 1.1.38(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) '@langchain/langgraph': 1.2.6(@langchain/core@1.1.38(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(zod@4.3.6) '@langchain/langgraph-checkpoint': 1.0.1(@langchain/core@1.1.38(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0)) - langsmith: 0.5.11(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) + langsmith: 0.7.4(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0) uuid: 11.1.0 zod: 4.3.6 transitivePeerDependencies: @@ -11543,14 +11538,9 @@ snapshots: - ws - zod-to-json-schema - langsmith@0.5.11(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0): + langsmith@0.7.4(openai@6.32.0(ws@8.19.0)(zod@3.25.76))(ws@8.19.0): dependencies: - '@types/uuid': 10.0.0 - chalk: 5.6.2 - console-table-printer: 2.15.0 p-queue: 6.6.2 - semver: 7.7.4 - uuid: 10.0.0 optionalDependencies: openai: 6.32.0(ws@8.19.0)(zod@3.25.76) ws: 8.19.0 @@ -12723,6 +12713,8 @@ snapshots: path-expression-matcher@1.1.3: {} + path-expression-matcher@1.5.0: {} + path-is-absolute@1.0.1: {} path-key@3.1.1: {} @@ -13430,8 +13422,6 @@ snapshots: dependencies: is-arrayish: 0.3.4 - simple-wcswidth@1.1.2: {} - slash@3.0.0: {} smart-buffer@4.2.0: {} @@ -14151,6 +14141,8 @@ snapshots: ws@8.19.0: {} + xml-naming@0.1.0: {} + xmlbuilder@10.1.1: {} xtend@4.0.2: {}