[andriy-sudo]

Clears every open Dependabot alert on main (4: 2 high, 2 medium) and every finding the repo-wide vulnerability-check gate reports, so the gate goes green again. All of them were published after #60 cleared the repo on 2026-09-28.

Part of INF-3001 (Dependabot clear-and-enable, Python cluster).

Package	Old	New	Advisory	CVSS	Lock	Status
urllib3	2.7.0	2.8.0	GHSA-vxq7-64xx-v4gw	8.9	langchain/poetry.lock	✅ Fixed
urllib3	2.7.0	2.8.0	GHSA-8988-9cw3-xx77	7.6	langchain/poetry.lock	✅ Fixed
urllib3	2.7.0	2.8.0	GHSA-gh4c-6fx4-qh6g	6.9	langchain/poetry.lock	✅ Fixed
brace-expansion (dev)	1.1.18	1.1.21	GHSA-6j4f-fj2g-mc7p	7.5	zapier/package-lock.json	✅ Fixed (OSV only)
brace-expansion (dev)	1.1.18	1.1.21	GHSA-qhr7-859c-m2p7	7.5	zapier/package-lock.json	✅ Fixed (OSV only)
brace-expansion (dev)	1.1.18	1.1.21	GHSA-q2hr-2g5m-vwhr	5.3	zapier/package-lock.json	✅ Fixed
braces (dev)	3.0.3	—	GHSA-vfj7-8cjw-p6xm (CVE-2026-93687)	8.7	zapier/package-lock.json	⚠️ Risk accepted until 2027-01-04: no upstream fix (see below)

Supersedes Dependabot #61. #61 bumps only urllib3, so the zapier/ findings keep the repo-wide gate red.

What changed

• langchain/pyproject.toml: the urllib3 floor goes to >=2.8.0. poetry.lock was regenerated with Poetry 2.4.1, the version in its header; the only change is urllib3.
• zapier/package.json: the exact-pinned "brace-expansion": "1.1.18" override was what held the package below the fix, since Dependabot can't propose a version past an exact pin. It's now 1.1.21. package-lock.json was regenerated with npm install --package-lock-only --ignore-scripts; the only change is brace-expansion.
• New osv-scanner.toml with one time-boxed entry (below). Under the org-wide CODEOWNERS rule, this file needs a @tinyfish-io/security_team approval.

All changes are limited to manifest and lock-file version bumps plus the scanner config; there are no source code changes.

Risk acceptance: braces GHSA-vfj7-8cjw-p6xm

Severity	EPSS (FIRST, 2026-10-05)	KEV	Exploit	Fixed version	Disposition	Review by
HIGH (8.7)	0.74%	no	none known	none: affects <=3.0.3, and 3.0.3 is the latest release	No upstream patch, not exploitable here	2027-01-04

The advisory is a stack-overflow DoS triggered by deeply nested brace patterns. Here, braces is reachable only through jest → @jest/core → micromatch in zapier/ devDependencies (jest is the only devDependency, and it runs as npm test). It expands glob patterns from jest's own config and CLI, never external input, and it isn't part of the published Zapier app (dependencies are agentql-js-common, zapier-platform-core and lodash). Every npm audit finding in zapier/ traces back to this same advisory. Remove the entry once braces ships a fix.

Verification

• osv-scanner scan -r --config osv-scanner.toml .: No issues found, with 1 filtered (the braces entry). The control, on main, showed 10 finding rows.
• Resolved versions read back from the locks: urllib3 2.8.0, brace-expansion 1.1.21.

Changelog impact summary

Package	Old	New	Classification	Key changes
urllib3	2.7.0	2.8.0	Minor / security	The three advisories above. No API removals.
brace-expansion	1.1.18	1.1.21	Patch / security	DoS fixes in the 1.x line only. Dev-only (jest's glob matching).

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: e1d6e5ea-e4b9-498f-a37c-04ce99650e37

📥 Commits

Reviewing files that changed from the base of the PR and between 03fdeaf and ecd5fe1.

⛔ Files ignored due to path filters (2)

• langchain/poetry.lock is excluded by !**/*.lock
• zapier/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• langchain/pyproject.toml
• osv-scanner.toml
• zapier/package.json

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The minimum urllib3 version changes to 2.8.0, and the brace-expansion override changes to 1.1.21. The OSV scanner configuration adds a time-limited ignore entry for GHSA-vfj7-8cjw-p6xm, expiring on 2027-01-04.

Suggested reviewers: paveldudka

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to ecd5f

The dependency locks match the requested versions, and the braces exception has a review expiry. The known affected dependency path is in Jest development tooling; no concrete production-impacting regression is established, so the PR appears mergeable with normal checks.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security dependency updates and the time-limited acceptance of the unfixed braces advisory.
Description check	✅ Passed	The description explains the dependency updates, the accepted braces advisory, and the reported verification results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}