fix(deps): update dependency @langchain/community to v1 [security] - #4059
fix(deps): update dependency @langchain/community to v1 [security]#4059renovate[bot] wants to merge 1 commit into
Conversation
|
Finished running flow.
|
||||||||||||
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Check changeset necessityStatus: NOT REQUIRED Reason:
Changeset (copy & paste):N/A |
🤖 Agent Deep Modeling ExecutionStarted at: 2026-08-14 22:16:33 UTC View DetailsCommand Output
RUN v3.2.4 /home/runner/work/liam/liam/frontend/internal-packages/agent (node:7913) ExperimentalWarning: WASI is an experimental feature and might change at any time ✅ [INFO] 2026-08-14T22:16:36.647Z Context: trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=34869435-ffa1-4716-b3c2-f6a959f7dbe7; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=468cbef9-c86b-41d1-8e9b-20b0ce5604c0; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=52747f3e-43d3-411e-a6df-b43c37932c0f; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=96c153d7-fd80-4f58-8be4-75ce4d500f61; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=f3ed8903-4fd0-4c0a-951a-f8d26ee2628b; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=4e05b1d7-c35f-4d23-8f73-41651bb14424; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=1fb40324-9794-491a-ab2b-a0907814e72f; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=ff95786f-92cf-4f96-bd28-21117fb62765; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=5f4fed0f-f817-492d-a0cf-cfd0965143da; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=08d839b8-95fa-4dfd-b9be-afadb460ff0b; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=b07a7b7d-1505-44be-82ea-d54a4892a2e4; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=bdb79032-273a-459e-92ad-8e24fb44ea20; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=5f27e4ae-fc8e-4127-ad37-d8ec4ff88f7a; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=6b60d9c6-edb9-45b7-93ae-c74190e45478; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=39479c91-6dfa-4cb6-be9f-734698ac5d66; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=db2dc0c5-5b71-48e9-94d7-84fbcaa700bf; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=e9391b77-c204-4a07-8283-751099136c43; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=1388618f-2c65-4f84-a820-67fde242200e; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=c205b5fe-f582-446e-a9d0-5d7f22095cc6; trace=34869435-ffa1-4716-b3c2-f6a959f7dbe7,id=5d27dc9a-6de1-498e-ac61-bd227f2b4549 x ⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯ FAIL src/createGraph.integration.test.ts > createGraph Integration > should execute complete workflow Troubleshooting URL: https://js.langchain.com/docs/troubleshooting/errors/MODEL_AUTHENTICATION/ ❯ RunnableCallable.analyzeRequirementsNode [as func] src/pm-agent/nodes/analyzeRequirementsNode.ts:38:11 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯ Test Files 1 failed (1) ELIFECYCLE Command failed with exit code 1. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| }, | ||
| "dependencies": { | ||
| "@langchain/community": "0.3.57", | ||
| "@langchain/community": "1.1.14", |
There was a problem hiding this comment.
🔴 Peer dependency mismatch: @langchain/community@1.1.18 requires @langchain/core@^1.1.27 but project uses @langchain/core@0.3.78
@langchain/community was upgraded from 0.3.57 (v0.x) to 1.1.18 (v1.x), but its companion dependency @langchain/core was left at 0.3.78. The lockfile confirms @langchain/community@1.1.18 declares a peer dependency of @langchain/core: ^1.1.27, which 0.3.78 does not satisfy. Furthermore, @langchain/community@1.1.18 internally pulls in @langchain/openai@1.2.9 (which also requires @langchain/core@^1.1.27) and @langchain/classic@1.0.19 (which requires @langchain/core@^1.0.0), all incompatible with the installed 0.3.78. While pnpm resolves this at install time (using autoInstallPeers), mixing @langchain/core@0.3.x with libraries designed for @langchain/core@1.x will likely cause runtime failures due to API incompatibilities (e.g., changed class interfaces, removed methods, or different type contracts between the 0.x and 1.x lines). The project's own @langchain/openai@0.6.9 (which requires @langchain/core >=0.3.68 <0.4.0) is also now in conflict with the @langchain/openai@1.2.9 transitively brought in by @langchain/community@1.1.18.
