github/langchain
1
0
Fork 0
mirror of https://github.com/hwchase17/langchain.git synced 2026-06-09 10:17:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: pygments>=2.20.0 across all packages (CVE-2026-4539) (#36385)

Browse Source 
## Summary

Bumps `pygments` to `>=2.20.0` across all 21 affected packages to
address [CVE-2026-4539](https://github.com/advisories/GHSA-XXXX) — ReDoS
via inefficient GUID regex in Pygments.

- **Severity:** Low
- **Fixed in:** 2.20.0 (was 2.19.2)
- **Change:** Added `pygments>=2.20.0` to `constraint-dependencies` in
`[tool.uv]` for each package, then ran `uv lock --upgrade-package
pygments` to regenerate lock files.

Closes Dependabot alerts #3435–#3455.

## Release Note
Patch deps

### Test Plan
 - [x] CI Green 🙏

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
John Kennedy
2026-03-30 20:26:59 -07:00
committed by GitHub
parent e207685e8f
commit 0f4f3f74c8
42 changed files with 205 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libs/partners/deepseek/pyproject.toml
View File

@@ -53,6 +53,9 @@ dev = []
typing = ["mypy>=1.10.0,<2.0.0"]
[tool.uv]
constraint-dependencies = ["pygments>=2.20.0"]
[tool.uv.sources]
langchain-openai = { path = "../openai", editable = true }
langchain-core = { path = "../../core", editable = true }