[WIP] Update security upgrade of solana-agent-kit to 2.0.1 by Copilot · Pull Request #34 · SMSDAO/solana-agent-kit

Copilot · 2026-01-30T13:09:49Z

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

socket-security · 2026-01-30T13:12:20Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@4.19.2
	ts-node@10.9.2
	react@19.0.0 ⏵ 19.2.3
	typescript@5.6.3
	@langchain/community@0.3.20

View full report

Copilot

Pull request overview

Updates the example projects to use solana-agent-kit ^2.0.1 as part of a security upgrade effort.

Changes:

Bump solana-agent-kit dependency to ^2.0.1 across multiple example package.json files.
Standardize the dependency version in examples previously on various 1.x versions.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
examples/tg-bot-starter/group-tg-bot/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the group Telegram bot example.
examples/tg-bot-starter/basic-tg-bot/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the basic Telegram bot example.
examples/tg-bot-starter/advanced-tg-bot/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the advanced Telegram bot example.
examples/persistent-agent/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the persistent agent example.
examples/orbofi-personality-engine/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the Orbofi personality engine example.
examples/discord-bot-starter/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the Discord bot starter example.
examples/agent-kit-nextjs-langchain/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the Next.js + LangChain example.
examples/agent-kit-mcp-server/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the MCP server example.
examples/agent-kit-langgraph/package.json	Bumps `solana-agent-kit` to `^2.0.1` for the LangGraph example.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-30T13:15:12Z

examples/tg-bot-starter/basic-tg-bot/package.json

    "react": "^19.2.0",
    "react-dom": "^19.0.0",
-    "solana-agent-kit": "^1.3.0"
+    "solana-agent-kit": "^2.0.1"


This dependency was bumped in package.json, but the corresponding pnpm-lock.yaml in this example still pins solana-agent-kit to 1.3.0. Please update the lockfile (e.g., run pnpm install in this example) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "^1.3.0"

Copilot · 2026-01-30T13:15:13Z

examples/tg-bot-starter/advanced-tg-bot/package.json

    "react": "^19.2.0",
    "react-dom": "^19.0.0",
-    "solana-agent-kit": "^1.3.0"
+    "solana-agent-kit": "^2.0.1"


This dependency was bumped in package.json, but the corresponding pnpm-lock.yaml in this example still pins solana-agent-kit to 1.3.0. Please update the lockfile (e.g., run pnpm install in this example) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "1.3.0"

Copilot · 2026-01-30T13:15:13Z

examples/persistent-agent/package.json

  "dependencies": {
    "@langchain/langgraph-checkpoint-postgres": "^0.0.2",
-    "solana-agent-kit": "^1.3.0"
+    "solana-agent-kit": "^2.0.1"


This dependency was bumped in package.json, but the corresponding pnpm-lock.yaml in this example still pins solana-agent-kit to 1.3.0. Please update the lockfile (run pnpm install here) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "^1.3.0"

Copilot · 2026-01-30T13:15:13Z

examples/discord-bot-starter/package.json

    "discord.js": "^14.25.1",
    "dotenv": "^16.4.7",
-    "solana-agent-kit": "^1.3.4"
+    "solana-agent-kit": "^2.0.1"


This dependency was bumped in package.json, but examples/discord-bot-starter/pnpm-lock.yaml still pins solana-agent-kit to 1.3.4. Please update the lockfile (pnpm install) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "^1.3.4"

Copilot · 2026-01-30T13:15:13Z

examples/agent-kit-nextjs-langchain/package.json

 		"react-dom": "^18.3.1",
 		"react-toastify": "^9.1.3",
-		"solana-agent-kit": "^1.3.0",
+		"solana-agent-kit": "^2.0.1",


This dependency was bumped in package.json, but examples/agent-kit-nextjs-langchain/pnpm-lock.yaml still pins solana-agent-kit to 1.3.0. Please update the lockfile (pnpm install) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1",

"solana-agent-kit": "1.3.0",

Copilot · 2026-01-30T13:15:14Z

examples/agent-kit-mcp-server/package.json

    "@modelcontextprotocol/sdk": "^1.5.0",
    "dotenv": "^16.4.7",
-    "solana-agent-kit": "1.4.8",
+    "solana-agent-kit": "^2.0.1",


This dependency was bumped in package.json, but examples/agent-kit-mcp-server/pnpm-lock.yaml still pins solana-agent-kit to 1.4.8. Please update the lockfile (pnpm install) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1",

"solana-agent-kit": "1.4.8",

Copilot · 2026-01-30T13:15:14Z

examples/tg-bot-starter/group-tg-bot/package.json

    "react": "^19.0.0",
    "react-dom": "^19.0.0",
-    "solana-agent-kit": "^1.3.0"
+    "solana-agent-kit": "^2.0.1"


This dependency was bumped in package.json, but the corresponding pnpm-lock.yaml in this example still pins solana-agent-kit to 1.3.0. Please update the lockfile (e.g., run pnpm install in this example) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "^1.3.0"

Copilot · 2026-01-30T13:15:14Z

examples/orbofi-personality-engine/package.json

  "dependencies": {
    "@langchain/langgraph-checkpoint-postgres": "^0.0.2",
-    "solana-agent-kit": "^1.3.0"
+    "solana-agent-kit": "^2.0.1"


package.json was updated to solana-agent-kit ^2.0.1, but this example’s package-lock.json still references solana-agent-kit ^1.3.0 / 1.x (and will keep npm installs on the old version). Please regenerate/update package-lock.json so npm installs resolve to 2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1"

"solana-agent-kit": "^1.3.0"

Copilot · 2026-01-30T13:15:14Z

examples/agent-kit-langgraph/package.json

    "@solana/web3.js": "^1.98.0",
    "dotenv": "^16.4.7",
-    "solana-agent-kit": "^1.3.0",
+    "solana-agent-kit": "^2.0.1",


This dependency was bumped in package.json, but examples/agent-kit-langgraph/pnpm-lock.yaml still pins solana-agent-kit to 1.3.0. Please update the lockfile (pnpm install) so installs/CI actually use solana-agent-kit ^2.0.1.

Suggested change

"solana-agent-kit": "^2.0.1",

"solana-agent-kit": "^1.3.0",

Initial plan

4148e96

Copilot AI assigned Copilot and SMSDAO Jan 30, 2026

Copilot AI mentioned this pull request Jan 30, 2026

[Snyk] Security upgrade solana-agent-kit from 1.3.7 to 2.0.1 #29

Merged

Copilot started work on behalf of SMSDAO January 30, 2026 13:10 View session

Update all examples to solana-agent-kit ^2.0.1 for consistency

21a3305

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

SMSDAO marked this pull request as ready for review January 30, 2026 13:11

Copilot AI review requested due to automatic review settings January 30, 2026 13:11

Copilot started reviewing on behalf of SMSDAO January 30, 2026 13:12 View session

SMSDAO merged commit 0a2c321 into snyk-fix-79d17d74375956f9b19adb7e2186c148 Jan 30, 2026
6 checks passed

Copilot AI requested a review from SMSDAO January 30, 2026 13:13

Copilot stopped work on behalf of SMSDAO due to an error January 30, 2026 13:13
The session was cancelled by the user.

Copilot AI reviewed Jan 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Update security upgrade of solana-agent-kit to 2.0.1#34

[WIP] Update security upgrade of solana-agent-kit to 2.0.1#34
SMSDAO merged 2 commits intosnyk-fix-79d17d74375956f9b19adb7e2186c148from
copilot/sub-pr-29

Copilot AI commented Jan 30, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 30, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 30, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 30, 2026 •

edited

Loading