chore: bump langsmith from 0.8.0 to 0.8.18#117
Conversation
dependabot
Bot
added
dependencies
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.0 to 0.8.18. - [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases) - [Commits](langchain-ai/langsmith-sdk@v0.8.0...v0.8.18) --- updated-dependencies: - dependency-name: langsmith dependency-version: 0.8.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Fixes the following pip-audit security vulnerabilities: - aiohttp: 3.13.4 → 3.14.1 (CVE-2026-34993, CVE-2026-47265, CVE-2026-54273-54280, CVE-2026-50269) - cryptography: 46.0.7 → 49.0.0 (GHSA-537c-gmf6-5ccf) - pypdf: 6.10.2 → 6.13.3 (CVE-2026-48155, CVE-2026-48156, CVE-2026-48735, CVE-2026-49460, CVE-2026-49461, CVE-2026-54530, CVE-2026-54531, GHSA-jm82-fx9c-mx94) - msgpack: 1.1.2 → 1.2.1 (GHSA-6v7p-g79w-8964) - pydantic-settings: 2.13.1 → 2.14.2 (GHSA-4xgf-cpjx-pc3j) - pip: 26.1 → 26.1.2 (PYSEC-2026-196) Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
Security Vulnerabilities — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no compatible patched version can be applied given the current dependency constraints:
Why these cannot be auto-fixedchromadb (CVE-2026-45829): The vulnerability affects version 1.0.0 or later and no patched release has been published to PyPI yet. A fix requires the upstream ChromaDB maintainers to release a new version. langchain (GHSA-gr75-jv2w-4656): The fix version (1.3.9) is a major version upgrade from 0.3.x. Upgrading langchain to 1.x would require upgrading What was fixedThe following vulnerabilities were patched in this commit:
Recommended next steps
This PR will not be auto-merged until the remaining vulnerabilities are resolved. |
amrit110
force-pushed
the
dependabot/uv/langsmith-0.8.18
branch
from
679922a to
617e802
Compare
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 1014 agent actions - (789 info, 95 tool_call, 17 error, 75 tool_result, 37 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerabilities — Cannot Auto-Fixaieng-bot found 2 security vulnerabilities reported by pip-audit that cannot be fixed automatically:
chromadb — CVE-2026-45829A pre-authentication code injection vulnerability via langchain — GHSA-gr75-jv2w-4656A path traversal / sandbox escape in filesystem-backed agent components. The fix is in
Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 0 files - Executed 328 agent actions - (236 info, 39 tool_call, 2 error, 32 tool_result, 18 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerabilities — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no compatible patched version can be installed given the current dependency graph:
Why this cannot be auto-fixedchromadb CVE-2026-45829: The PyPI vulnerability advisory confirms langchain GHSA-gr75-jv2w-4656: pip-audit identifies fix version 1.3.9, but upgrading Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 228 agent actions - (153 info, 29 tool_call, 4 error, 25 tool_result, 17 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
1 participant
Bumps langsmith from 0.8.0 to 0.8.18.
Release notes
Sourced from langsmith's releases.
... (truncated)
Commits
31c2bf6release(py): 0.8.18 (#3063)8955b68chore: reconcile bumpversion config and mandate release process for agents (#...411401ftest(python): fix integration assertions for updated attachment error message...9c55156Merge commit from fork5b2bd8dchore(deps): bump the npm_and_yarn group across 2 directories with 2 updates ...d8642f9chore(deps): bump the npm_and_yarn group across 4 directories with 4 updates ...953c2e5chore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python (#3044)5513699chore(deps): bump starlette from 1.0.1 to 1.3.1 in /python (#3039)8becdefchore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python (#3038)1a9c522chore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python (#3037)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.