admin-valentin/arcade-mcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Npm-form-data security vulnerability (#743)

Browse source 
Remediate CVE-2025-7783 critical vulnerability in the `form-data`
package across the repository.

The `form-data` package (versions >= 4.0.0 and < 4.0.4) used
`Math.random()` to generate boundary values, which is predictable and
could allow attackers to inject additional parameters into requests.
This PR updates the affected dependencies to a secure version (>= 4.0.4)
by running `npm audit fix` in `openai-agents-ts` and adding a pnpm
override in `langchain-ts`.

---
Linear Issue:
[TOO-333](https://linear.app/arcadedev/issue/TOO-333/vanta-remediate-critical-vulnerabilities-identified-in-packages-are)

<a
href="https://cursor.com/background-agent?bcId=bc-10abc1b2-8ec1-42cc-8ab9-6c7d1ff8a69d"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/open-in-cursor-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/open-in-cursor-light.svg"><img alt="Open in
Cursor"
src="https://cursor.com/open-in-cursor.svg"></picture></a>&nbsp;<a
href="https://cursor.com/agents?id=bc-10abc1b2-8ec1-42cc-8ab9-6c7d1ff8a69d"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/open-in-web-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/open-in-web-light.svg"><img alt="Open in Web"
src="https://cursor.com/open-in-web.svg"></picture></a>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Security and dependency updates**
> 
> - Adds `pnpm` override in `contrib/examples/langchain-ts/package.json`
to force `form-data@>=4.0.4`
> - Refreshes `pnpm-lock.yaml` for `langchain-ts`, upgrading `form-data`
to `4.0.5` and bumping related transitive deps (e.g., `axios`,
`follow-redirects`, `ws`, `dotenv`, `jsonwebtoken`,
`zod-to-json-schema`)
> - Updates `contrib/examples/openai-agents-ts/package-lock.json`:
upgrades `@modelcontextprotocol/sdk` to `1.25.3` (adds optional
`@hono/node-server`, `hono`, `jose`, `json-schema-typed`) and bumps `qs`
to `6.14.1`
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ae26b3d994d8fb0a6f4a88be34b7f17fb98cef6e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
This commit is contained in:
Evan Tahler 2026-01-20 18:17:56 -08:00 committed by GitHub
parent 28c1863ee3
commit b3a90889c6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 187 additions and 115 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
contrib/examples/langchain-ts/package.json
View file

@ -23,5 +23,10 @@
},
"devDependencies": {
"@types/node": "^24.10.1"
},
"pnpm": {
"overrides": {
"form-data@>=4.0.0 <4.0.4": ">=4.0.4"
}
}
}

241
contrib/examples/langchain-ts/pnpm-lock.yaml
View file

@ -4,6 +4,9 @@ settings:
autoInstallPeers: true
excludeLinksFromLockfile: false
overrides:
form-data@>=4.0.0 <4.0.4: '>=4.0.4'
importers:
.:
@ -13,16 +16,16 @@ importers:
version: 1.14.0
'@langchain/community':
specifier: ^1.0.5
version: 1.0.5(@browserbasehq/sdk@2.5.0)(@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.5.0)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(zod@4.1.13))(@ibm-cloud/watsonx-ai@1.6.5)(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ibm-cloud-sdk-core@5.3.2)(jsonwebtoken@9.0.2)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(playwright@1.52.0)(ws@8.18.2)
