chore(deps): update dependency langchain-core to v1 [security] by renovate-bot · Pull Request #13957 · GoogleCloudPlatform/python-docs-samples

renovate-bot · 2026-03-27T23:48:28Z

This PR contains the following updates:

Package	Change	Age	Confidence
langchain-core (changelog)	`==0.2.33` → `==1.2.22`

GitHub Vulnerability Alerts

CVE-2026-34070

Summary

Multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples).

Note: The affected functions (load_prompt, load_prompt_from_config, and the .save() method on prompt classes) are undocumented legacy APIs. They are superseded by the dumpd/dumps/load/loads serialization APIs in langchain_core.load, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.

Affected component

Package: langchain-core
File: langchain_core/prompts/loading.py
Affected functions: _load_template(), _load_examples(), _load_few_shot_prompt()

Severity

High

The score reflects the file-extension constraints that limit which files can be read.

Vulnerable code paths

Config key	Loaded by	Readable extensions
`template_path`, `suffix_path`, `prefix_path`	`_load_template()`	`.txt`
`examples` (when string)	`_load_examples()`	`.json`, `.yaml`, `.yml`
`example_prompt_path`	`_load_few_shot_prompt()`	`.json`, `.yaml`, `.yml`

None of these code paths validated the supplied path against absolute path injection or .. traversal sequences before reading from disk.

Impact

An attacker who controls or influences the prompt configuration dict can read files outside the intended directory:

.txt files: cloud-mounted secrets (/mnt/secrets/api_key.txt), requirements.txt, internal system prompts
.json/.yaml files: cloud credentials (~/.docker/config.json, ~/.azure/accessTokens.json), Kubernetes manifests, CI/CD configs, application settings

This is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose load_prompt_from_config().

Proof of concept

from langchain_core.prompts.loading import load_prompt_from_config

# Reads /tmp/secret.txt via absolute path injection
config = {
    "_type": "prompt",
    "template_path": "/tmp/secret.txt",
    "input_variables": [],
}
prompt = load_prompt_from_config(config)
print(prompt.template)  # file contents disclosed

# Reads ../../etc/secret.txt via directory traversal
config = {
    "_type": "prompt",
    "template_path": "../../etc/secret.txt",
    "input_variables": [],
}
prompt = load_prompt_from_config(config)

# Reads arbitrary .json via few-shot examples
config = {
    "_type": "few_shot",
    "examples": "../../../../.docker/config.json",
    "example_prompt": {
        "_type": "prompt",
        "input_variables": ["input", "output"],
        "template": "{input}: {output}",
    },
    "prefix": "",
    "suffix": "{query}",
    "input_variables": ["query"],
}
prompt = load_prompt_from_config(config)

Mitigation

Update langchain-core to >= 1.2.22.

The fix adds path validation that rejects absolute paths and .. traversal sequences by default. An allow_dangerous_paths=True keyword argument is available on load_prompt() and load_prompt_from_config() for trusted inputs.

As described above, these legacy APIs have been formally deprecated. Users should migrate to dumpd/dumps/load/loads from langchain_core.load.

Credit

jiayuqi7813 reporter
VladimirEliTokarev reporter
Rickidevs reporter
Kenneth Cox (cczine@gmail.com) reporter

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

gemini-code-assist

Code Review

This pull request updates the langchain-core dependency to version 1.2.22 across several requirements files. A critical dependency conflict was identified because langchain-google-vertexai 1.0.10 requires langchain-core < 0.3, meaning this update will break environment resolution and cannot be merged in its current state.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/evaluation/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/extensions/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/image_generation/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/model_garden/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/model_tuning/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/prompts/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

gemini-code-assist · 2026-03-27T23:50:19Z

generative_ai/reasoning_engine/requirements.txt

 google-auth==2.38.0
 anthropic[vertex]==0.28.0
-langchain-core==0.2.33
+langchain-core==1.2.22


This update to langchain-core==1.2.22 introduces a breaking dependency conflict. The langchain-google-vertexai==1.0.10 package (on line 11) requires langchain-core<0.3, as specified on its PyPI page. Upgrading langchain-core to v1.2.22 will cause dependency resolution to fail.

To resolve this, langchain-google-vertexai must also be updated to a version compatible with langchain-core v1 or newer. It appears a compatible version has not been released yet.

This PR cannot be merged in its current state as it will break the application's environment.

chore(deps): update dependency langchain-core to v1 [security]

4388d9e

renovate-bot requested review from a team as code owners March 27, 2026 23:48

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Mar 27, 2026

product-auto-label bot added the samples Issues that are directly related to samples. label Mar 27, 2026

kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Mar 27, 2026

gemini-code-assist bot reviewed Mar 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency langchain-core to v1 [security]#13957

chore(deps): update dependency langchain-core to v1 [security]#13957
renovate-bot wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
renovate-bot:renovate/pypi-langchain-core-vulnerability

renovate-bot commented Mar 27, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

gemini-code-assist bot Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate-bot commented Mar 27, 2026

GitHub Vulnerability Alerts

CVE-2026-34070

Summary

Affected component

Severity

Vulnerable code paths

Impact

Proof of concept

Mitigation

Credit

Configuration

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants