mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-10-21 07:21:44 +02:00
8b9c1a1301
Update brace-expansion from 5.0.9 to 5.0.12 in both CLI JavaScript example lockfiles to address CVE-2026-102277. Existing dependency ranges already allow the patched version; no manifests or runtime code change. Verification: generated the replacement entries with the declared Yarn 1.22.22 in an isolated dependency fixture, then checked basic brace/range expansion and `git diff --check`. Full example installs were attempted but blocked by registry.yarnpkg.com DNS/timeouts, including with npm selected as the registry; only the authentic generated package entries were transferred, preserving unrelated resolutions. Full package lint/tests were not run and CI is not claimed. ## References - [Slack thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846) · openai:gpt-6.1-sol (medium) Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>