version: 1.0.5(@browserbasehq/sdk@2.6.0)(@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.6.1)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(zod@4.1.13))(@ibm-cloud/watsonx-ai@1.6.5)(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ibm-cloud-sdk-core@5.3.2)(jsonwebtoken@9.0.3)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(playwright@1.52.0)(ws@8.19.0)
'@langchain/core':
specifier: ^1.1.0
version: 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
version: 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
'@langchain/langgraph':
specifier: ^1.0.2
version: 1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(zod-to-json-schema@3.24.5(zod@4.1.13))(zod@4.1.13)
version: 1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(zod-to-json-schema@3.25.1(zod@4.1.13))(zod@4.1.13)
'@langchain/openai':
specifier: ^1.1.3
version: 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ws@8.18.2)
version: 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ws@8.19.0)
devDependencies:
'@types/node':
specifier: ^24.10.1
@ -36,8 +39,8 @@ packages:
'@arcadeai/arcadejs@1.14.0':
resolution: {integrity: sha512-Zcg4kxkZAJfuPyHueUpD5rXUrHZ2C8hHA/2b3bYArfCEcYhY6RkbyA8S7pbxKKHyzBf/929h6SE2SmE+xoMciw==}
'@browserbasehq/sdk@2.5.0':
resolution: {integrity: sha512-bcnbYZvm5Ht1nrHUfWDK4crspiTy1ESJYMApsMiOTUnlKOan0ocRD6m7hZH34iSC2c2XWsoryR80cwsYgCBWzQ==}
'@browserbasehq/sdk@2.6.0':
resolution: {integrity: sha512-83iXP5D7xMm8Wyn66TUaUrgoByCmAJuoMoZQI3sGg3JAiMlTfnCIMqyVBoNSaItaPIkaCnrsj6LiusmXV2X9YA==}
'@browserbasehq/stagehand@1.14.0':
resolution: {integrity: sha512-Hi/EzgMFWz+FKyepxHTrqfTPjpsuBS4zRy3e9sbMpBgLPv+9c0R+YZEvS7Bw4mTS66QtvvURRT6zgDGFotthVQ==}
@ -497,12 +500,21 @@ packages:
'@types/node-fetch@2.6.12':
resolution: {integrity: sha512-8nneRWKCg3rMtF69nLQJnOYUcbafYeFSjqkw3jCRLsqkWFlHaoQrr5mXmofFGOx3DKn7UfmBMyov8ySvLRVldA==}
'@types/node-fetch@2.6.13':
resolution: {integrity: sha512-QGpRVpzSaUs30JBSGPjOg4Uveu384erbHBoT1zeONvyCfwQxIkUshLAOqN/k9EjGviPRmWTTe6aH2qySWKTVSw==}
'@types/node@18.19.100':
resolution: {integrity: sha512-ojmMP8SZBKprc3qGrGk8Ujpo80AXkrP7G2tOT4VWr5jlr5DHjsJF+emXJz+Wm0glmy4Js62oKMdZZ6B9Y+tEcA==}
'@types/node@18.19.130':
resolution: {integrity: sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==}
'@types/node@24.10.1':
resolution: {integrity: sha512-GNWcUTRBgIRJD5zj+Tq0fKOJ5XZajIiBroOF0yvj2bSU1WvNdYS/dn9UxwsujGW4JX06dnHyjV2y9rRaybH0iQ==}
'@types/node@24.10.9':
resolution: {integrity: sha512-ne4A0IpG3+2ETuREInjPNhUGis1SFjv1d5asp8MzEAGtOZeTeHVDOYqOgqfhvseqg/iXty2hjBf1zAOb7RNiNw==}
'@types/retry@0.12.0':
resolution: {integrity: sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==}
@ -534,8 +546,8 @@ packages:
asynckit@0.4.0:
resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
axios@1.9.0:
resolution: {integrity: sha512-re4CqKTJaURpzbLHtIi6XpDv20/CnpXOtjRY5/CU32L8gU8ek9UIivcfvSWvmKEngmVbrUtPpdDwWDWL7DNHvg==}
axios@1.13.2:
resolution: {integrity: sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==}
base64-js@1.5.1:
resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
@ -576,8 +588,8 @@ packages:
console-table-printer@2.12.1:
resolution: {integrity: sha512-wKGOQRRvdnd89pCeH96e2Fn4wkbenSP6LMHfjfyNLMbGuHEFbMqQNuxXqd0oXG9caIOQ1FTvc5Uijp9/4jujnQ==}
debug@4.4.1:
resolution: {integrity: sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==}
debug@4.4.3:
resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
engines: {node: '>=6.0'}
peerDependencies:
supports-color: '*'
@ -597,8 +609,8 @@ packages:
resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
