Skip to content

[Snyk] Fix for 4 vulnerabilities#48

Open
SMSDAO wants to merge 1 commit intomainfrom
snyk-fix-50dd0956427d8c24365c27b86a27633a
Open

[Snyk] Fix for 4 vulnerabilities#48
SMSDAO wants to merge 1 commit intomainfrom
snyk-fix-50dd0956427d8c24365c27b86a27633a

Conversation

@SMSDAO
Copy link
Owner

@SMSDAO SMSDAO commented Feb 14, 2026

snyk-top-banner

Snyk has created this PR to fix 4 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

  • examples/agent-kit-nextjs-langchain/package.json
  • examples/agent-kit-nextjs-langchain/pnpm-lock.yaml

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Prototype Pollution
SNYK-JS-AXIOS-15252993
  828  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295
  803  
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-LANGCHAINCOMMUNITY-15268428
  541  
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-LANGCHAINCORE-15268429
  541  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)

Copilot AI review requested due to automatic review settings February 14, 2026 07:35
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR is a Snyk-generated security fix that upgrades 4 dependencies in the examples/agent-kit-nextjs-langchain example to address high and medium severity vulnerabilities. The changes involve major version upgrades across multiple packages that may introduce breaking changes and compatibility issues.

Changes:

  • Upgrades @langchain/community and @langchain/core from v0.3 to v1.1 (major version jump)
  • Upgrades ESLint from 8.46.0 to 10.0.0 (major version with significant breaking changes)
  • Upgrades solana-agent-kit from ^1.3.0 to ^2.0.1 (major version, potentially nonexistent)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

"ai": "^3.1.12",
"autoprefixer": "10.4.14",
"eslint": "8.46.0",
"eslint": "10.0.0",
Copy link

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The upgrade from eslint 8.46.0 to 10.0.0 may be incompatible with eslint-config-next 13.4.12, which was released when eslint 8 was current. ESLint 9 introduced significant breaking changes (including the new flat config format), and ESLint 10 continues that evolution. The eslint-config-next package at version 13.4.12 was designed for ESLint 8 and may not work correctly with ESLint 10. Consider either:

  1. Upgrading eslint-config-next to a version compatible with ESLint 10, or
  2. Keeping ESLint at version 8.x until all related packages are updated, or
  3. Testing thoroughly to ensure the current configuration works with ESLint 10
Suggested change
"eslint": "10.0.0",
"eslint": "8.46.0",

Copilot uses AI. Check for mistakes.
Comment on lines +16 to +17
"@langchain/community": "^1.1.14",
"@langchain/core": "^1.1.14",
Copy link

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The major version upgrade of @langchain/core (0.3.17 → 1.1.14) and @langchain/community (0.3.11 → 1.1.14) creates version inconsistency across the repository. Other dependencies like @langchain/langgraph (^0.2.20), @langchain/openai (^0.3.11), and langchain (^0.3.5) remain at 0.x versions. LangChain packages typically have peer dependency requirements, and mixing v0.3 and v1.1 packages may cause compatibility issues. All @langchain/* packages should ideally be upgraded together to ensure compatibility. Consider upgrading @langchain/langgraph, @langchain/openai, and langchain to their v1.x equivalents if available.

Suggested change
"@langchain/community": "^1.1.14",
"@langchain/core": "^1.1.14",
"@langchain/community": "^0.3.11",
"@langchain/core": "^0.3.17",

Copilot uses AI. Check for mistakes.
"react-dom": "^18.3.1",
"react-toastify": "^9.1.3",
"solana-agent-kit": "^1.3.0",
"solana-agent-kit": "^2.0.1",
Copy link

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The upgrade of solana-agent-kit from ^1.3.0 to ^2.0.1 creates version inconsistency across the repository examples. The root package (main solana-agent-kit library) is at version 1.4.8, and other examples (agent-kit-langgraph, persistent-agent) still use ^1.3.0. This could lead to inconsistent behavior across examples and confusion for users. Consider:

  1. Updating all examples to use the same version of solana-agent-kit, or
  2. Documenting why different examples use different versions, or
  3. Verifying that version 2.0.1 is compatible with the current codebase (since the root package is still at 1.4.8)
Suggested change
"solana-agent-kit": "^2.0.1",
"solana-agent-kit": "^1.4.8",

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants