Fix MVS-2023-gwm8-m3c2: bump langchain-core, langchain-openai, langsmith (4 CVEs)

[EvanderDS (EvanderDS)]

Summary

Fixes a known vulnerability in the langchain-core dependency by bumping the centralized constraint in root pyproject.toml's [tool.uv] constraint-dependencies from >=0.1.0 to >=1.3.3 (no upper bound, matching the other unbounded AI-framework constraints in the same block).

CVE fixed

GHSA-pjwx-r37v-7724 / CVE-2026-44843 - LangChain unsafe deserialization of attacker-controlled objects through overly broad load() allowlists (affects RunnableWithMessageHistory, astream_log(), astream_events(v1), and related serialization/deserialization round-trips). The previously-locked langchain-core 1.2.28 fell inside the vulnerable >=1.0.0,<=1.3.2 range. 1.3.3 is the first patched 1.x release; the resolver picked up 1.6.2.

This maps to S360 action item MVS-2023-gwm8-m3c2 (Component Governance alert, Location: /Agent365-python/uv.lock).

Why a new PR instead of reviewing #272

#272 proposed this exact fix and passed CI + got one approval, but it was opened from a fork with maintainerCanModify: false, so mergeStateStatus was BLOCKED and it could never actually be merged - it was closed unmerged and main is still on the vulnerable langchain-core >= 0.1.0 constraint today. This PR reproduces the identical change with maintainer-edit access enabled so it can be merged directly.

Usage check: the only consumer of langchain_core in this repo is microsoft-agents-a365-observability-extensions-langchain (a tracing/observability shim - BaseTracer, callbacks, messages.BaseMessage). It never calls the vulnerable RunnableWithMessageHistory/astream_log/astream_events(v1) paths, so the version bump alone fully remediates the alert with no code changes required.

Local verification (this branch)

• uv lock (with PYTHONPATH=./versioning/helper per CI): resolves clean, langchain-core 1.2.28 -> 1.6.2
• uv sync --locked --all-extras --dev: clean
• tox -e verify-constraints: PASS
• tox -e lint: PASS
• tox -e format: PASS
• tox -e py312: 800 passed, 3 skipped, 9 deselected (full suite, including the langchain observability extension's own tests, all passing against the new version)

Reviewers

Requesting review from dbezic, rbrighenti, DheerajPannala (same reviewers as #272 and the sibling google-adk security fix, #269).

This PR was generated by an AI assistant (S360 automation) reproducing the already-reviewed #272 change on a mergeable branch. Please review carefully before merging.

[EvanderDS (EvanderDS)]

dbezic (@dbezic) Rick Brighenti (@rbrighenti) Krishnadheeraj (@DheerajPannala) could one of you review/approve? (submitted from a fork so I can't formally request review via the UI — flagging directly instead, same as #269/#272/#285.) This reproduces #272's already-CI-green, already-approved change on a branch with maintainer-edit access enabled, so it can actually be merged this time. Note: if this repo's integration/secret-dependent CI checks fail on a fork PR, that's the known fork-secrets limitation (pull_request workflows from forks don't get repo secrets), not a problem from this dependency bump — the full unit suite (tox -e py312, 800 passed) already covers it locally.

[Copilot]

🟢 Approval recommended

The patched dependency constraint and lockfile resolution address the vulnerability.

Pull request overview

Updates the centralized langchain-core dependency constraint to remediate the reported deserialization vulnerability.

Changes:

• Raises the minimum version to >=1.3.3.
• Resolves langchain-core to 1.6.2.

File summaries

File	Description
pyproject.toml	Updates the centralized security constraint.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[EvanderDS (EvanderDS)]

Clarification on advisory mapping

I want to correct something in this PR''s framing: I checked GitHub''s public advisory database exhaustively (langchain, langchain-core, langchain-community, langchain-openai, langgraph — every advisory affecting each) and none has a GHSA ID matching gwm8-m3c2. That means Microsoft''s internal S360/Component-Governance ID MVS-2023-gwm8-m3c2 is not a 1:1 alias for GHSA-pjwx-r37v-7724 / CVE-2026-44843 — I inferred that mapping (repo + locked vulnerable version + a matching CVE-specific PR already existing for this repo) but could not confirm it against the actual CG alert page (SSO-gated).

MVS-2023-gwm8-m3c2 appears to be Microsoft''s own blanket "LangChain not designed with security" advisory — the same tag gets attached to many different langchain/langchain-core versions across many repos regardless of which specific CVE applies, per its generic description ("LangChain must not be used in a production service, when processing untrusted data... or with access to sensitive data").

What this PR does verifiably fix: langchain-core 1.2.28 (the version locked in uv.lock before this change) is confirmed vulnerable to real, current CVEs — most concretely CVE-2026-44843/GHSA-pjwx-r37v-7724 (unsafe deserialization) — and this bump to >=1.3.3 (resolving to 1.6.2) is CG''s own stated recommendation ("Upgrade or remove uses of the vulnerable package version") applied correctly.

What it may not do: if MVS-2023-gwm8-m3c2 is truly a version-independent blanket policy flag (not a specific CVE), upgrading langchain-core alone may not clear that S360 alert — it could keep re-flagging any langchain-core version. Whoever owns the S360/CG alert should confirm against the actual alert page whether this merge closes it, or whether a policy exception is still required separately.

