Latest Results
build(deps): patch vulnerable integration dependencies (#41473)
Upgrade Pillow to 13.0.0, filelock to 4.2.4, and setuptools to 84.2.1
across the affected dependency locks, addressing all 171 currently open
Dependabot alerts. Raise Qdrant's optional fastembed minimum to 0.9.1 so
it accepts patched Pillow.
**Breaking change:** Chroma, Hugging Face, Nomic, OpenAI, Perplexity,
Qdrant, LangChain, and LangChain Classic now require Python 3.11 or
newer. Patched Pillow and filelock dropped Python 3.10; downstream
package requirements and locks are updated consistently. PR and
scheduled integration CI use a plain Python 3.11 minimum, with no custom
matrix selection, added tests, or integration-group exceptions.
Text-splitters retains its existing package Python requirement.
Text-splitters lock validation succeeded offline with the unchanged,
hash-verified official spaCy wheel; online validation is blocked by a
GitHub release redirect returning HTTP 401.
Prepared with AI-agent assistance.
## References
- [Slack
thread](https://langchain.slack.com/archives/D0B5PRNJA05/p1792921848727259)
Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view
thread](https://openswe.langchain.dev/agents/4344b5aa-e3c2-5381-897f-24c9c5785146)
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Latest Branches
+22%
dependabot/uv/libs/core/minor-and-patch-99abfc1897 0%
0%
revert-41473-jkennedyvz/infra/dependabot-security-patches © 2026 CodSpeed Technology