Summary
uipath-langchain (>=0.11.12, reproduced against the latest 0.17.x line) pins httpx2 to
>=2.5.0,<2.10.0. This upper bound blocks resolution of several known, publicly disclosed
vulnerabilities in httpx2/httpcore2, because every patched release of those packages is
>=2.10.0. Any project depending on uipath-langchain cannot resolve a clean dependency tree
via uv lock/pip without manually overriding this constraint.
Environment
uipath-langchain >=0.11.12 (also reproduced against the latest 0.17.x line)- Dependency scanning tool: Grype
Vulnerabilities blocked by the <2.10.0 cap
Root cause
Resolving with uv lock --upgrade-package httpx2 --upgrade-package httpcore2 fails with:
Because uipath-langchain>=0.17.0 depends on httpx2>=2.5.0,<2.10.0 and
httpx2>=2.12.0, we can conclude that uipath-langchain>=0.17.0 cannot
be used.
So even upgrading uipath-langchain to its latest release does not resolve the vulnerable
transitive dependency, since the <2.10.0 upper bound is present across the 0.17.x line.
Impact
Any consumer of uipath-langchain fails dependency/vulnerability scans (Grype, etc.) for
High/Medium severity findings in httpx2/httpcore2, with no way to fix it short of forcibly
overriding the resolver (uv's override-dependencies), which bypasses uipath-langchain's
own compatibility testing.
Suggested fix
Relax the httpx2 (and httpcore2) upper bound in uipath-langchain's dependency spec to
allow >=2.10.0 (ideally >=2.12.0 to pick up all current fixes), assuming compatibility
testing passes.
Workaround we're using in the meantime
[tool.uv]
override-dependencies = [
"httpx2>=2.12.0",
"httpcore2>=2.10.0",
]
Summary
uipath-langchain(>=0.11.12, reproduced against the latest 0.17.x line) pinshttpx2to>=2.5.0,<2.10.0. This upper bound blocks resolution of several known, publicly disclosedvulnerabilities in
httpx2/httpcore2, because every patched release of those packages is>=2.10.0. Any project depending onuipath-langchaincannot resolve a clean dependency treevia
uv lock/pipwithout manually overriding this constraint.Environment
uipath-langchain>=0.11.12 (also reproduced against the latest 0.17.x line)Vulnerabilities blocked by the
<2.10.0capRoot cause
Resolving with
uv lock --upgrade-package httpx2 --upgrade-package httpcore2fails with:So even upgrading
uipath-langchainto its latest release does not resolve the vulnerabletransitive dependency, since the
<2.10.0upper bound is present across the 0.17.x line.Impact
Any consumer of
uipath-langchainfails dependency/vulnerability scans (Grype, etc.) forHigh/Medium severity findings in
httpx2/httpcore2, with no way to fix it short of forciblyoverriding the resolver (
uv'soverride-dependencies), which bypassesuipath-langchain'sown compatibility testing.
Suggested fix
Relax the
httpx2(andhttpcore2) upper bound inuipath-langchain's dependency spec toallow
>=2.10.0(ideally>=2.12.0to pick up all current fixes), assuming compatibilitytesting passes.
Workaround we're using in the meantime