obsidian-plugin/rmccorkl_TubeSage
1
0
Fork 0
mirror of https://github.com/rmccorkl/TubeSage.git synced 2026-07-22 06:45:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: bump langsmith override to >=0.6.0 to resolve Dependabot alert #67

Browse source 
langsmith 0.5.26 (transitive via @langchain/core) is vulnerable to
GHSA-3644-q5cj-c5c7 (public prompt pull deserializes untrusted manifests
without trust boundary warning). Patched in 0.6.0.

The previous override was pinning to ^0.5.18 which kept the vulnerable
0.5.x line — relaxed to >=0.6.0. Resolves to 0.6.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Richard McCorkle 2026-05-13 21:27:34 +02:00
parent ef46a30070
commit 49efdcf83d
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
package-lock.json generated
View file

@ -3884,9 +3884,9 @@
}
},
"node_modules/langsmith": {
"version": "0.5.26",
"resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.5.26.tgz",
"integrity": "sha512-HmmFgeQR2n9x1Kq8NiVaNL/j72ta71qN11hYjbyePJ/QuYEnOMhQjbNv9KeyKB3bOetpIzNalQbhHm+RyKoPRQ==",
"version": "0.6.3",
"resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.6.3.tgz",
"integrity": "sha512-pXrQ4/4myQvjFFOAUmt5pWRrLEZR20gzIJD7MNdUH+5/S5nLI4ZRBo/SYKC6coaYj9pYTfQdBIzcs+3kfJ5uDA==",
"license": "MIT",
"dependencies": {
"p-queue": "6.6.2"

2
package.json
View file

@ -37,7 +37,7 @@
},
"overrides": {
"axios": ">=1.15.0",
"langsmith": "^0.5.18",
"langsmith": ">=0.6.0",
"fast-xml-parser": ">=5.7.0",
"uuid": ">=14.0.0",
"fast-uri": ">=3.1.2"