diff --git a/pyproject.toml b/pyproject.toml index 34c1150f..5c3c9648 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -57,15 +57,27 @@ dev-dependencies = [ "agent-framework", "azure-identity", "openai-agents", - "langchain-openai", + # langchain-openai >=1.1.14 - security remediation. Fixes CVE-2026-41488 + # (SSRF / DNS-rebinding TOCTOU in _url_to_size()'s validate-then-fetch + # pattern for image token counting). Also requires langchain-core + # >=1.2.31, already satisfied by the >=1.3.3 constraint below. + "langchain-openai >= 1.1.14", ] # azure-ai-projects is capped at <2.0.0 because: # 1. semantic-kernel>=1.39.3 requires azure-ai-projects~=1.0.0b12 (<2.0.0) # 2. tooling-extensions-azureaifoundry uses the 1.x Agents API (project_client.agents.update_agent) # which was removed in azure-ai-projects 2.x +# +# langsmith is not a direct dependency of any workspace package - it's pulled +# in transitively by langchain-core/langchain-openai - so it's pinned here via +# override rather than constraint-dependencies. >=0.8.18 fixes two advisories: +# CVE-2026-45134 (prompt-pull deserialization trust-boundary bypass; fixed in +# 0.8.0) and GHSA-f4xh-w4cj-qxq8 (TracingMiddleware arbitrary file read via +# unvalidated trace-propagation header; fixed in 0.8.18, which supersedes 0.8.0). override-dependencies = [ "azure-ai-projects>=1.0.0b12,<2.0.0", + "langsmith >= 0.8.18", ] # Centralized version constraints for all external dependencies @@ -89,7 +101,13 @@ constraint-dependencies = [ # --- AI Frameworks --- "agent-framework >= 1.0.0", "agent-framework-core >= 1.0.0", - "langchain-core >= 0.1.0", + # langchain-core >=1.3.3 - security remediation. Fixes GHSA-pjwx-r37v-7724 + # / CVE-2026-44843 (unsafe deserialization of attacker-controlled objects + # through overly broad load() allowlists in RunnableWithMessageHistory, + # astream_log(), and astream_events(v1)). The vulnerable range is + # >=1.0.0,<=1.3.2; 1.3.3 is the first patched 1.x release. No upper bound, + # matching the other unbounded AI-framework constraints in this block. + "langchain-core >= 1.3.3", "openai-agents >= 0.2.6", "semantic-kernel >= 1.39.3", # google-adk >=1.28.1,<2.0.0 - security remediation. Fixes CVE-2026-4810 diff --git a/uv.lock b/uv.lock index 6db581d4..1401d293 100644 --- a/uv.lock +++ b/uv.lock @@ -38,7 +38,7 @@ constraints = [ { name = "black", specifier = ">=23.0.0" }, { name = "google-adk", specifier = ">=1.28.1,<2.0.0" }, { name = "httpx", specifier = ">=0.27.0" }, - { name = "langchain-core", specifier = ">=0.1.0" }, + { name = "langchain-core", specifier = ">=1.3.3" }, { name = "microsoft-agents-activity", specifier = ">=0.4.0" }, { name = "microsoft-agents-hosting-core", specifier = ">=0.4.0" }, { name = "mypy", specifier = ">=1.0.0" }, @@ -63,13 +63,16 @@ constraints = [ { name = "typing-extensions", specifier = ">=4.0.0" }, { name = "wrapt", specifier = ">=1.14" }, ] -overrides = [{ name = "azure-ai-projects", specifier = ">=1.0.0b12,<2.0.0" }] +overrides = [ + { name = "azure-ai-projects", specifier = ">=1.0.0b12,<2.0.0" }, + { name = "langsmith", specifier = ">=0.8.18" }, +] [manifest.dependency-groups] dev = [ { name = "agent-framework" }, { name = "azure-identity" }, - { name = "langchain-openai" }, + { name = "langchain-openai", specifier = ">=1.1.14" }, { name = "openai" }, { name = "openai-agents" }, { name = "pytest" }, @@ -2339,6 +2342,19 @@ wheels = [ { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpcore/1.0.9/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55" }, ] +[[package]] +name = "httpcore2" +version = "2.12.0" +source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } +dependencies = [ + { name = "h11" }, + { name = "truststore" }, +] +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpcore2/2.12/httpcore2-2.12.0.tar.gz", hash = "sha256:9293522bba0aa7c4c8e9e3f040c16575bd8868e155a77fa30c7a9085a5eae648" } +wheels = [ + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpcore2/2.12/httpcore2-2.12.0-py3-none-any.whl", hash = "sha256:7e04258ce01013d7d615e5b910a3b27fac937d7a95038227e79652b4ba3b4ceb" }, +] + [[package]] name = "httplib2" version = "0.32.0" @@ -2416,6 +2432,32 @@ wheels = [ { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpx-sse/0.4.3/httpx_sse-0.4.3-py3-none-any.whl", hash = "sha256:0ac1c9fe3c0afad2e0ebb25a934a59f4c7823b60792691f779fad2c5568830fc" }, ] +[[package]] +name = "httpx2" +version = "2.12.0" +source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } +dependencies = [ + { name = "anyio", marker = "sys_platform != 'emscripten'" }, + { name = "httpcore2", marker = "sys_platform != 'emscripten'" }, + { name = "httpx2-jsfetch", marker = "python_full_version >= '3.12' and sys_platform == 'emscripten'" }, + { name = "idna" }, + { name = "truststore", marker = "sys_platform != 'emscripten'" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, +] +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpx2/2.12/httpx2-2.12.0.tar.gz", hash = "sha256:7631fe9887a8a2275f4a2540e053aa670fcc50742864a9ae7c66e609fdcf12cf" } +wheels = [ + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpx2/2.12/httpx2-2.12.0-py3-none-any.whl", hash = "sha256:cc8b6eecb8661c146b8f89a60e97456ee086e91a784ed31ac450c3a9e613dd36" }, +] + +[[package]] +name = "httpx2-jsfetch" +version = "1.0" +source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpx2-jsfetch/1/httpx2_jsfetch-1.0.tar.gz", hash = "sha256:70a0e3eabfef7cce5ad9c629f7d01ca05e418f586646f4ddf14782e4c1454c60" } +wheels = [ + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/httpx2-jsfetch/1/httpx2_jsfetch-1.0-py3-none-any.whl", hash = "sha256:cb916b707601e69a07721aabc8f3f6659be3a6893bc1ff5c6f9e02241df2da32" }, +] + [[package]] name = "hyperframe" version = "6.1.0" @@ -2427,11 +2469,11 @@ wheels = [ [[package]] name = "idna" -version = "3.11" +version = "3.19" source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } -sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/idna/3.11/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/idna/3.19/idna-3.19.tar.gz", hash = "sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15" } wheels = [ - { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/idna/3.11/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea" }, + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/idna/3.19/idna-3.19-py3-none-any.whl", hash = "sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4" }, ] [[package]] @@ -2653,10 +2695,12 @@ wheels = [ [[package]] name = "langchain-core" -version = "1.2.28" +version = "1.6.1" source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } dependencies = [ + { name = "httpx" }, { name = "jsonpatch" }, + { name = "langchain-protocol" }, { name = "langsmith" }, { name = "packaging" }, { name = "pydantic" }, @@ -2665,43 +2709,61 @@ dependencies = [ { name = "typing-extensions" }, { name = "uuid-utils" }, ] -sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-core/1.2.28/langchain_core-1.2.28.tar.gz", hash = "sha256:271a3d8bd618f795fdeba112b0753980457fc90537c46a0c11998516a74dc2cb" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-core/1.6.1/langchain_core-1.6.1.tar.gz", hash = "sha256:1b156cb395aac4f009a8a1b38a574c7d948fe2d5f74c96e0d8a5017b4149e04f" } wheels = [ - { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-core/1.2.28/langchain_core-1.2.28-py3-none-any.whl", hash = "sha256:80764232581eaf8057bcefa71dbf8adc1f6a28d257ebd8b95ba9b8b452e8c6ac" }, + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-core/1.6.1/langchain_core-1.6.1-py3-none-any.whl", hash = "sha256:954a84132a5cb0435d27b910e336347b6744ecc18fbeef1e2de7029a0959841a" }, ] [[package]] name = "langchain-openai" -version = "1.1.12" +version = "1.6.0" source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } dependencies = [ + { name = "certifi" }, { name = "langchain-core" }, { name = "openai" }, { name = "tiktoken" }, ] -sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-openai/1.1.12/langchain_openai-1.1.12.tar.gz", hash = "sha256:ccf5ef02c896f6807b4d0e51aaf678a72ce81ae41201cae8d65e11eeff9ecb79" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-openai/1.6/langchain_openai-1.6.0.tar.gz", hash = "sha256:7c545cc1f2bee048a7e219f375b78cd820b32c876ccf825320e25e1e94132577" } +wheels = [ + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-openai/1.6/langchain_openai-1.6.0-py3-none-any.whl", hash = "sha256:648112bbd135aa51d60d4aa2fd4ad353628a8d92a2f8e779244a0d9869a16f18" }, +] + +[[package]] +name = "langchain-protocol" +version = "0.0.19" +source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } +dependencies = [ + { name = "typing-extensions" }, +] +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-protocol/0.0.19/langchain_protocol-0.0.19.tar.gz", hash = "sha256:79d90a1425122ac87e8052e2ec054fbd09c3edbf341bdfb6397112a495c7bf8c" } wheels = [ - { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-openai/1.1.12/langchain_openai-1.1.12-py3-none-any.whl", hash = "sha256:da71ca3f2d18c16f7a2443cc306aa195ad2a07054335ac9b0626dcae02b6a0c5" }, + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langchain-protocol/0.0.19/langchain_protocol-0.0.19-py3-none-any.whl", hash = "sha256:4cdf879a492a35980fd859ae792d3c65458ccaae504e183c9a10d7eac1f0720f" }, ] [[package]] name = "langsmith" -version = "0.7.31" +version = "0.12.1" source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } dependencies = [ - { name = "httpx" }, + { name = "anyio" }, + { name = "distro" }, + { name = "httpx2" }, { name = "orjson", marker = "platform_python_implementation != 'PyPy'" }, { name = "packaging" }, { name = "pydantic" }, { name = "requests" }, { name = "requests-toolbelt" }, + { name = "sniffio" }, + { name = "typing-extensions" }, { name = "uuid-utils" }, + { name = "websockets" }, { name = "xxhash" }, { name = "zstandard" }, ] -sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langsmith/0.7.31/langsmith-0.7.31.tar.gz", hash = "sha256:331ee4f7c26bb5be4022b9859b7d7b122cbf8c9d01d9f530114c1914b0349ffb" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langsmith/0.12.1/langsmith-0.12.1.tar.gz", hash = "sha256:8916c1a8daa4282511f311f569fd5cb2f0aba8d89a4d1761620ed37b57f72c00" } wheels = [ - { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langsmith/0.7.31/langsmith-0.7.31-py3-none-any.whl", hash = "sha256:0291d49203f6e80dda011af1afda61eb0595a4d697adb684590a8805e1d61fb6" }, + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/langsmith/0.12.1/langsmith-0.12.1-py3-none-any.whl", hash = "sha256:34574d4411947f62825e8368fd172cad2505ddfb73bf5d8ed7c0e7a41e4c4879" }, ] [[package]] @@ -4012,7 +4074,7 @@ wheels = [ [[package]] name = "openai" -version = "2.28.0" +version = "2.54.0" source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } dependencies = [ { name = "anyio" }, @@ -4024,9 +4086,9 @@ dependencies = [ { name = "tqdm" }, { name = "typing-extensions" }, ] -sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/openai/2.28/openai-2.28.0.tar.gz", hash = "sha256:bb7fdff384d2a787fa82e8822d1dd3c02e8cf901d60f1df523b7da03cbb6d48d" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/openai/2.54/openai-2.54.0.tar.gz", hash = "sha256:e3e6f8bc1ba30ddf381ace1a14340eed381cb984a1a59bd0f34b5be3b5d49cfa" } wheels = [ - { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/openai/2.28/openai-2.28.0-py3-none-any.whl", hash = "sha256:79aa5c45dba7fef84085701c235cf13ba88485e1ef4f8dfcedc44fc2a698fc1d" }, + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/openai/2.54/openai-2.54.0-py3-none-any.whl", hash = "sha256:89089789197ccdb87f173a03145ed1598d00795220c93e96cf712b1cbf5e5f2b" }, ] [[package]] @@ -5918,6 +5980,15 @@ wheels = [ { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/tqdm/4.67.3/tqdm-4.67.3-py3-none-any.whl", hash = "sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf" }, ] +[[package]] +name = "truststore" +version = "0.10.4" +source = { registry = "https://packagefeedproxy.microsoft.io/pypi/simple/" } +sdist = { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/truststore/0.10.4/truststore-0.10.4.tar.gz", hash = "sha256:9d91bd436463ad5e4ee4aba766628dd6cd7010cf3e2461756b3303710eebc301" } +wheels = [ + { url = "https://ms-feed-25.pkgs.visualstudio.com/6f084628-a36d-42cb-934d-057357e379dc/_packaging/49d7402f-07bb-4b18-a9ce-086e6e98a554/pypi/download/truststore/0.10.4/truststore-0.10.4-py3-none-any.whl", hash = "sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981" }, +] + [[package]] name = "types-requests" version = "2.32.4.20260107"