fix(security): clear all open alerts — langchain 1.x, dify_plugin 0.10.2, npm relock (INF-3001)

dify/requirements.txt

@@ -1 +1,4 @@
-dify_plugin==0.0.1b65
+dify_plugin==0.10.2
+# Transitive floors (via dify_plugin -> httpx): GHSA-82r6-8w77-94w6 / GHSA-5p39-cfhj-2xmp (anyio), PYSEC-2026-215 / GHSA-65pc-fj4g-8rjx (idna)
+anyio>=4.15.1
+idna>=3.20

langchain/pyproject.toml

@@ -19,24 +19,27 @@ disallow_untyped_defs = "True"
 
 [tool.poetry.dependencies]
 python = ">=3.10,<4.0"
-langchain-core = ">=0.3.85,<1.0.0"
+langchain-core = ">=1.6.5,<2.0.0"
 agentql = "^1.8.1"
 playwright = "^1.50.0"
 httpx = "^0.28.1"
-langchain-community = "^0.3.17"
-langchain-openai = "^0.3.4"
-langchain-tests = "^0.3.12"
+langchain-community = "^0.4.2"
+langchain-openai = "^1.6.6"
+langchain-tests = "^1.1.9"
 h11 = "^0.16.0"
 urllib3 = ">=2.7.0"
 langsmith = ">=0.8.18"
 orjson = ">=3.11.6"
 requests = ">=2.33.0"
 pygments = ">=2.20.0"
-aiohttp = ">=3.14.1"
+aiohttp = ">=3.14.3"
 python-dotenv = ">=1.2.2"
-langchain = ">=0.3.30,<1.0.0"
+langchain = ">=1.4.2,<2.0.0"
 idna = ">=3.15"
 pydantic-settings = ">=2.14.2"
+anyio = ">=4.15.1"
+click = ">=8.3.3"
+langchain-text-splitters = ">=1.1.2"
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "T201"]
@@ -69,11 +72,11 @@ optional = true
 [tool.poetry.group.dev.dependencies]
 
 [tool.poetry.group.test.dependencies]
-pytest = "^7.4.3"
-pytest-asyncio = "^0.23.2"
+pytest = "^9.0.3"
+pytest-asyncio = "^1.3.0"
 pytest-socket = "^0.7.0"
 pytest-watcher = "^0.3.4"
-langchain-tests = "^0.3.5"
+langchain-tests = "^1.1.9"
 vcrpy = ">=8.2.1"
 
 [tool.poetry.group.codespell.dependencies]

zapier/package.json

@@ -19,7 +19,7 @@
     "minimatch": "^3.1.3",
     "picomatch": "^2.3.2",
     "@babel/core": "7.29.6",
-    "brace-expansion": "1.1.13",
+    "brace-expansion": "1.1.18",
     "form-data": "4.0.6"
   },
   "private": true