What needs to happen?
The langchain4j dependency currently includes opennlp-tools, which currently has the 2 critical CVEs below.
The language model chat transform doens't use the opennlp-tools dependency. Changing to langchain4j-core wouldn't have an impact on the transform's functionality and would no longer include the opennlp-tools jar.
CVE-2026-42027
CVE-2026-40682
Issue Priority
Priority: 1
Issue Component
Component: Transforms
What needs to happen?
The langchain4j dependency currently includes opennlp-tools, which currently has the 2 critical CVEs below.
The language model chat transform doens't use the opennlp-tools dependency. Changing to langchain4j-core wouldn't have an impact on the transform's functionality and would no longer include the opennlp-tools jar.
CVE-2026-42027
CVE-2026-40682
Issue Priority
Priority: 1
Issue Component
Component: Transforms