build(deps): bump @langchain/community from 1.1.3 to 1.1.14#22
build(deps): bump @langchain/community from 1.1.3 to 1.1.14#22dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
Bumps [@langchain/community](https://github.com/langchain-ai/langchainjs) from 1.1.3 to 1.1.14. - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/community@1.1.3...@langchain/community@1.1.14) --- updated-dependencies: - dependency-name: "@langchain/community" dependency-version: 1.1.14 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| "@fastify/swagger-ui": "^5.2.4", | ||
| "@lancedb/lancedb": "^0.23.0", | ||
| "@langchain/community": "^1.1.3", | ||
| "@langchain/community": "^1.1.14", |
There was a problem hiding this comment.
Unmet peer dependency: @langchain/core version too low
High Severity
@langchain/community@1.1.14 declares a peer dependency on @langchain/core@^1.1.21, but package.json still specifies @langchain/core at ^1.1.12 and the lockfile resolves it to 1.1.12. The 1.1.14 release notes describe integrating validateSafeUrl and isSameOrigin from @langchain/core/utils/ssrf, a module only available starting in 1.1.21. This unmet peer dependency can cause runtime import failures if any code path in @langchain/community attempts to load the SSRF utilities from @langchain/core.
Bumps @langchain/community from 1.1.3 to 1.1.14.
Release notes
Sourced from
@langchain/community's releases.... (truncated)
Commits
d4aa95achore: version packages (#9989)1a5b644chore: fix changeset (#9994)be7c778chore: caret resolution for core (#9993)6939dabfix(openai): store response.output in response_metadata for reasoning model r...ea7e791fix(agents): concurrent-dynamic-system-prompt-agent-support (#9983)342fd4fchore(langchain): relax benchmark (#9992)8a52dadDon't re-emit input state from middleware hooks that return void (#9986)5f28338feat(agents): support returning Command from wrapModelCall middleware (#9981)d5e3db0feat(core,community): ssrf hardening (#9990)e2ed407Set the correct_llmTypefor Google models (#9985)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Dependency-only change, but it upgrades
openai/LangChain internals and could alter AI integrations or networking behavior (e.g., loader/URL handling) at runtime.Overview
Updates
apps/apito use@langchain/community^1.1.14(from^1.1.3) and refreshespnpm-lock.yamlaccordingly.The lockfile change pulls in newer transitive LangChain/OpenAI-related packages (notably
openai6.16.0→6.21.0,@langchain/openai1.2.1→1.2.7,@langchain/classic1.0.8→1.0.17, andlangsmith0.5.2) plus assorted minor dependency metadata/version bumps.Written by Cursor Bugbot for commit 379b8e8. This will update automatically on new commits. Configure here.