engines: {node: '>=0.4.0'}
dotenv@16.5.0:
resolution: {integrity: sha512-m/C+AwOAr9/W1UOIZUo232ejMNnJAJtYQjUbHoNTBNTJSvqzzDh7vnrei3o3r3m9blf6ZoDkvcw0VmozNRFJxg==}
dotenv@16.6.1:
resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
engines: {node: '>=12'}
dunder-proto@1.0.1:
@ -646,8 +658,8 @@ packages:
resolution: {integrity: sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==}
hasBin: true
follow-redirects@1.15.9:
resolution: {integrity: sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==}
follow-redirects@1.15.11:
resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==}
engines: {node: '>=4.0'}
peerDependencies:
debug: '*'
@ -658,12 +670,8 @@ packages:
form-data-encoder@1.7.2:
resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==}
form-data@4.0.0:
resolution: {integrity: sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==}
engines: {node: '>= 6'}
form-data@4.0.2:
resolution: {integrity: sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==}
form-data@4.0.5:
resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
engines: {node: '>= 6'}
formdata-node@4.4.1:
@ -739,15 +747,15 @@ packages:
resolution: {integrity: sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==}
engines: {node: '>=0.10.0'}
jsonwebtoken@9.0.2:
resolution: {integrity: sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==}
jsonwebtoken@9.0.3:
resolution: {integrity: sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==}
engines: {node: '>=12', npm: '>=6'}
jwa@1.4.2:
resolution: {integrity: sha512-eeH5JO+21J78qMvTIDdBXidBd6nG2kZjg5Ohz/1fpa28Z4CcsWUzJ1ZZyFq/3z3N17aZy+ZuBoHljASbL1WfOw==}
jwa@2.0.1:
resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
jws@3.2.2:
resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==}
jws@4.0.1:
resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
langsmith@0.3.81:
resolution: {integrity: sha512-NFmp7TDrrbCE6TIfHqutN9xhdgvx0EOhULVo8bDW+ib5idprwjMTvmS0S1n9uVFwjN03zU2zVEWViXnwy5XPrw==}
@ -924,6 +932,11 @@ packages:
engines: {node: '>=10'}
hasBin: true
semver@7.7.3:
resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==}
engines: {node: '>=10'}
hasBin: true
simple-wcswidth@1.0.1:
resolution: {integrity: sha512-xMO/8eNREtaROt7tJvWJqHBDTMFN4eiQ5I4JRMuilwfnFcV5W9u7RUkueNkdw0jPqGMX36iCywelS5yilTuOxg==}
@ -992,8 +1005,8 @@ packages:
wordwrap@1.0.0:
resolution: {integrity: sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==}
ws@8.18.2:
resolution: {integrity: sha512-DMricUmwGZUVr++AEAe2uiVM7UoO9MAVZMDu05UQOaUII0lp+zOzLLU4Xqh/JvTqklB1T4uELaaPBKyjE1r4fQ==}
ws@8.19.0:
resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==}
engines: {node: '>=10.0.0'}
peerDependencies:
bufferutil: ^4.0.1
@ -1009,10 +1022,10 @@ packages:
engines: {node: '>= 14'}
hasBin: true
zod-to-json-schema@3.24.5:
resolution: {integrity: sha512-/AuWwMP+YqiPbsJx5D6TfgRTc4kTLjsh5SOcd4bLsfUg2RcEXrFMJl1DGgdHy2aCfsIA/cr/1JM0xcB2GZji8g==}
zod-to-json-schema@3.25.1:
resolution: {integrity: sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA==}
peerDependencies:
zod: ^3.24.1
zod: ^3.25 || ^4
zod@3.24.4:
resolution: {integrity: sha512-OdqJE9UDRPwWsrHjLN2F8bPxvwJBK22EHLWtanu0LSYr5YqzsaaW3RMgmjwr8Rypg5k+meEJdSPXJZXE/yqOMg==}
@ -1024,8 +1037,8 @@ snapshots:
'@anthropic-ai/sdk@0.27.3':
dependencies:
'@types/node': 18.19.100
'@types/node-fetch': 2.6.12
'@types/node': 18.19.130
'@types/node-fetch': 2.6.13
abort-controller: 3.0.0
agentkeepalive: 4.6.0
form-data-encoder: 1.7.2
@ -1047,10 +1060,10 @@ snapshots:
transitivePeerDependencies:
- encoding
'@browserbasehq/sdk@2.5.0':
'@browserbasehq/sdk@2.6.0':
dependencies:
'@types/node': 18.19.100
'@types/node-fetch': 2.6.12
'@types/node': 18.19.130
'@types/node-fetch': 2.6.13
abort-controller: 3.0.0
agentkeepalive: 4.6.0
form-data-encoder: 1.7.2
@ -1059,17 +1072,17 @@ snapshots:
transitivePeerDependencies:
- encoding
'@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.5.0)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(zod@4.1.13)':
'@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.6.1)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(zod@4.1.13)':
dependencies:
'@anthropic-ai/sdk': 0.27.3
'@browserbasehq/sdk': 2.5.0
'@browserbasehq/sdk': 2.6.0
'@playwright/test': 1.52.0
deepmerge: 4.3.1
dotenv: 16.5.0
openai: 6.9.1(ws@8.18.2)(zod@4.1.13)
ws: 8.18.2
dotenv: 16.6.1
openai: 6.9.1(ws@8.19.0)(zod@4.1.13)
ws: 8.19.0
zod: 4.1.13
zod-to-json-schema: 3.24.5(zod@4.1.13)
zod-to-json-schema: 3.25.1(zod@4.1.13)
transitivePeerDependencies:
- bufferutil
- encoding
@ -1079,17 +1092,17 @@ snapshots:
'@ibm-cloud/watsonx-ai@1.6.5':
dependencies:
'@types/node': 18.19.100
'@types/node': 18.19.130
extend: 3.0.2
ibm-cloud-sdk-core: 5.3.2
transitivePeerDependencies:
- supports-color
'@langchain/classic@1.0.5(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(ws@8.18.2)':
'@langchain/classic@1.0.5(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(ws@8.19.0)':
dependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/openai': 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ws@8.18.2)
'@langchain/textsplitters': 1.0.1(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
'@langchain/openai': 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ws@8.19.0)
'@langchain/textsplitters': 1.0.1(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))
handlebars: 4.7.8
js-yaml: 4.1.1
jsonpointer: 5.0.1
@ -1099,7 +1112,7 @@ snapshots:
yaml: 2.7.1
zod: 4.1.13
optionalDependencies:
langsmith: 0.3.81(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
langsmith: 0.3.81(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
transitivePeerDependencies:
- '@opentelemetry/api'
- '@opentelemetry/exporter-trace-otlp-proto'
@ -1107,40 +1120,40 @@ snapshots:
- openai
- ws
'@langchain/community@1.0.5(@browserbasehq/sdk@2.5.0)(@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.5.0)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(zod@4.1.13))(@ibm-cloud/watsonx-ai@1.6.5)(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ibm-cloud-sdk-core@5.3.2)(jsonwebtoken@9.0.2)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(playwright@1.52.0)(ws@8.18.2)':
'@langchain/community@1.0.5(@browserbasehq/sdk@2.6.0)(@browserbasehq/stagehand@1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.6.1)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(zod@4.1.13))(@ibm-cloud/watsonx-ai@1.6.5)(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ibm-cloud-sdk-core@5.3.2)(jsonwebtoken@9.0.3)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(playwright@1.52.0)(ws@8.19.0)':
dependencies:
'@browserbasehq/stagehand': 1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.5.0)(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(zod@4.1.13)
'@browserbasehq/stagehand': 1.14.0(@playwright/test@1.52.0)(deepmerge@4.3.1)(dotenv@16.6.1)(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(zod@4.1.13)
'@ibm-cloud/watsonx-ai': 1.6.5
'@langchain/classic': 1.0.5(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(openai@6.9.1(ws@8.18.2)(zod@4.1.13))(ws@8.18.2)
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/openai': 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ws@8.18.2)
'@langchain/classic': 1.0.5(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(openai@6.9.1(ws@8.19.0)(zod@4.1.13))(ws@8.19.0)
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
'@langchain/openai': 1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ws@8.19.0)
binary-extensions: 2.3.0
flat: 5.0.2
ibm-cloud-sdk-core: 5.3.2
js-yaml: 4.1.1
math-expression-evaluator: 2.0.7
openai: 6.9.1(ws@8.18.2)(zod@4.1.13)
openai: 6.9.1(ws@8.19.0)(zod@4.1.13)
uuid: 10.0.0
zod: 4.1.13
optionalDependencies:
'@browserbasehq/sdk': 2.5.0
jsonwebtoken: 9.0.2
'@browserbasehq/sdk': 2.6.0
jsonwebtoken: 9.0.3
playwright: 1.52.0
ws: 8.18.2
ws: 8.19.0
transitivePeerDependencies:
- '@opentelemetry/api'
- '@opentelemetry/exporter-trace-otlp-proto'
- '@opentelemetry/sdk-trace-base'
- peggy
'@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))':
'@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))':
dependencies:
'@cfworker/json-schema': 4.1.1
ansi-styles: 5.2.0
camelcase: 6.3.0
decamelize: 1.2.0
js-tiktoken: 1.0.20
langsmith: 0.3.81(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
langsmith: 0.3.81(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
mustache: 4.2.0
p-queue: 6.6.2
p-retry: 7.1.0
@ -1152,44 +1165,44 @@ snapshots:
- '@opentelemetry/sdk-trace-base'
- openai
'@langchain/langgraph-checkpoint@1.0.0(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))':
'@langchain/langgraph-checkpoint@1.0.0(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))':
dependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
uuid: 10.0.0
'@langchain/langgraph-sdk@1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))':
'@langchain/langgraph-sdk@1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))':
dependencies:
p-queue: 6.6.2
p-retry: 4.6.2
uuid: 9.0.1
optionalDependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
'@langchain/langgraph@1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(zod-to-json-schema@3.24.5(zod@4.1.13))(zod@4.1.13)':
'@langchain/langgraph@1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(zod-to-json-schema@3.25.1(zod@4.1.13))(zod@4.1.13)':
dependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))
'@langchain/langgraph-sdk': 1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
'@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))
'@langchain/langgraph-sdk': 1.0.2(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))
uuid: 10.0.0
zod: 4.1.13
optionalDependencies:
zod-to-json-schema: 3.24.5(zod@4.1.13)
zod-to-json-schema: 3.25.1(zod@4.1.13)
transitivePeerDependencies:
- react
- react-dom
'@langchain/openai@1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))(ws@8.18.2)':
'@langchain/openai@1.1.3(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))(ws@8.19.0)':
dependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
js-tiktoken: 1.0.20
openai: 6.9.1(ws@8.18.2)(zod@4.1.13)
openai: 6.9.1(ws@8.19.0)(zod@4.1.13)
zod: 4.1.13
transitivePeerDependencies:
- ws
'@langchain/textsplitters@1.0.1(@langchain/core@1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13)))':
'@langchain/textsplitters@1.0.1(@langchain/core@1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13)))':
dependencies:
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.18.2)(zod@4.1.13))
'@langchain/core': 1.1.0(openai@6.9.1(ws@8.19.0)(zod@4.1.13))
js-tiktoken: 1.0.20
'@playwright/test@1.52.0':
@ -1207,16 +1220,29 @@ snapshots:
'@types/node-fetch@2.6.12':
dependencies:
'@types/node': 24.10.1
form-data: 4.0.2
form-data: 4.0.5
'@types/node-fetch@2.6.13':
dependencies:
'@types/node': 24.10.9
form-data: 4.0.5
'@types/node@18.19.100':
dependencies:
undici-types: 5.26.5
'@types/node@18.19.130':
dependencies:
undici-types: 5.26.5
'@types/node@24.10.1':
dependencies:
undici-types: 7.16.0
'@types/node@24.10.9':
dependencies:
undici-types: 7.16.0
'@types/retry@0.12.0': {}
'@types/tough-cookie@4.0.5': {}
@ -1241,10 +1267,10 @@ snapshots:
asynckit@0.4.0: {}
axios@1.9.0(debug@4.4.1):
axios@1.13.2(debug@4.4.3):
dependencies:
follow-redirects: 1.15.9(debug@4.4.1)
form-data: 4.0.2
follow-redirects: 1.15.11(debug@4.4.3)
form-data: 4.0.5
proxy-from-env: 1.1.0
transitivePeerDependencies:
- debug
@ -1286,7 +1312,7 @@ snapshots:
dependencies:
simple-wcswidth: 1.0.1
debug@4.4.1:
debug@4.4.3:
dependencies:
ms: 2.1.3
@ -1296,7 +1322,7 @@ snapshots:
delayed-stream@1.0.0: {}
dotenv@16.5.0: {}
dotenv@16.6.1: {}
dunder-proto@1.0.1:
dependencies:
@ -1339,23 +1365,18 @@ snapshots:
flat@5.0.2: {}
follow-redirects@1.15.9(debug@4.4.1):
follow-redirects@1.15.11(debug@4.4.3):
optionalDependencies:
debug: 4.4.1
debug: 4.4.3
form-data-encoder@1.7.2: {}
form-data@4.0.0:
dependencies:
asynckit: 0.4.0
combined-stream: 1.0.8
mime-types: 2.1.35
form-data@4.0.2:
form-data@4.0.5:
dependencies:
asynckit: 0.4.0
combined-stream: 1.0.8
es-set-tostringtag: 2.1.0
hasown: 2.0.2
mime-types: 2.1.35
formdata-node@4.4.1:
@ -1416,19 +1437,19 @@ snapshots:
ibm-cloud-sdk-core@5.3.2:
dependencies:
'@types/debug': 4.1.12
'@types/node': 18.19.100
'@types/node': 18.19.130
'@types/tough-cookie': 4.0.5
axios: 1.9.0(debug@4.4.1)
axios: 1.13.2(debug@4.4.3)
camelcase: 6.3.0
debug: 4.4.1
dotenv: 16.5.0
debug: 4.4.3
dotenv: 16.6.1
extend: 3.0.2
file-type: 16.5.4
form-data: 4.0.0
form-data: 4.0.5
isstream: 0.1.2
jsonwebtoken: 9.0.2
jsonwebtoken: 9.0.3
mime-types: 2.1.35
retry-axios: 2.6.0(axios@1.9.0(debug@4.4.1))
retry-axios: 2.6.0(axios@1.13.2)
tough-cookie: 4.1.4
transitivePeerDependencies:
- supports-color
@ -1449,9 +1470,9 @@ snapshots:
jsonpointer@5.0.1: {}
jsonwebtoken@9.0.2:
jsonwebtoken@9.0.3:
dependencies:
jws: 3.2.2
jws: 4.0.1
lodash.includes: 4.3.0
lodash.isboolean: 3.0.3
lodash.isinteger: 4.0.4
@ -1460,20 +1481,20 @@ snapshots:
lodash.isstring: 4.0.1
lodash.once: 4.1.1
ms: 2.1.3
semver: 7.7.2
semver: 7.7.3
jwa@1.4.2:
jwa@2.0.1:
dependencies:
buffer-equal-constant-time: 1.0.1
ecdsa-sig-formatter: 1.0.11
safe-buffer: 5.2.1
jws@3.2.2:
jws@4.0.1:
dependencies:
jwa: 1.4.2
jwa: 2.0.1
safe-buffer: 5.2.1
langsmith@0.3.81(openai@6.9.1(ws@8.18.2)(zod@4.1.13)):
langsmith@0.3.81(openai@6.9.1(ws@8.19.0)(zod@4.1.13)):
dependencies:
'@types/uuid': 10.0.0
chalk: 4.1.2
@ -1483,7 +1504,7 @@ snapshots:
semver: 7.7.2
uuid: 10.0.0
optionalDependencies:
openai: 6.9.1(ws@8.18.2)(zod@4.1.13)
openai: 6.9.1(ws@8.19.0)(zod@4.1.13)
lodash.includes@4.3.0: {}
@ -1523,9 +1544,9 @@ snapshots:
dependencies:
whatwg-url: 5.0.0
openai@6.9.1(ws@8.18.2)(zod@4.1.13):
