[Snyk] Security upgrade @langchain/core from 0.3.26 to 0.3.80

[SMSDAO]

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• examples/agent-kit-langgraph/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Deserialization of Untrusted Data SNYK-JS-LANGCHAINCORE-14563113	853

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.19.2
	ts-node@​10.9.2
	typescript@​5.6.3
	@​langchain/​community@​0.3.20

View full report

[Copilot]

Pull request overview

This PR upgrades the @langchain/core dependency from version 0.3.26 to 0.3.80 in one example project to address a critical deserialization vulnerability (SNYK-JS-LANGCHAINCORE-14563113) with a severity score of 853. However, the upgrade is incomplete as only one of multiple affected files in the repository has been updated.

• Upgrades @langchain/core from 0.3.26 to 0.3.80 in the agent-kit-langgraph example
• Addresses critical deserialization vulnerability (score: 853)
• Warning: pnpm-lock.yaml was not updated and requires manual intervention

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This security upgrade only addresses the vulnerability in one example project, but the same vulnerable version (0.3.26) is still present in other locations:

• examples/tg-bot-starter/advanced-tg-bot/package.json
• examples/tg-bot-starter/basic-tg-bot/package.json
• package.json (root)

To fully address the critical deserialization vulnerability (SNYK-JS-LANGCHAINCORE-14563113), all instances of @langchain/core should be upgraded to version 0.3.80 or later across the entire repository.