Was this helpful? React with 👍 or 👎 to provide feedback.
ece87b7 to
80a1e4c
Compare
80a1e4c to
403577e
Compare
403577e to
daa1818
Compare
fb5e9b8 to
ca1eb86
Compare
ca1eb86 to
c61ec61
Compare
c61ec61 to
376519f
Compare
376519f to
ec8c7e8
Compare
ec8c7e8 to
36244db
Compare
This PR contains the following updates:
0.3.57→1.1.18@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
CVE-2026-26019 / GHSA-gf3v-fwqg-4vh7
More information
Details
Description
The
RecursiveUrlLoaderclass in@langchain/communityis a web crawler that recursively follows links from a starting URL. ItspreventOutsideoption (enabled by default) is intended to restrict crawling to the same site as the base URL.The implementation used
String.startsWith()to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target (e.g.,https://example.com.attacker.compasses astartsWithcheck againsthttps://example.com), causing the crawler to follow links to attacker-controlled or internal infrastructure.Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services (
169.254.169.254), localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction.Impact
An attacker who can influence the content of a page being crawled (e.g., by placing a link on a public-facing page, forum, or user-generated content) could cause the crawler to:
10.x,172.16.x,192.168.x)This is exploitable in any environment where
RecursiveUrlLoaderruns on infrastructure with access to cloud metadata or internal services — which includes most cloud-hosted deployments.Resolution
Two changes were made:
Origin comparison replaced. The
startsWithcheck was replaced with a strict origin comparison using the URL API (new URL(link).origin === new URL(baseUrl).origin). This correctly validates scheme, hostname, and port as a unit, preventing subdomain-based bypasses.SSRF validation added to all fetch operations. A new URL validation module (
@langchain/core/utils/ssrf) was introduced and applied before every outbound fetch in the crawler. This blocks requests to:169.254.169.254,169.254.170.2,100.100.100.200,metadata.google.internal, and related hostnames10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.0.0/16::1,fc00::/7,fe80::/10file:,ftp:,javascript:, etc.)Cloud metadata endpoints are unconditionally blocked and cannot be overridden.
Workarounds
Users who cannot upgrade immediately should avoid using
RecursiveUrlLoaderon untrusted or user-influenced content, or should run the crawler in a network environment without access to cloud metadata or internal services.Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
CVE-2026-27795 / GHSA-mphv-75cg-56wg
More information
Details
Summary
A redirect-based Server-Side Request Forgery (SSRF) bypass exists in
RecursiveUrlLoaderin@langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019).Affected Component
@langchain/communityRecursiveUrlLoaderpreventOutside(default:true) is insufficient to prevent this bypass when redirects are followed automatically.Description
RecursiveUrlLoaderis a web crawler that recursively follows links from a starting URL. The existing SSRF mitigation validates the initial URL before fetching, but it does not re-validate when the request follows redirects. Because fetch follows redirects by default, an attacker can supply a public URL that passes validation and then redirects to a private network address, localhost, or cloud metadata endpoint.This constitutes a “check‑then‑act” gap in the request lifecycle: the safety check occurs before the redirect chain is resolved, and the final destination is never validated.
Impact
If an attacker can influence content on a page being crawled (e.g., user‑generated content, untrusted external pages), they can cause the crawler to:
10.x,172.16.x,192.168.x)This is exploitable in any environment where
RecursiveUrlLoaderruns with access to internal networks or metadata services, which includes most cloud-hosted deployments.Attack Scenario
Example redirector:
Root Cause
validateSafeUrl) is only performed on the initial URL.redirect: "follow"default), so the request can change destinations without additional validation.Resolution
Upgrade to
@langchain/community>= 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validatingLocationtargets before following them.redirect: "manual").Locationis resolved and validated withvalidateSafeUrl()before the next request.Reources
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
langchain-ai/langchainjs-community (@langchain/community)
v0.3.58Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.