[EvanderDS (EvanderDS)]

Update: expanded to cover the full MVS-2023-gwm8-m3c2 alert bundle

The user who owns this S360/Component-Governance alert (MVS-2023-gwm8-m3c2, Location: /Agent365-python/uv.lock) shared the full alert page contents, which list four distinct CVEs bundled under that one alert ID, all pointing at packages this repo locks:

#	CVE / GHSA	Package	Vulnerable	Fixed	Fixed in this PR
1	CVE-2026-44843 / GHSA-pjwx-r37v-7724	langchain-core	1.2.28	>=1.3.3	✅ (first commit)
2	CVE-2026-41488	langchain-openai	1.1.12	>=1.1.14	✅ (this commit)
3	CVE-2026-45134	langsmith	0.7.31	>=0.8.0	✅ (this commit, floor raised to 0.8.18)
4	GHSA-f4xh-w4cj-qxq8	langsmith (SDK)	<0.8.18	>=0.8.18	✅ (this commit)

Changes added in the second commit:

• langchain-openai >= 1.1.14 pinned directly in root [tool.uv] dev-dependencies (it's not a direct dependency of any workspace library package, only a root dev-dep - no constraint-dependencies entry needed, verified by verify_constraints.py still passing).
• langsmith >= 0.8.18 added to override-dependencies (it's a transitive-only dependency, pulled in by langchain-core/langchain-openai; 0.8.18 covers both #3 and #4 since it's the higher floor).

Local verification (all three fixes applied together):

• uv lock: resolves clean - langchain-openai 1.1.12→1.6.0, langsmith 0.7.31→0.12.1, langchain-core→1.6.1
• tox -e verify-constraints: PASS
• tox -e lint: PASS
• tox -e format: PASS
• tox -e py312: 800 passed, 3 skipped, 9 deselected, 0 failed - identical to the langchain-core-only commit, no regressions from the additional bumps

This should clear all four CVE-level findings under the MVS-2023-gwm8-m3c2 alert without removing/replacing LangChain - pure version upgrades, no code or behavior changes needed. Whether it fully closes the alert itself still depends on whether Microsoft's internal CG scanner treats MVS-2023-gwm8-m3c2 as "resolved once every currently-known CVE under it is patched" or continues to re-flag langchain categorically regardless of version (see my earlier comment) - the alert owner should verify against the actual CG portal once this merges.

[Copilot]

🟡 Changes recommended

Ensure the published langsmith minimum is enforced and reconcile the documented and locked langchain-core versions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

[EvanderDS (EvanderDS)]

Correction: this PR fixes 4 real CVEs, but CANNOT clear MVS-2023-gwm8-m3c2 itself

The alert owner shared the authoritative source advisory (https://dev.azure.com/OneCST/SecurityEngineering/_git/OSS-Security-Reviews?path=/advisories/2023/08/MVS-2023-gwm8-m3c2/MVS-2023-gwm8-m3c2.json). Key facts that change the picture from my earlier comments:

• Affected versions: introduced: "0", limit: "*" — i.e. ALL VERSIONS of langchain, langchain-core, langchain-community, and langchain-experimental, forever. This is not a version-bound CVE - no upgrade, at any version, can ever satisfy this range.
• approval_level: "Use Discouraged", published 2023-08-18 by Microsoft's own Open Source Security Team, still "publication_state": "Active" as of the last modified timestamp (2026-04-27). It's a standing policy position ("LangChain... must not be used in a production service, when processing untrusted data in any way, or with access to sensitive data"), not a patchable defect.
• Their own recommendation: "We recommend using Semantic Kernel instead."

What this means for this PR: the langchain-core/langchain-openai/langsmith version bumps here are still legitimate, independently-real CVE fixes (CVE-2026-44843, CVE-2026-41488, CVE-2026-45134, GHSA-f4xh-w4cj-qxq8) and should still be merged as good hygiene. But they will not, and structurally cannot, clear the MVS-2023-gwm8-m3c2 S360/CG alert - that alert will keep re-firing on any langchain-core dependency at any version, by design.

The only two ways to actually clear MVS-2023-gwm8-m3c2 for this repo:

1. Remove langchain-core/langchain/langchain-community/langchain-experimental entirely - in this repo that means retiring the microsoft-agents-a365-observability-extensions-langchain package (the only consumer). Given the repo already ships a parallel microsoft-agents-a365-observability-extensions-semantickernel package, this aligns with the advisory's own recommendation, but it is a product/feature-removal decision (drops LangChain observability support for any customer using it), not something I'll do unilaterally in this PR.
2. File a formal S360 risk-acceptance exception documenting that this repo's only LangChain touchpoint is a tracer/callback shim (not executing chains on untrusted input) - via the S360 portal's built-in "Request Exception" workflow, per Microsoft's OneException process. This does not require code changes and matches "use discouraged," not "prohibited."

Leaving this PR open for the 4 real CVE fixes; the alert itself needs one of the two decisions above from the service owner.

[EvanderDS (EvanderDS)]

Closing per repo owner's decision after reviewing the full advisory: MVS-2023-gwm8-m3c2 flags langchain/langchain-core at ALL VERSIONS (a permanent 'Use Discouraged' policy, not a patchable CVE) — no version bump can ever clear it. Replacing this PR with a clean removal PR instead. See #274.