From fd6ce93250a3d614c90cd6e90c39b01188906c6e Mon Sep 17 00:00:00 2001
From: Samuel Berton <47687944+samuBe@users.noreply.github.com>
Date: Sat, 28 Mar 2026 16:23:35 +0100
Subject: [PATCH 1/2] fix: upgrade langchain-core and requests to patch
 security vulnerabilities

- langchain-core 0.2.0 -> 1.2.22 (CVE-2026-34070, path traversal, HIGH)
- langchain 0.2.0 -> 1.2.13 (compatibility with new langchain-core)
- langchain-community 0.2.0 -> 0.4.1 (compatibility)
- langchain-text-splitters 0.2.0 -> 1.1.1 (compatibility)
- requests 2.31.0 -> 2.33.0 (CVE-2026-25645, insecure temp file, MEDIUM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 requirements.txt | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 0d2a94b..39ae844 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -24,10 +24,10 @@ jsonpatch==1.33
 jsonpointer==2.4
 jsonschema==4.22.0
 jsonschema-specifications==2023.12.1
-langchain==0.2.0
-langchain-community==0.2.0
-langchain-core==0.2.0
-langchain-text-splitters==0.2.0
+langchain==1.2.13
+langchain-community==0.4.1
+langchain-core==1.2.22
+langchain-text-splitters==1.1.1
 langsmith==0.1.59
 Markdown==3.6
 markdown-it-py==3.0.0
@@ -54,7 +54,7 @@ pytz==2024.1
 PyYAML==6.0.1
 referencing==0.35.1
 replicate==0.26.0
-requests==2.31.0
+requests==2.33.0
 rich==13.7.1
 rpds-py==0.18.1
 setuptools==69.5.1

From 7f54c353c28f11b8252649fb14497dd0fd8ab69e Mon Sep 17 00:00:00 2001
From: Samuel Berton <47687944+samuBe@users.noreply.github.com>
Date: Sat, 28 Mar 2026 16:26:24 +0100
Subject: [PATCH 2/2] fix: update langchain imports for v1.x compatibility

- Remove unused LLMChain import (removed in langchain 1.x)
- Move CommaSeparatedListOutputParser import to langchain_core.output_parsers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 main.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/main.py b/main.py
index 6354b01..7800fa9 100644
--- a/main.py
+++ b/main.py
@@ -1,9 +1,8 @@
 import streamlit as st
-from langchain.chains import LLMChain
 import replicate
 from langchain_community.llms import Replicate
 from langchain_core.prompts import PromptTemplate
-from langchain.output_parsers import CommaSeparatedListOutputParser
+from langchain_core.output_parsers import CommaSeparatedListOutputParser
 import os
 from streamlit_searchbox import st_searchbox
 from typing import List 
@@ -193,7 +192,8 @@ def create_route(city, landmarks):
        input_variables=["landmarks", "city", "end"]
     )
     chain = prompt | llm
-    landmarks_string = "\n".join([f"{row['Name']}" for index, row in landmarks.iloc[:5,:].iterrows()])
+    landmarks_string = "
+".join([f"{row['Name']}" for index, row in landmarks.iloc[:5,:].iterrows()])
     print(landmarks_string)
     part_one = chain.invoke({'city': city, 'landmarks':landmarks_string, 'end': landmarks.iloc[5,:]['Name']})
     if len(landmarks)<5:
@@ -212,7 +212,8 @@ def create_route(city, landmarks):
         input_variables=["landmarks", "city", "previous"]
     )
     chain = prompt | llm
-    landmarks_string = "\n".join([f"{row['Name']}" for index, row in landmarks.iloc[5:,:].iterrows()])
+    landmarks_string = "
+".join([f"{row['Name']}" for index, row in landmarks.iloc[5:,:].iterrows()])
     part_two = chain.invoke({'city': city, 'landmarks':landmarks_string, 'previous': landmarks.iloc[4,:]['Name']})
     return part_one + " " + part_two
 
@@ -267,4 +268,3 @@ def generate_route(city, stops):
             file_name='BikeRouter-route.html',
             mime='text/html'
     )
-