fix(deps): resolve HIGH transitive vulns (langsmith, fast-xml-builder)

package.json

@@ -74,8 +74,10 @@
       "immutable": ">=5.1.5",
       "handlebars": ">=4.7.9",
       "picomatch": ">=4.0.4",
-      "@xmldom/xmldom": ">=0.9.10"
+      "@xmldom/xmldom": ">=0.9.10",
+      "langsmith": ">=0.6.0 <1.0.0",
+      "fast-xml-builder": ">=1.1.7 <2.0.0"
     },
-    "comment": "Override @langchain/core to >=1.1.38 <1.2.0 to resolve peer dependency conflicts and ensure the standard_schema export exists (required by @langchain/openai >=1.3.0 and @langchain/anthropic >=1.3.0). langchain >=1.2.39 and fast-xml-parser >=5.5.6 fixes GHSA-8gc5-j5rx-235r (numeric entity expansion bypass). qs >=6.14.1 fixes GHSA-6rw7-vpxm-498p (DoS via memory exhaustion) in express. @langchain/langgraph-sdk <2.0.0 avoids the deprecated 2.0.0 release. underscore >=1.13.8 fixes GHSA-qpx9-hpmf-5gmw. immutable >=5.1.5 fixes GHSA-wf6x-7x77-mvgw. handlebars >=4.7.9 fixes GHSA-3mfm-83xf-c92r. picomatch >=4.0.4 fixes GHSA-c2c7-rcm5-vvqj. @xmldom/xmldom >=0.9.10 fixes 4 GHSA advisories (GHSA-2v35-w6hq-6mfw uncontrolled recursion, GHSA-f6ww-3ggp-fr8h XML injection, GHSA-x6wf-f3px-wcqx XML node injection, GHSA-j759-j44w-7fr8 XML node injection); previous >=0.8.12 was too lax — pnpm resolved it to 0.9.9 (vulnerable). Note: path-to-regexp override removed — Express 4 bundles 0.1.x which is unaffected, and overriding to >=0.1.13 resolves to v8+ which breaks Express's API."
+    "comment": "Override @langchain/core to >=1.1.38 <1.2.0 to resolve peer dependency conflicts and ensure the standard_schema export exists (required by @langchain/openai >=1.3.0 and @langchain/anthropic >=1.3.0). langchain >=1.2.39 and fast-xml-parser >=5.5.6 fixes GHSA-8gc5-j5rx-235r (numeric entity expansion bypass). qs >=6.14.1 fixes GHSA-6rw7-vpxm-498p (DoS via memory exhaustion) in express. @langchain/langgraph-sdk <2.0.0 avoids the deprecated 2.0.0 release. underscore >=1.13.8 fixes GHSA-qpx9-hpmf-5gmw. immutable >=5.1.5 fixes GHSA-wf6x-7x77-mvgw. handlebars >=4.7.9 fixes GHSA-3mfm-83xf-c92r. picomatch >=4.0.4 fixes GHSA-c2c7-rcm5-vvqj. @xmldom/xmldom >=0.9.10 fixes 4 GHSA advisories (GHSA-2v35-w6hq-6mfw uncontrolled recursion, GHSA-f6ww-3ggp-fr8h XML injection, GHSA-x6wf-f3px-wcqx XML node injection, GHSA-j759-j44w-7fr8 XML node injection); previous >=0.8.12 was too lax — pnpm resolved it to 0.9.9 (vulnerable). langsmith >=0.6.0 fixes GHSA-3644-q5cj-c5c7 (public prompt pull deserializes untrusted manifests); kept <1.0.0 to stay within @langchain/core@1.1.38's declared langsmith range (>=0.5.0 <1.0.0). fast-xml-builder >=1.1.7 fixes the attribute-value quote-bypass advisory (vulnerable <=1.1.6), pulled transitively via @langchain/anthropic. Note: path-to-regexp override removed — Express 4 bundles 0.1.x which is unaffected, and overriding to >=0.1.13 resolves to v8+ which breaks Express's API."
   }
 }