highsecurityHARDCODED_SECRET
Potential secret material was detected in packages/ai-sdk/test/tools.test.ts.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRET
Potential secret material was detected in packages/langchain-js/test/langchain.test.ts.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRET
Potential secret material was detected in packages/langchain-python/langchain_hyperresearch/tools.py.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRET
Potential secret material was detected in packages/langchain-python/tests/unit_tests/test_tools.py.
Remove the secret from source control and load it securely at runtime.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-ai-sdk.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-ai-sdk.yml references "actions/setup-node@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-js.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-js.yml references "actions/setup-node@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-python.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-python.yml references "astral-sh/setup-uv@v6" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-python.yml references "actions/upload-artifact@v4" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-python.yml references "actions/download-artifact@v4" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/publish-langchain-python.yml references "pypa/gh-action-pypi-publish@release/v1" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-ai-sdk.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-ai-sdk.yml references "actions/setup-node@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-langchain-js.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-langchain-js.yml references "actions/setup-node@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-langchain-python.yml references "actions/checkout@v5" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
mediumoperational-securityGITHUB_ACTION_UNPINNED
.github/workflows/test-langchain-python.yml references "astral-sh/setup-uv@v6" instead of a full 40-character commit SHA.
Pin third-party GitHub Actions and reusable workflows to a full commit SHA.
lowsecuritySECURITY_MD_MISSING
Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.
Add a SECURITY.md file with reporting guidance and supported versions.
lowoperational-securityDEPENDABOT_MISSING
Automation or dependency surfaces exist, but .github/dependabot.yml is missing.
Add Dependabot updates for GitHub Actions and dependency manifests.