Sacha Al Himdani 8ce429507b Bump langsmith to 0.5.20 and override @langchain/classic to fix CVE ...

langsmith <=0.5.18 leaks streamed LLM output past redaction controls
(GHSA-rr7j-v2q5-chgv). The transitive pin via @n8n/ai-utilities held
@langchain/classic at 1.0.5 which required langsmith ^0.3.64, blocking
the upgrade. Add npm overrides for @langchain/classic (^1.0.27) and
langsmith (^0.5.19) to resolve all three langsmith advisories.

The lockfile refresh bumps eslint-plugin-react-hooks from 7.0.1 to
7.1.0 which enables the react-hooks/refs and set-state-in-effect
rules. Fix the resulting lint errors:

- PDFPreview (console + trust): read currentPage through a ref synced
  via useEffect, keeping the setState updater pure and ref access
  outside of render
- MeasuresPage: remove redundant categoryFilter state that mirrored
  urlCategory, use a ref to detect URL changes and trigger refetch
  as the single source of category refetches
- WebhooksSettingsPage: defer loadEvents via requestAnimationFrame
  to avoid synchronous setState within the effect body

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

2026-04-21 11:16:53 +02:00

716 KiB

Raw Blame History

View Raw