[renovate-appwrite]

This PR contains the following updates:

Package	Change	Age	Confidence
langchain-openai (changelog)	==0.3.28 → ==1.1.14

---

langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

CVE-2026-41488 / GHSA-r7w7-9xr2-qq2r / PYSEC-2026-76

More information

Details

Summary

langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.

The practical impact is limited because the fetched response body is passed directly to Pillow's Image.open() to extract dimensions — the response content is never returned, logged, or otherwise exposed to the caller. An attacker cannot exfiltrate data from internal services through this path. A potential risk is blind probing (inferring whether an internal host/port is open based on timing or error behavior).

Affected versions

• langchain-openai < 1.1.14

Patched versions

• langchain-openai >= 1.1.14 (requires langchain-core >= 1.2.31)

Affected code

File: libs/partners/openai/langchain_openai/chat_models/base.py — _url_to_size()

The vulnerable pattern was a validate-then-fetch with separate DNS resolution:

validate_safe_url(image_source, allow_private=False, allow_http=True)

##### ... separate network operation with independent DNS resolution ...
response = httpx.get(image_source, timeout=timeout)

Fix

The fix replaces the validate-then-fetch pattern with an SSRF-safe httpx transport (SSRFSafeSyncTransport from langchain-core) that:

• Resolves DNS once and validates all returned IPs against a policy (private ranges, cloud metadata, localhost, k8s internal DNS)
• Pins the connection to the validated IP, eliminating the DNS rebinding window
• Disables redirect following to prevent redirect-based SSRF bypasses

This fix was released in langchain-openai 1.1.14.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-r7w7-9xr2-qq2r
• https://nvd.nist.gov/vuln/detail/CVE-2026-41488
• https://github.com/langchain-ai/langchain
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-openai/PYSEC-2026-76.yaml

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2026-41488 / GHSA-r7w7-9xr2-qq2r / PYSEC-2026-76

More information

Details

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-r7w7-9xr2-qq2r

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[hansi-codes]

🟡 Tier B · Needs changes before merging

The previously reported unresolved dependency conflict remains: langchain-core is pinned below the minimum required by langchain-openai 1.1.14.

The requirements file replaces the langchain-openai pin from 0.3.28 to 1.1.14. Other dependency pins remain unchanged.

Verdict	New comments	Fixed	Still open
💬 Commented	0	0	1

Fix with agent prompt

### Issue 1
requirements.txt:6
**Update the langchain-core pin with this major bump**

`langchain-openai==1.1.14` requires `langchain-core>=1.2.31`, but the requirements still pin `langchain-core==0.3.72`. This makes `pip install -r requirements.txt` unsatisfiable, so the Dockerfile's dependency-install step cannot build production images.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 1

File	Change
requirements.txt	Updated the pinned langchain-openai version.

⏳ Still open from earlier reviews · 1

• 🟠 Update the langchain-core pin with this major bump · requirements.txt:6

---

_{Reviewed c4c4b2e · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

Update the langchain-core pin with this major bump

langchain-openai==1.1.14 requires langchain-core>=1.2.31, but the requirements still pin langchain-core==0.3.72. This makes pip install -r requirements.txt unsatisfiable, so the Dockerfile's dependency-install step cannot build production images.

Prompt To Fix With AI

This is a comment left during a code review.
Path: requirements.txt
Line: 6

Comment:
**Update the langchain-core pin with this major bump**

`langchain-openai==1.1.14` requires `langchain-core>=1.2.31`, but the requirements still pin `langchain-core==0.3.72`. This makes `pip install -r requirements.txt` unsatisfiable, so the Dockerfile's dependency-install step cannot build production images.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟠 Major · bug · Reply if this doesn't apply.}