[andriy-sudo]

Clears all 14 open Dependabot alerts on agentql-integrations, plus every finding the lapsed osv-scanner.toml entries were hiding. One consolidated PR, part of INF-3001. Supersedes Dependabot #53–#57.

⚠️ Reviewer attention — langchain/ moves from the 0.3 to the 1.x ecosystem. This is a manifest-only change (no .py edits). But it raises langchain-agentql's declared langchain-core range from <1.0 to >=1.6.5,<2. This repo has no CI tests, only integration tests that need an AgentQL key. Local validation is below. Please run langchain/tests/integration_tests before merging. CD.yml publishes only from the release branch, so merging to main does not publish to PyPI.

Why now

Every one of the 12 osv-scanner.toml entries lapsed (the last on 2026-09-25), and both premises they rested on are now false:

• "langchain-community 0.3.x caps langchain-core <1.0, so a 1.x migration is impossible." langchain-community 0.4.2 is stable and requires langchain-core>=1.4.0. All langchain fixes are reachable.
• "dify_plugin==0.0.1b65 pins flask ~=3.0 / werkzeug ~=3.0 / requests ~=2.32." dify_plugin 0.10.2 requires flask>=3.1.3, werkzeug>=3.1.8, requests>=2.33.1.
• The js-yaml entry said "fix requires 4.x". 3.15.2 (same major) fixes all four js-yaml advisories, so @istanbuljs/load-nyc-config's safeLoad keeps working.

Nothing renewed. The file is deleted, because the repo scans clean with no ignores.

Changes

Project	Package	Old	New	Advisories	Status
langchain	langchain-core	0.3.86	1.6.5	GHSA-qh6h-p6c9-ff54 (7.5), GHSA-2g6r-c272-w58r	✅ Fixed
langchain	langchain	0.3.30	1.4.2	GHSA-gr75-jv2w-4656	✅ Fixed
langchain	langchain-openai	0.3.35	1.6.6	GHSA-r7w7-9xr2-qq2r	✅ Fixed
langchain	langchain-text-splitters	0.3.11	1.1.2	GHSA-fv5p-p927-qmxr	✅ Fixed
langchain	pytest (test)	7.4.4	9.1.1	GHSA-6w46-j5rx-g56g	✅ Fixed
langchain	aiohttp	3.14.1	3.14.3	GHSA-cq5v-8q36-5273, -mfx4-hv73-q22v, -mq44-7p77-q5h7	✅ Fixed
langchain	anyio	4.12.1	4.15.1	GHSA-82r6-8w77-94w6 (critical 9.3), GHSA-5p39-cfhj-2xmp	✅ Fixed
langchain	click	8.3.1	8.5.0	GHSA-47fr-3ffg-hgmw (7.2)	✅ Fixed
dify	dify_plugin	0.0.1b65	0.10.2	lifts flask → 3.1.3, werkzeug → 3.1.8, requests → 2.34.2 (GHSA-68rp-wp8r-4726, -29vq-49wr-vm6x, -87hc-h4r5-73f7, -hgf8-39gv-g3f2, -gc5v-m9x4-r6x2)	✅ Fixed
dify	anyio / idna (floors)	4.9.0 / 3.9.0	≥4.15.1 / ≥3.20	GHSA-82r6-8w77-94w6, GHSA-5p39-cfhj-2xmp, PYSEC-2026-215 / GHSA-65pc-fj4g-8rjx	✅ Fixed
zapier	brace-expansion (override)	1.1.13	1.1.18	GHSA-3jxr-9vmj-r5cp, -mh99-v99m-4gvg, -rgw5-rvv9-x895	✅ Fixed
zapier	js-yaml	3.14.2	3.15.2	GHSA-2883-xcg3-v3hh, -52cp-r559-cp3m, -5p4m-2wfm-xmqj, -h67p-54hq-rp68	✅ Fixed
zapier	browserslist	4.28.1	4.29.1	GHSA-73wf-gq98-2v4g, -c83g-rgw3-j3cx	✅ Fixed
zapier	baseline-browser-mapping	2.9.17	2.11.26	GHSA-w5vr-8v7q-w6rv	✅ Fixed

Also moved with the langchain migration: langchain-community 0.3.31 → 0.4.2 (now pulls langchain-classic 1.0.8), langchain-tests → 1.1.9, pytest-asyncio → 1.4.0 (required by langchain-tests 1.x).

Validation

• osv-scanner, with no ignores: main has 30 findings; this branch has 0 across all three projects.
• langchain (Python 3.12, poetry install --with test): all 9 langchain_agentql modules import. Every external name the source imports resolves on 1.x: init_chat_model, playwright ClickTool/NavigateTool/BaseBrowserTool/PlayWrightBrowserToolkit, DuckDuckGoSearchResults, WriteFileTool, BaseLoader, ToolsIntegrationTests. pytest --collect-only collects all 12 tests. Not run: the integration tests themselves, which need an AgentQL key and a browser.
• dify (Python 3.12, dify_plugin 0.10.2): tools.extract_web_data and provider.agentql import. All 6 SDK names the plugin uses exist, Tool.create_json_message exists, and DifyPluginEnv(MAX_REQUEST_TIMEOUT=120) constructs.
• zapier: lock regenerated in node:22 on linux (no platform entries dropped). npm audit: 0 vulnerabilities.

Changelog impact summary

Package	Old	New	Classification	Key changes
langchain-core / langchain / -openai / -text-splitters / -community	0.3.x	1.x / 0.4.2	Breaking (ecosystem major)	LangChain 1.0 moved legacy chains/agents to langchain-classic. Every API this package imports is unchanged (verified above). Downstream users of langchain-agentql will need langchain-core>=1.6.5 once a release is cut.
pytest / pytest-asyncio	7.4 / 0.23	9.1 / 1.4	Breaking (test-only)	Required by langchain-tests 1.x. asyncio_mode = "auto" is unchanged and supported.
dify_plugin	0.0.1b65	0.10.2	Notable	Beta → stable SDK line. All used APIs present (verified).
aiohttp, anyio, click, idna	—	—	Patch/security	Same-major bug/security fixes.
brace-expansion, js-yaml, browserslist, baseline-browser-mapping	—	—	Patch/security	Same-major, dev-tooling (jest/istanbul/babel) only.

All changes are manifest/lock files, requirements.txt and deleting osv-scanner.toml. No functional source code changes.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: e63cd700-d42b-457c-82f1-b8780c8682ca

📥 Commits

Reviewing files that changed from the base of the PR and between a8bb50e and 8bfa680.

⛔ Files ignored due to path filters (2)

• langchain/poetry.lock is excluded by !**/*.lock
• zapier/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• dify/requirements.txt
• langchain/pyproject.toml
• osv-scanner.toml
• zapier/package.json

💤 Files with no reviewable changes (1)

• osv-scanner.toml

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The PR updates dependency versions and minimum constraints in Dify, LangChain, and Zapier. It also removes 12 vulnerability-ignore entries, including their expiration dates and reasons, from the scanner configuration.

Suggested reviewers: paveldudka

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 8bfa6

No concrete issue currently blocks merging. LangChain integration tests remain unrun, so the dependency upgrade should receive normal integration validation when the required key and browser are available.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security dependency updates, LangChain 1.x migration, Dify upgrade, npm relock, and tracking issue.
Description check	✅ Passed	The description directly explains the dependency upgrades, vulnerability remediation, removed OSV ignores, validation results, and the unrun integration tests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}