John Kennedy 22869321b2 fix: patch Dependabot dependency vulnerabilities (#38853) ...

## Summary

- remove obsolete aiohttp <3.14.0 constraints and resolve the xAI and
Fireworks locks to aiohttp 3.14.1
- set langchain-fireworks' runtime floor to aiohttp >=3.14.1
- constrain the langchain-classic lock to langchain 1.3.9, resolving
CVE-2026-55443

## Dependabot alerts

Resolves the patchable aiohttp and langchain alerts in the current
backlog.

The critical ChromaDB CVE-2026-45829 remains open because no patched
upstream version exists. It is tracked in
[SEC-969](https://linear.app/langchain/issue/SEC-969/critical-mitigate-unpatched-chromadb-cve-2026-45829).

## Verification

-  for xAI, Fireworks, and langchain-classic
- xAI unit tests: 38 passed
- Fireworks unit tests: 129 passed (with local FIREWORKS_API_BASE
removed to avoid snapshot pollution)
- imported vcrpy's aiohttp stub under aiohttp 3.14.1 in both partner
environments

2026-07-14 21:57:41 +00:00

2.3 KiB

Raw Blame History

View Raw