Skip to content

fix(deps): bump langgraph-checkpoint to >=4.0.0 to fix RCE deserialization CVE#238

Merged
sujayintugle merged 1 commit intomainfrom
fix/langgraph-checkpoint-rce
Mar 30, 2026
Merged

fix(deps): bump langgraph-checkpoint to >=4.0.0 to fix RCE deserialization CVE#238
sujayintugle merged 1 commit intomainfrom
fix/langgraph-checkpoint-rce

Conversation

@raphael-intugle
Copy link
Copy Markdown
Collaborator

Summary

  • Adds explicit langgraph-checkpoint>=4.0.0 constraint in pyproject.toml to resolve Dependabot alert added fmcg snowflake notebook #50
  • uv.lock updated: langgraph-checkpoint bumped from 3.0.14.0.1

Vulnerability

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

  • Affected: langgraph-checkpoint < 4.0.0
  • Patched: 4.0.0
  • Severity: Moderate

@sujayintugle sujayintugle merged commit 91c70b1 into main Mar 30, 2026
4 checks passed
@sujayintugle sujayintugle deleted the fix/langgraph-checkpoint-rce branch March 30, 2026 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants