fix(deps): bump langchain-core to ^1.2.5 to address CVE-2025-68664

This addresses the critical serialization injection vulnerability
(GHSA-c67j-w6g6-q2cm / CVE-2025-68664) in langchain-core that allows
attackers to steal secrets via the dumps/loads APIs.

Fixed versions: 0.3.81+ (0.x branch) or 1.2.5+ (1.x branch)

Related oncall issue: airbytehq/oncall#10773

Co-Authored-By: unknown <>

Author: devin-ai-integration[bot]

poetry.lock

@@ -64,7 +64,7 @@ avro = { version = ">=1.11.2,<1.13.0", optional = true }  # TODO: Move into dev
 cohere = { version = ">=4.21,<6.0.0", optional = true }
 fastavro = { version = ">=1.11.0,<2.0.0", optional = true }
 langchain_community = { version = "^0.4", optional = true }
-langchain_core = { version = "^1.0.0", optional = true }
+langchain_core = { version = "^1.2.5", optional = true }
 langchain_text_splitters = { version = "^1.0.0", optional = true }
 markdown = { version = "*", optional = true }  # TODO: Remove if unused
 openai = { version = "0.27.9", extras = ["embeddings"], optional = true }  # Used indirectly by langchain library