Repository navigation
fix(deps): clear LangGraph and ASN.1 security advisories - #1141
Merged
Merged
Conversation
PurpleCHOIms
marked this pull request as ready for review
November 1, 2026 16:23
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The frozen source dependency audit reports six advisories in LangGraph API/CLI and pyasn1. Raise their security floors and lock API0.16.6, CLI0.4.37, in-memory runtime0.36.9 and pyasn1 0.6.5. Preserve Deep Agents0.7.32/LangGraph1.2.17. No audit exclusions or package version changes.
Local final gates: exact repository security audit changes from6findings/exit1 to0findings/exit0. Frozen Python3.13 sync, Ruff check/format and errors-only basedpyright pass (904existing warnings). Full fast Python lane:6,133pass,3Windows-only skips,93.75s/two workers. Three dependency path tests exercise real verbose subprocess stdin withholding and ephemeral RSA PKCS8 ASN.1 round-trip/signature verification.
Actual network-none old-to-new CLI/API restart passes13HTTP assertions, preserving the same thread/checkpoint/Store data and Python tenant authorization. It does not claim JS authorization, production Postgres or E2B/OpenShell/installer qualification. No model/provider/credential access.
All remaining quality gates pass through the shared coordinator: CLI typecheck/build/300tests, telemetry typecheck/51tests, Web lint/75tests/Prisma generation/full production build. Root npm audit high gate passes with3low/19moderate findings remaining; telemetry audit0. JavaScript lockfiles unchanged. Frozen npm setup and initial interrupted/failing harness attempts are documented, not counted as passing gates.
Local verification remains primary; OSS CI run41326061469 and Security run41326061494 actually completed successfully on source3c1f258b, including its required status. Compose/telemetry hosted jobs were skipped. No protection bypass. Source-only: no tag, package/image publication, version bump or SaaS deployment. SaaS upstream catalog #1139 and egress #1140 still require their own integration.
CHAGELOG.md · Evidence and limits · Actual local gate receipt
The initial normal merge rejection was an expected required status that subsequently completed successfully, not a confirmed billing failure. This documentation correction triggers the ordinary exact-head protection again; no admin merge/status fabrication.