fix(security): extend langchain-core SSRF suppress to 2026-07-30 (ENG-12311)

[andriy-sudo]

Vulnerability

Package	Advisory	CVSS	Status
langchain-core	GHSA-2g6r-c272-w58r (CVE-2026-26013)	LOW	⚠️ Risk accepted — suppress extended to 2026-07-30

Ticket: ENG-12311

Blocker: Fix requires langchain-core 0.3.x → 1.2.11 (major breaking change). langchain-community 0.3.x hard-constrains langchain-core<1.0.0, making a semver-compatible upgrade impossible. Existing suppress was expiring 2026-06-15; extended to 2026-07-30.

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates the osv-scanner.toml configuration file to modify the suppression policy for vulnerability GHSA-2g6r-c272-w58r. The suppression expiration date is extended from June 15, 2026 to July 30, 2026. The ignore rationale is updated to explicitly reference CVE-2026-26013 and include an ENG-12311 reference, while preserving the existing information about the version constraint incompatibility between langchain-core 0.3.x and 1.2.11 and the conclusion that no semver-compatible fix is available.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and specifically describes the main change: extending a langchain-core SSRF vulnerability suppression to a new date, with the ticket reference ENG-12311.
Description check	✅ Passed	The description is clearly related to the changeset, providing detailed context about the vulnerability, suppression extension rationale, and blocker explanation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/ENG-12311-extend-langchain-core-ssrf-suppress

---

_{Review rate limit: 0/5 reviews remaining, refill in 56 minutes and 41 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

osv-scanner.toml (1)

8-8: Consider risk prioritization across severity levels.

The LOW severity vulnerability GHSA-2g6r-c272-w58r now has a suppression expiry of 2026-07-30, which is 14 days later than the HIGH severity vulnerability GHSA-qh6h-p6c9-ff54 (line 13, expires 2026-07-16). While the LOW severity designation may justify a longer acceptance window, having a lower-severity issue suppressed beyond a higher-severity one could create confusion in risk management reviews or automated compliance checks.

Consider either:

• Aligning LOW severity expiry dates to not exceed HIGH severity dates, or
• Adding a comment explaining the risk acceptance policy that permits this ordering

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@osv-scanner.toml` at line 8, The LOW severity suppression entry for
GHSA-2g6r-c272-w58r has ignoreUntil = 2026-07-30 which is later than the HIGH
severity GHSA-qh6h-p6c9-ff54 (2026-07-16); either change the ignoreUntil value
for GHSA-2g6r-c272-w58r to be on or before 2026-07-16 to align expiries, or add
a clear inline comment in osv-scanner.toml next to the GHSA-2g6r-c272-w58r entry
explaining the risk acceptance policy that allows a longer suppression window
relative to GHSA-qh6h-p6c9-ff54 so auditors and automated checks understand the
ordering.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@osv-scanner.toml`:
- Line 8: The LOW severity suppression entry for GHSA-2g6r-c272-w58r has
ignoreUntil = 2026-07-30 which is later than the HIGH severity
GHSA-qh6h-p6c9-ff54 (2026-07-16); either change the ignoreUntil value for
GHSA-2g6r-c272-w58r to be on or before 2026-07-16 to align expiries, or add a
clear inline comment in osv-scanner.toml next to the GHSA-2g6r-c272-w58r entry
explaining the risk acceptance policy that allows a longer suppression window
relative to GHSA-qh6h-p6c9-ff54 so auditors and automated checks understand the
ordering.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c67c61f8-bfb1-4384-b1cc-8e855a90e6ef

📥 Commits

Reviewing files that changed from the base of the PR and between 1e7a092 and 60b3f8b.

📒 Files selected for processing (1)

• osv-scanner.toml