mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-10-20 23:11:43 +02:00
a24fc97778
Patch the remaining 1.x and 2.x copies covered by [GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr), which were not addressed by #9349. Regenerate both CLI fixture locks with their declared Yarn 1.22.22: 1.1.11/1.1.12 → 1.1.21 and 2.0.2 → 2.1.7, retaining 5.0.12 with no new packages or manifest changes. Verification: - Both fixtures: `yarn install --frozen-lockfile --ignore-scripts --non-interactive` and `yarn check --integrity --ignore-scripts` passed. - Local Node regression harness: 16 checks passed across all installed brace-expansion and real minimatch 3/9/10 consumers, including normal expansion/matching and advisory-shaped DoS payloads with a three-second subprocess deadline (direct 128k braces; minimatch 64k braces). - Every tracked text file scanned for brace-expansion; all five resolved lock entries are outside all four current advisory ranges. No additional repository copies found. - `git diff --check` passed; only three generated version/URL/integrity triplets changed. Lifecycle scripts and the full suite were intentionally not run. Existing peer-dependency warnings remain, including the checkpoint resolution mismatch in js-examples; dependency-graph ingestion and alert status were not refreshed or claimed resolved. ## References - [Plan](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846/plan) - [Slack thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846) · openai:gpt-6.1-sol (medium) Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>