mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-09-11 04:07:52 +02:00
e539ac122f
## Summary Patch both `js-yaml` release lines in `libs/cli/js-examples` for GHSA-2883-xcg3-v3hh: Jest's transitive copy to 3.15.2 and ESLint's to 4.3.2. Updates the existing fix rather than opening a duplicate; no runtime dependencies added and no major-version overrides. Addresses Dependabot alerts [#398](https://github.com/langchain-ai/langgraph/security/dependabot/398) and [#397](https://github.com/langchain-ai/langgraph/security/dependabot/397). These are real vulnerable versions in example development tooling; patch rather than dismiss. Alerts remain open until this reaches `main` and GitHub rescans. ## Verification - [x] Yarn 1.22.22 regenerated the lockfile with lifecycle scripts disabled; diff limited to the two js-yaml entries and scoped resolutions. - [x] `yarn install --frozen-lockfile --ignore-scripts --force --non-interactive` in `libs/cli/js-examples`. - [x] `yarn why js-yaml`: ESLint 4.3.2 and Jest/Istanbul 3.15.2. - [x] Resolved versions checked against freshly retrieved GitHub advisory patched versions for both alerts. - [x] `yarn format:check` and `git diff --check`. - [ ] Build fails in unchanged `tests/graph.int.test.ts:7`: `input` is not a valid update property (also recorded in the earlier PR verification). - [ ] Unit-test script fails because it uses Jest's removed `--testPathPattern` option; Jest requires `--testPathPatterns`. - [ ] Lint fails because ESLint 10 requires `eslint.config.*`, which this example lacks. The build/test/lint configuration issues are outside this scoped dependency patch and remain unresolved. No full test-pass claim. --------- Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
51 lines
1.7 KiB
JSON
51 lines
1.7 KiB
JSON
{
|
|
"name": "example-graph",
|
|
"version": "0.0.1",
|
|
"description": "A starter template for creating a LangGraph workflow.",
|
|
"packageManager": "yarn@1.22.22",
|
|
"main": "my_app/graph.ts",
|
|
"author": "Your Name",
|
|
"license": "MIT",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"clean": "rm -rf dist",
|
|
"test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=\\.test\\.ts$ --testPathIgnorePatterns=\\.int\\.test\\.ts$",
|
|
"test:int": "node --experimental-vm-modules node_modules/jest/bin/jest.js --testPathPattern=\\.int\\.test\\.ts$",
|
|
"format": "prettier --write .",
|
|
"lint": "eslint src",
|
|
"format:check": "prettier --check .",
|
|
"lint:langgraph-json": "node scripts/checkLanggraphPaths.js",
|
|
"lint:all": "yarn lint & yarn lint:langgraph-json & yarn format:check",
|
|
"test:all": "yarn test && yarn test:int && yarn lint:langgraph"
|
|
},
|
|
"dependencies": {
|
|
"@langchain/core": "^1.2.9",
|
|
"@langchain/langgraph": "^1.4.13"
|
|
},
|
|
"resolutions": {
|
|
"@langchain/langgraph-checkpoint": "1.0.4",
|
|
"jest/**/js-yaml": "3.15.2",
|
|
"@eslint/eslintrc/js-yaml": "4.3.2"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "^3.3.6",
|
|
"@eslint/js": "^10.0.1",
|
|
"@tsconfig/recommended": "^1.0.13",
|
|
"@types/jest": "^30.0.0",
|
|
"@typescript-eslint/eslint-plugin": "^8.68.0",
|
|
"@typescript-eslint/parser": "^8.68.0",
|
|
"dotenv": "^17.4.2",
|
|
"eslint": "^10.9.1",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-plugin-import": "^2.32.0",
|
|
"eslint-plugin-no-instanceof": "^1.0.1",
|
|
"eslint-plugin-prettier": "^5.5.6",
|
|
"jest": "^30.5.0",
|
|
"prettier": "^3.9.6",
|
|
"ts-jest": "^29.4.12",
|
|
"typescript": "^7.0.2"
|
|
}
|
|
}
|