[Snyk] Fix for 2 vulnerabilities

[SMSDAO]

Snyk has created this PR to fix 2 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• examples/tg-bot-starter/basic-tg-bot/package.json
• examples/tg-bot-starter/basic-tg-bot/pnpm-lock.yaml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828
	Server-side Request Forgery (SSRF) SNYK-JS-LANGCHAINCORE-15268429	541

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)

[Copilot]

Pull request overview

This pull request updates two critical dependencies to fix security vulnerabilities identified by Snyk: a Prototype Pollution vulnerability in axios (score 828) and a Server-side Request Forgery (SSRF) vulnerability in langchain-core (score 541). The PR performs major version upgrades for both @langchain/core (0.3.26 → 1.1.24) and solana-agent-kit (1.3.0 → 2.0.10).

Changes:

• Upgrades @langchain/core from ^0.3.26 to ^1.1.24 to fix SSRF vulnerability
• Upgrades solana-agent-kit from ^1.3.0 to ^2.0.10 to address axios Prototype Pollution
• Updates pnpm-lock.yaml with new dependency tree including removal of axios and addition of many new transitive dependencies

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
examples/tg-bot-starter/basic-tg-bot/package.json	Updates dependency versions for security fixes with major version bumps
examples/tg-bot-starter/basic-tg-bot/pnpm-lock.yaml	Reflects complete dependency tree changes including removal of vulnerable packages and addition of new dependencies

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The package.json specifies "solana-agent-kit": "^2.0.1" but the lock file resolves to version 2.0.10. While this is normal behavior for caret ranges (^2.0.1 allows 2.0.10), the PR description states the upgrade is to fix vulnerabilities.

For clarity and to ensure reproducible builds that match security expectations, consider either:

1. Updating the package.json to specify the exact version being tested: "solana-agent-kit": "^2.0.10"
2. Or using a tilde range to be more conservative: "solana-agent-kit": "~2.0.1"

This ensures that the exact version that fixed the vulnerabilities is what gets installed.

Suggested change

	"solana-agent-kit": "^2.0.1"
	"solana-agent-kit": "^2.0.10"

[Copilot]

The PR description mentions fixing a Prototype Pollution vulnerability in axios (SNYK-JS-AXIOS-15252993), but the package.json and visible code don't show axios as a direct dependency. This suggests:

1. Axios is a transitive dependency of the upgraded packages
2. The vulnerability is being fixed through the dependency chain updates

However, the lock file shows axios was completely removed (it appeared in the old dependency tree but not in the new one). This is actually a good outcome - if axios was causing vulnerabilities and is no longer needed, removing it reduces the attack surface.

Verify that the functionality previously provided by axios (if any) is still working correctly after these updates.

[Copilot]

This PR includes major version updates that introduce breaking changes:

1. @langchain/core: 0.3.26 → 1.1.24 (major version bump)
2. solana-agent-kit: 1.3.0 → 2.0.10 (major version bump)

The Snyk metadata indicates isBreakingChange: true. While these updates fix critical security vulnerabilities (Prototype Pollution with score 828 and SSRF with score 541), the major version changes require careful verification:

• The code imports HumanMessage from @langchain/core/messages and uses SolanaAgentKit and createSolanaTools from solana-agent-kit
• These APIs may have changed between major versions
• The application should be tested to ensure compatibility with the new versions before merging

Consider reviewing the changelog for both packages to understand the breaking changes and verify that the existing code is compatible with the new APIs.