fix(security): bump langchain-core to 0.3.86 (GHSA-c67j-w6g6-q2cm)

@zen-agentchecks n/achecks…zen/socket-fix-critical-gtfz0h → next1 files · +34 −3updated 3w ago

▸Description· 1 comment

Description

Resolves both critical CVE alerts (same GHSA referenced twice) for langchain-core reported by Socket.dev for this repo.

Vulnerabilities Fixed

Alert ID	Severity	Package	Fix
GHSA-c67j-w6g6-q2cm	critical	`langchain-core@0.3.72`	bumped to `0.3.86` (latest 0.3.x; > patched `0.3.81`)

GHSA: https://github.com/advisories/GHSA-c67j-w6g6-q2cm (LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs)

Applied via uv lock --upgrade-package langchain-core. The repo stays on the 0.3.x branch of langchain-core, so no breaking major-version transition. Adds uuid-utils as a transitive dependency.

How did I test this PR

uv lock --upgrade-package langchain-core reported Updated langchain-core v0.3.72 -> v0.3.86 and Added uuid-utils v0.16.0.
git diff uv.lock is scoped to langchain-core (+ uuid-utils) — no unrelated dep churn (37 line change).
CI on this PR will run a real uv sync + tests against the new lockfile.

Unresolved (out of scope for this run)

999 cve alerts at high severity remain across transitive deps (largest tier-1 surface in this repo). These will be picked up by subsequent weekly runs.

Auto-generated by Socket.dev security cron

Origin: cron-socket-tier1-weekly / zen-cron-9b6a4e268d91 Triggered by: saransh@composio.dev | Source: cron Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-9b6a4e268d91

@zen-agent3w ago

Final status — Socket.dev security cron

⚠️ CI: 7/8 checks PASSED. The run-tests job failed on 2 tests — test_get_auth_data[production] and test_valid_connection_id_passes[production] — both with 403 Forbidden from /api/v3/admin/connections/ca_vbZ1LhakOBdV.
This is pre-existing on the next branch: every Unit Tests - Integrator run on next since 2026-05-19 has failed with the same 403 (verified via gh api repos/ComposioHQ/integrator/actions/workflows/206717671/runs?branch=next). The test connection ID ca_vbZ1LhakOBdV has presumably been revoked or the admin token has expired — unrelated to this uv.lock change.
✅ Integration Tests: green.
✅ Lint, check-lines, all analyze jobs: green.
🟢 Codex review: skipped — lockfile-only change.

Safe to merge once the pre-existing run-tests infra issue is fixed (separate from this PR).

loading diff…

@zen-agent3w ago

Final status — Socket.dev security cron

⚠️ CI: 7/8 checks PASSED. The run-tests job failed on 2 tests — test_get_auth_data[production] and test_valid_connection_id_passes[production] — both with 403 Forbidden from /api/v3/admin/connections/ca_vbZ1LhakOBdV.
This is pre-existing on the next branch: every Unit Tests - Integrator run on next since 2026-05-19 has failed with the same 403 (verified via gh api repos/ComposioHQ/integrator/actions/workflows/206717671/runs?branch=next). The test connection ID ca_vbZ1LhakOBdV has presumably been revoked or the admin token has expired — unrelated to this uv.lock change.
✅ Integration Tests: green.
✅ Lint, check-lines, all analyze jobs: green.
🟢 Codex review: skipped — lockfile-only change.

Safe to merge once the pre-existing run-tests infra issue is fixed (separate from this PR).