openai@6.9.1(ws@8.19.0)(zod@4.1.13):
optionalDependencies:
ws: 8.18.2
ws: 8.19.0
zod: 4.1.13
openapi-types@12.1.3: {}
@ -1586,9 +1607,9 @@ snapshots:
requires-port@1.0.0: {}
retry-axios@2.6.0(axios@1.9.0(debug@4.4.1)):
retry-axios@2.6.0(axios@1.13.2):
dependencies:
axios: 1.9.0(debug@4.4.1)
axios: 1.13.2(debug@4.4.3)
retry@0.13.1: {}
@ -1596,6 +1617,8 @@ snapshots:
semver@7.7.2: {}
semver@7.7.3: {}
simple-wcswidth@1.0.1: {}
source-map@0.6.1: {}
@ -1656,11 +1679,11 @@ snapshots:
wordwrap@1.0.0: {}
ws@8.18.2: {}
ws@8.19.0: {}
yaml@2.7.1: {}
zod-to-json-schema@3.24.5(zod@4.1.13):
zod-to-json-schema@3.25.1(zod@4.1.13):
dependencies:
zod: 4.1.13

56
contrib/examples/openai-agents-ts/package-lock.json generated
View file

@ -29,13 +29,27 @@
"zod": "^3.24.2"
}
},
"node_modules/@hono/node-server": {
"version": "1.19.9",
"resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
"integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
"license": "MIT",
"optional": true,
"engines": {
"node": ">=18.14.1"
},
"peerDependencies": {
"hono": "^4"
}
},
"node_modules/@modelcontextprotocol/sdk": {
"version": "1.23.0",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.23.0.tgz",
"integrity": "sha512-MCGd4K9aZKvuSqdoBkdMvZNcYXCkZRYVs/Gh92mdV5IHbctX9H9uIvd4X93+9g8tBbXv08sxc/QHXTzf8y65bA==",
"version": "1.25.3",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.25.3.tgz",
"integrity": "sha512-vsAMBMERybvYgKbg/l4L1rhS7VXV1c0CtyJg72vwxONVX0l4ZfKVAnZEWTQixJGTzKnELjQ59e4NbdFDALRiAQ==",
"license": "MIT",
"optional": true,
"dependencies": {
"@hono/node-server": "^1.19.9",
"ajv": "^8.17.1",
"ajv-formats": "^3.0.1",
"content-type": "^1.0.5",
@ -45,6 +59,8 @@
"eventsource-parser": "^3.0.0",
"express": "^5.0.1",
"express-rate-limit": "^7.5.0",
"jose": "^6.1.1",
"json-schema-typed": "^8.0.2",
"pkce-challenge": "^5.0.0",
"raw-body": "^3.0.0",
"zod": "^3.25 || ^4.0",
@ -824,6 +840,17 @@
"node": ">= 0.4"
}
},
"node_modules/hono": {
"version": "4.11.4",
"resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz",
"integrity": "sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==",
"license": "MIT",
"optional": true,
"peer": true,
"engines": {
"node": ">=16.9.0"
}
},
"node_modules/http-errors": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
@ -902,6 +929,16 @@
"license": "ISC",
"optional": true
},
"node_modules/jose": {
"version": "6.1.3",
"resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
"integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
"license": "MIT",
"optional": true,
"funding": {
"url": "https://github.com/sponsors/panva"
}
},
"node_modules/json-schema-traverse": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
@ -909,6 +946,13 @@
"license": "MIT",
"optional": true
},
"node_modules/json-schema-typed": {
"version": "8.0.2",
"resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
"integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
"license": "BSD-2-Clause",
"optional": true
},
"node_modules/math-intrinsics": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@ -1147,9 +1191,9 @@
}
},
"node_modules/qs": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
"integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
"version": "6.14.1",
"resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
"integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
"license": "BSD-3-Clause",
"optional": true,
"dependencies": {