f13/microservices/chatThis dossier retains 20 exact component occurrences from 2 published evidence files at one immutable repository commit.
Published dependency evidence does not prove deployment, productive use, procurement or runtime reachability.
project ID + commit SHA + exact evidence pathEvery file remains tied to the observed commit. A parse error stays visible and never becomes a zero.
pypi:langchain-core1.4.6 · 1.4.87 OSV records returnedpypi:langchain1.3.11 · 1.3.83 OSV records returnedpypi:langgraph1.2.4 · 1.2.72 OSV records returnedpypi:langchain-openai1.3.0 · 1.3.31 OSV record returnedpypi:openai2.41.1 · 2.44.0pypi:langchain-linkup0.2.1pypi:langchain-mcp-adapters0.3.0pypi:langchain-protocol0.0.16 · 0.0.18pypi:langchain-tavily0.2.18pypi:tiktoken0.13.0LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
13 Jul 2026LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
13 Jul 2026langchain-core allows unauthorized users to read arbitrary files from the host file system
07 Jul 2026LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
07 Jul 2026LangChain has incomplete f-string validation in prompt templates
13 Jul 2026LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
02 Jul 2026LangGraph checkpoint loading has unsafe msgpack deserialization
06 Jun 2026LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
13 Jul 2026LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
13 Jul 2026LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
13 Jul 2026langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
06 Jun 2026LangGraph SDK has unsafe URL path construction
13 Jul 2026Not reported
13 Jul 2026The collector reads bounded lockfiles, SBOMs and exact double-equals pins at one immutable commit. Version ranges are never resolved by assumption.
Retrieval, parsing, matching and publishing use no generative AI model.i6eal (2026): Chat — exact AI dependency evidence dossier, data state 19 Jul 2026. https://i6eal.de/en/tools/ki-abhaengigkeitsatlas/repository/opencode-5711/
We build source-backed data products with stable identities, reproducible joins and boundaries that remain visible.
These tools complement the current result.