From af2fd561a7a3d5e7f780b4b8539458843f09b4e0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 16:30:25 +0000 Subject: [PATCH 1/2] chore: bump urllib3 from 2.6.3 to 2.7.0 Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- uv.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 8c00545..631c516 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -42,7 +42,7 @@ dependencies = [ "langchain-core>=0.3.84", "marshmallow>=3.26.2", "pyasn1>=0.6.2", - "urllib3>=2.6.3", + "urllib3>=2.7.0", "virtualenv>=20.36.1", "requests>=2.33.0", ] diff --git a/uv.lock b/uv.lock index 51b938c..652067c 100644 --- a/uv.lock +++ b/uv.lock @@ -1918,7 +1918,7 @@ requires-dist = [ { name = "scipy", specifier = ">=1.12.0" }, { name = "spacy", specifier = ">=3.8.4" }, { name = "tiktoken", specifier = ">=0.8.0" }, - { name = "urllib3", specifier = ">=2.6.3" }, + { name = "urllib3", specifier = ">=2.7.0" }, { name = "virtualenv", specifier = ">=20.36.1" }, ] @@ -5093,11 +5093,11 @@ wheels = [ [[package]] name = "urllib3" -version = "2.6.3" +version = "2.7.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" } +sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" }, + { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, ] [[package]] From 3c954b35da5db93a30bbd3a8e42dacf09f7f9188 Mon Sep 17 00:00:00 2001 From: "aieng-bot[bot]" Date: Tue, 12 May 2026 00:58:39 +0000 Subject: [PATCH 2/2] chore: bump langchain-core to 0.3.86 to fix CVE-2026-44843 Bumps langchain-core from 0.3.84 to 0.3.86 to remediate CVE-2026-44843 (unsafe deserialization in LangChain runtime paths). Co-authored-by: aieng-bot --- pyproject.toml | 2 +- uv.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 631c516..85e0cc9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -39,7 +39,7 @@ dependencies = [ "filelock>=3.20.3", "fonttools>=4.60.2", "pygments>=2.20.0", - "langchain-core>=0.3.84", + "langchain-core>=0.3.85", "marshmallow>=3.26.2", "pyasn1>=0.6.2", "urllib3>=2.7.0", diff --git a/uv.lock b/uv.lock index 652067c..ac60d2f 100644 --- a/uv.lock +++ b/uv.lock @@ -1892,7 +1892,7 @@ requires-dist = [ { name = "ipywidgets", specifier = ">=8.1.5" }, { name = "langchain", specifier = ">=0.3.13" }, { name = "langchain-chroma", specifier = ">=0.2.1" }, - { name = "langchain-core", specifier = ">=0.3.84" }, + { name = "langchain-core", specifier = ">=0.3.85" }, { name = "langchain-experimental", specifier = ">=0.3.3" }, { name = "langchain-google-genai", specifier = ">=2.0.9" }, { name = "langchain-graphrag", specifier = ">=0.0.9" }, @@ -2076,7 +2076,7 @@ wheels = [ [[package]] name = "langchain-core" -version = "0.3.84" +version = "0.3.86" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "jsonpatch" }, @@ -2088,9 +2088,9 @@ dependencies = [ { name = "typing-extensions" }, { name = "uuid-utils" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/13/3e/1e70598fac522eaeeeb22f03107da06495160533b25ba4388be9cef01d55/langchain_core-0.3.84.tar.gz", hash = "sha256:814b75bfe67a8460a53f5839bae9505bbfffc7af6f1aa0a5155715563f5cc490", size = 599092, upload-time = "2026-04-08T19:14:00.106Z" } +sdist = { url = "https://files.pythonhosted.org/packages/fe/8d/d54586b8f65c6fc209db93916ff9e919e1cc14bad8fe66880ea4d7ea9d6c/langchain_core-0.3.86.tar.gz", hash = "sha256:671cbc96a325fe47f7dbab421236ada2d437bc4bfad0038102264885d0b462e2", size = 603154, upload-time = "2026-05-07T16:48:08.14Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/8d/5b/ba75d5b80bd1f60ae799c8cbda5477eb7489fb21d40c967ec509bbd51933/langchain_core-0.3.84-py3-none-any.whl", hash = "sha256:d0b3a7b6473e30a2b3d4588ee09dc6471b8d38c46cd48f3e7c3d1ab6547f63cb", size = 459123, upload-time = "2026-04-08T19:13:57.818Z" }, + { url = "https://files.pythonhosted.org/packages/0c/93/ba19ca54701c6118e68f8785949b6c0eab1df3a5cfa5310508cc86877994/langchain_core-0.3.86-py3-none-any.whl", hash = "sha256:7d2a1c50d2d2a139dbc6465cd339f32d14aa43db5ac9bd232e5b567a238709e8", size = 461306, upload-time = "2026-05-07T16:48:06.283Z" }, ] [[package]]