Possible fix(deps): 15 vulnerable dependencies in package-lock.json

[begininvoke]

Spotted what might be an issue in integrations/langchainjs/package-lock.json around line 3535.

CVE-2026-13676 is a HIGH severity vulnerability where fast-uri incorrectly canonicalizes IDN/Unicode hostnames compared to Node.js's native URL parser. This inconsistency allows attackers to bypass host-based security policies (denial lists, loopback filtering, redirect validation) by supplying Unicode URLs that pass pre-validation but resolve to unauthorized or malicious hosts during actual requests, potentially leading to SSRF, open redirects, or complete policy evasion.

Something like this might fix it:

--- a/integrations/langchainjs/package.json
+++ b/integrations/langchainjs/package.json
@@ -10,7 +10,7 @@
   "dependencies": {
     // existing dependencies...
-    "fast-uri": "^3.1.0"
+    "fast-uri": "^3.1.3"
     // existing dependencies...
   }
 }

Apply changes and regenerate lockfile:
npm install --prefix integrations/langchainjs

For reference: rule CVE-2026-13676. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.