chore(deps): bump the npm_and_yarn group across 23 directories with 12 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: jws and qs.
Bumps the npm_and_yarn group with 5 updates in the /.github/actions/changesets-action directory:

Package	From	To
@octokit/plugin-paginate-rest	2.21.3	removed
@octokit/request-error	2.1.0	7.1.0
semver	5.7.1	5.7.2
semver	6.3.0	6.3.1
brace-expansion	1.1.11	1.1.12
js-yaml	3.14.1	3.14.2

Bumps the npm_and_yarn group with 2 updates in the /CopilotKit directory: @langchain/community and next.
Bumps the npm_and_yarn group with 2 updates in the /CopilotKit/examples/next-openai directory: @langchain/community and next.
Bumps the npm_and_yarn group with 2 updates in the /CopilotKit/examples/next-pages-router directory: @langchain/community and next.
Bumps the npm_and_yarn group with 1 update in the /CopilotKit/packages/runtime directory: @langchain/community.
Bumps the npm_and_yarn group with 1 update in the /CopilotKit/packages/sdk-js directory: @langchain/community.
Bumps the npm_and_yarn group with 3 updates in the /docs directory: brace-expansion, js-yaml and next.
Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-ai-researcher/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 2 updates in the /examples/coagents-qa-native/agent-js directory: js-yaml and fast-xml-parser.
Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-qa-native/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 2 updates in the /examples/coagents-qa-text/agent-js directory: js-yaml and fast-xml-parser.
Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-qa-text/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 6 updates in the /examples/coagents-qa/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2
lodash	4.17.21	4.17.23

Bumps the npm_and_yarn group with 1 update in the /examples/coagents-research-canvas/agent-js directory: fast-xml-parser.
Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-research-canvas/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 2 updates in the /examples/coagents-routing/agent-js directory: js-yaml and fast-xml-parser.
Bumps the npm_and_yarn group with 6 updates in the /examples/coagents-routing/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2
lodash	4.17.21	4.17.23

Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-shared-state/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-starter/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-travel/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	14.2.5	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 5 updates in the /examples/coagents-wait-user-input/ui directory:

Package	From	To
jws	4.0.0	4.0.1
brace-expansion	1.1.11	1.1.12
js-yaml	4.1.0	4.1.1
next	15.1.0	15.5.10
diff	5.2.0	5.2.2

Bumps the npm_and_yarn group with 3 updates in the /infra directory: brace-expansion, js-yaml and diff.

Updates jws from 3.2.2 to 3.2.3

Release notes

Sourced from jws's releases.

v3.2.3

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.

Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

• BREAKING: jwt.verify now requires an algorithm parameter, and jws.createVerify requires an algorithm option. The "alg" field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by jwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.

2.0.0 - 2015-01-30

Changed

• BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

• Code reorganization, thanks @​fearphage! (7880050)

Added

• Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)

Commits

• 4f6e73f Merge commit from fork
• bd0fea5 version 3.2.3
• 7c3b4b4 Enhance tests for HMAC streaming sign and verify
• a9b8ed9 Improve secretOrKey initialization in VerifyStream
• 6707fde Improve secret handling in SignStream
• See full diff in compare view

Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.

Updates qs from 6.13.1 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

• [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
• [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

• [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
• [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
• [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
• [Fix] parse: enforce arrayLimit on comma-parsed values
• [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
• [Robustness] avoid .push, use void
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [meta] fix changelog typo (arrayLength → arrayLimit)
• [actions] fix rebase workflow permissions

6.14.1

• [Fix] ensure arrayLimit applies to [] notation as well
• [Fix] parse: when a custom decoder returns null for a key, ignore that key
• [Refactor] parse: extract key segment splitting helper
• [meta] add threat model
• [actions] add workflow permissions
• [Tests] stringify: increase coverage
• [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

• [New] parse: add throwOnParameterLimitExceeded option (#517)
• [Refactor] parse: use utils.combine more
• [patch] parse: add explicit throwOnLimitExceeded default
• [actions] use shared action; re-add finishers
• [meta] Fix changelog formatting bug
• [Deps] update side-channel
• [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
• [Tests] increase coverage

6.13.3

[Fix] fix regressions from robustness refactor [actions] update reusable workflows

6.13.2

• [Robustness] avoid .push, use void
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [actions] fix rebase workflow permissions

Commits

• d9b4c66 v6.15.0
• cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
• 88e1563 [Fix] duplicates option should not apply to bracket notation keys
• 9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
• 85cc8ca v6.12.5
• ffc12aa v6.11.4
• 0506b11 [actions] update reusable workflows
• 6a37faf [actions] update reusable workflows
• 8e8df5a [Fix] fix regressions from robustness refactor
• d60bab3 v6.10.7
• Additional commits viewable in compare view

Removes @octokit/plugin-paginate-rest

Updates @octokit/request-error from 2.1.0 to 7.1.0

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

• inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#512) (8eee0c1)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits

• 2ea2780 feat: inherit options from base Error class to add support for the cause ...
• ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
• dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
• f57f2e6 build(deps): lock file maintenance (#534)
• e5a75ef fix(deps): update dependency @​octokit/types to v16 (#533)
• e5d5de2 chore(deps): update dependency @​types/node to v24 (#532)
• 8cc127b ci(action): update actions/setup-node action to v6 (#529)
• b3a876b build(deps): lock file maintenance (#527)
• cf1817b ci(action): update github/codeql-action action to v4 (#528)
• 61f1e87 chore(deps): update dependency tinybench to v5 (#519)
• Additional commits viewable in compare view

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

5.7

• Add minVersion method

5.6

• Move boolean loose param to an options object, with backwards-compatibility protection.
• Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

• Add version coercion capabilities

5.4

• Add intersection checking

5.3

• Add minSatisfying method

5.2

• Add prerelease(v) that returns prerelease components

5.1

• Add Backus-Naur for ranges
• Remove excessively cute inspection methods

5.0

• Remove AMD/Browserified build artifacts
• Fix ltr and gtr when using the * range
• Fix for range * with a prerelease identifier

Commits

• f8cc313 chore: release 5.7.2
• 2f8fd41 fix: better handling of whitespace (#585)
• deb5ad5 chore: @​npmcli/template-oss@​4.16.0
• See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates semver from 6.3.0 to 6.3.1

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

5.7

• Add minVersion method

5.6

• Move boolean loose param to an options object, with backwards-compatibility protection.
• Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

• Add version coercion capabilities

5.4

• Add intersection checking

5.3

• Add minSatisfying method

5.2

• Add prerelease(v) that returns prerelease components

5.1

• Add Backus-Naur for ranges
• Remove excessively cute inspection methods

5.0

• Remove AMD/Browserified build artifacts
• Fix ltr and gtr when using the * range
• Fix for range * with a prerelease identifier

Commits

• f8cc313 chore: release 5.7.2
• 2f8fd41 fix: better handling of whitespace (#585)
• deb5ad5 chore: @​npmcli/template-oss@​4.16.0
• See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 44f33b4 1.1.12
• c460dbd pkg: publish on tag 1.x
• ccb8ac6 fmt
• c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

• Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

• Types are now exported as yaml.types.XXX.
• Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

• Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

• Check migration guide to see details for all breaking changes.
• Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
• Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
• yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
• yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
• !!binary now always mapped to Uint8Array on load.
• Reduced nesting of /lib folder.
• Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
• dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
• Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
• Code snippet created in exceptions now contains multiple lines with line numbers.
• dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
• dump() with skipInvalid=true now serializes invalid items in collections as null.
• Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
• Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

• Added .mjs (es modules) support.
• Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
• Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

• 9963d36 3.14.2 released
• 10d3c8e dist rebuild
• 5278870 fix prototype pollution in merge (<<) (#731)
• See full diff in compare view

Updates @langchain/community from 0.0.53 to 1.1.14

Release notes

Sourced from @​langchain/community's releases.

@​langchain/community@​1.1.14

Patch Changes

• #9990 d5e3db0 Thanks @​hntrl! - feat(core): Add SSRF protection module (@langchain/core/utils/ssrf) with utilities for validating URLs against private IPs, cloud metadata endpoints, and localhost.

  fix(community): Harden RecursiveUrlLoader against SSRF attacks by integrating validateSafeUrl and replacing string-based URL comparison with origin-based isSameOrigin from the shared SSRF module.

• Updated dependencies [d5e3db0, 6939dab, ad581c7]:

  • @​langchain/core@​1.1.21
  • @​langchain/openai@​1.2.7
  • @​langchain/classic@​1.0.17

@​langchain/community@​1.1.12

Patch Changes

• Updated dependencies [0870ca0, 8f0757f, cf46089]:
  • @​langchain/openai@​1.2.5
  • @​langchain/classic@​1.0.15

@​langchain/community@​1.1.11

Patch Changes

• #9905 41bfea5 Thanks @​christian-bromann! - fix(classic/community/core): avoid long lived abort signals

• Updated dependencies [41bfea5]:

  • @​langchain/classic@​1.0.14
  • @​langchain/openai@​1.2.4

@​langchain/community@​1.1.10

Patch Changes

• #9883 ea00005 Thanks @​FilipZmijewski! - support aborting for Model Gateway and WatsonxLLM for IBM

• #9896 70f329a Thanks @​Axadali! - Add score normalization feature to PGVectorStore allowing users to choose between returning raw distances or normalized similarity scores. This makes PGVectorStore consistent with other vector stores in the LangChain ecosystem where higher scores indicate greater similarity. Maintains full backward compatibility by defaulting to distance mode.

• #9874 a995a3f Thanks @​phong-phuong! - fix jira failing to fetch issues

• Updated dependencies [1fa865b, 28efb57, 4e42452, a9b5059, a9b5059]:

  • @​langchain/openai@​1.2.4
  • @​langchain/classic@​1.0.13

@​langchain/community@​1.1.9

Patch Changes

• Updated dependencies [1d58bf2]:
  • @​langchain/classic@​1.0.12

@​langchain/community@​1.1.8

Patch Changes

... (truncated)

Commits

• d4aa95a chore: version packages (#9989)
• 1a5b644 chore: fix changeset (#9994)
• be7c778 chore: caret resolution for core (#9993)
• 6939dab fix(openai): store response.output in response_metadata for reasoning model r...
• ea7e791 fix(agents): concurrent-dynamic-system-prompt-agent-support (#9983)
• 342fd4f chore(langchain): relax benchmark (#9992)
• 8a52dad Don't re-emit input state from middleware hooks that return void (#9986)
• 5f28338 feat(agents): support returning Command from wrapModelCall middleware (#9981)
• d5e3db0 feat(core,community): ssrf hardening (#9990)
• e2ed407 Set the correct _llmType for Google models (#9985)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​langchain/community since your current version.

Updates next from 14.2.4 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates @langchain/community from 0.0.53 to 1.1.14

Release notes

Sourced from @​langchain/community's releases.

@​langchain/community@​1.1.14

Patch Changes

• #9990 d5e3db0 Thanks @​hntrl! - feat(core): Add SSRF protection module (@langchain/core/utils/ssrf) with utilities for validating URLs against private IPs, cloud metadata endpoints, and localhost.

  fix(community): Harden RecursiveUrlLoader against SSRF attacks by integrating validateSafeUrl and replacing string-based URL comparison with origin-based isSameOrigin from the shared SSRF module.

• Updated dependencies [d5e3db0, 6939dab, ad581c7]:

  • @​langchain/core@​1.1.21
  • @​langchain/openai@​1.2.7
  • @​langchain/classic@​1.0.17

@​langchain/community@​1.1.12

Patch Changes

• Updated dependencies [0870ca0, 8f0757f, cf46089]:
  • @​langchain/openai@​1.2.5
  • @​langchain/classic@​1.0.15

@​langchain/community@​1.1.11

Patch Changes

• #9905 41bfea5 Thanks @​christian-bromann! - fix(classic/community/core): avoid long lived abort signals

• Updated dependencies [41bfea5]:

  • @​langchain/classic@​1.0.14
  • @​langchain/openai@​1.2.4

@​langchain/community@​1.1.10

Patch Changes

• #9883 ea00005 Thanks @​FilipZmijewski! - support aborting for Model Gateway and WatsonxLLM for IBM

• #9896 70f329a Thanks @​Axadali! - Add score normalization feature to PGVectorStore allowing users to choose between returning raw distances or normalized similarity scores. This makes PGVectorStore consistent with other vector stores in the LangChain ecosystem where higher scores indicate greater similarity. Maintains full backward compatibility by defaulting to distance mode.

• #9874 a995a3f Thanks @​phong-phuong! - fix jira failing to fetch issues

• Updated dependencies [1fa865b, 28efb57, 4e42452, a9b5059, a9b5059]:

  • @​langchain/openai@​1.2.4
  • @​langchain/classic@​1.0.13

@​langchain/community@​1.1.9

Patch Changes

• Updated dependencies [1d58bf2]:
  • @​langchain/classic@​1.0.12

@​langchain/community@​1.1.8

Patch Changes

... (truncated)

Commits

• d4aa95a chore: version packages (#9989)
• 1a5b644 chore: fix changeset (#9994)
• be7c778 chore: caret resolution for core (#9993)
• 6939dab fix(openai): store response.output in response_metadata for reasoning model r...
• ea7e791 fix(agents): concurrent-dynamic-system-prompt-agent-support (#9983)
• 342fd4f chore(langchain): relax benchmark (#9992)
• 8a52dad Don't re-emit input state from middleware hooks that return void (#9986)
• 5f28338 feat(agents): support returning Command from wrapModelCall middleware (#9981)
• d5e3db0 feat(core,community): ssrf hardening (#9990)
• e2ed407 Set the correct _llmType for Google models (#9985)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​langchain/community since your current version.

Updates next from 14.2.4 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates @langchain/community from 0.0.53 to 1.1.14

Release notes

Sourced from @​langchain/community's releases.

@​langchain/community@​1.1.14

Patch Changes

• #9990 d5e3db0 Thanks @​hntrl! - feat(core): Add SSRF protection module (@langchain/core/utils/ssrf) with utilities for validating URLs against private IPs, cloud metadata endpoints, and localhost.

  fix(community): Harden RecursiveUrlLoader again...

  Description has been truncated