diff --git a/langchain/poetry.lock b/langchain/poetry.lock
index 19004e5a..b9f0fce3 100644
--- a/langchain/poetry.lock
+++ b/langchain/poetry.lock
@@ -3384,14 +3384,14 @@ typing-extensions = ">=4.12.0"
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 description = "HTTP library with thread-safe connection pooling, file post, and more."
 optional = false
 python-versions = ">=3.10"
 groups = ["main", "test"]
 files = [
-    {file = "urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897"},
-    {file = "urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c"},
+    {file = "urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3"},
+    {file = "urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63"},
 ]
 
 [package.extras]
@@ -4095,4 +4095,4 @@ cffi = ["cffi (>=1.17,<2.0) ; platform_python_implementation != \"PyPy\" and pyt
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<4.0"
-content-hash = "0621a5de801306c4dbdb046db911ada4b0ea1d8fee99d4163c13eec67e833948"
+content-hash = "dfdeafb48099b0542e877690b61ca53a1a97080c451254ad85e0aa0397dc863a"
diff --git a/langchain/pyproject.toml b/langchain/pyproject.toml
index d0233ba4..3e4c7ba4 100644
--- a/langchain/pyproject.toml
+++ b/langchain/pyproject.toml
@@ -27,7 +27,7 @@ langchain-community = "^0.4.2"
 langchain-openai = "^1.6.6"
 langchain-tests = "^1.1.9"
 h11 = "^0.16.0"
-urllib3 = ">=2.7.0"
+urllib3 = ">=2.8.0"
 langsmith = ">=0.8.18"
 orjson = ">=3.11.6"
 requests = ">=2.33.0"
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 00000000..b1c0c81d
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,8 @@
+# OSV Scanner configuration — read by the repo-wide `vulnerability-check` gate.
+# Entries are time-boxed risk acceptances for findings with NO upstream fix.
+# Remove an entry as soon as a fixed release exists.
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"  # CVE-2026-93687, braces <=3.0.3, HIGH
+ignoreUntil = 2027-01-04
+reason = "NO UPSTREAM PATCH + NOT EXPLOITABLE: braces 3.0.3 (latest release) is reached only via jest -> @jest/core -> micromatch in zapier/ devDependencies; it runs as the local/CI test runner over glob patterns from jest's own config, never on external input, and is not part of the published Zapier app. EPSS 0.74%, not in CISA KEV. Remove when braces ships a fix."
diff --git a/zapier/package-lock.json b/zapier/package-lock.json
index ae90ac3b..4e5daea3 100644
--- a/zapier/package-lock.json
+++ b/zapier/package-lock.json
@@ -1264,9 +1264,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/zapier/package.json b/zapier/package.json
index c0af88a3..258884ad 100644
--- a/zapier/package.json
+++ b/zapier/package.json
@@ -19,7 +19,7 @@
     "minimatch": "^3.1.3",
     "picomatch": "^2.3.2",
     "@babel/core": "7.29.6",
-    "brace-expansion": "1.1.18",
+    "brace-expansion": "1.1.21",
     "form-data": "4.0.6"
   },
   "private": true