From cedc33da17c35c4a5f0653b8bd619cfafb114639 Mon Sep 17 00:00:00 2001 From: Jackson Weber Date: Thu, 1 Oct 2026 14:27:03 -0700 Subject: [PATCH] fix: update grpc-js to 1.14.5 in locked dependency trees Refresh the root and AKS LangChain lockfiles for CVE-2026-101915 and CVE-2026-101916 without changing dependency ranges. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 1 + package-lock.json | 6 +++--- samples/aks-langchain/package-lock.json | 6 +++--- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a9b25a9..e1bbca3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## [Unreleased] ### Bugs Fixed +- Update `@grpc/grpc-js` from 1.14.4 to 1.14.5 in the root and AKS LangChain sample lockfiles to address [CVE-2026-101915](https://github.com/advisories/GHSA-f596-whhp-79r4) and [CVE-2026-101916](https://github.com/advisories/GHSA-m9gg-hp2v-232j). - A365: centralize shared request attributes in the base scope, including session and conversation IDs, channel details, and `operationSource` as `service.name`, while retaining last-write-wins `recordAttributes()` behavior. [#243](https://github.com/microsoft/opentelemetry-distro-javascript/pull/243) - Default `InvokeAgentScope` spans to `SpanKind.INTERNAL` while preserving explicit span-kind overrides. [#241](https://github.com/microsoft/opentelemetry-distro-javascript/pull/241) diff --git a/package-lock.json b/package-lock.json index 393f7bf..042f311 100644 --- a/package-lock.json +++ b/package-lock.json @@ -709,9 +709,9 @@ } }, "node_modules/@grpc/grpc-js": { - "version": "1.14.4", - "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.4.tgz", - "integrity": "sha1-5z/1fZeALwY5mVRfQ+uyseymXZ0=", + "version": "1.14.5", + "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.5.tgz", + "integrity": "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==", "license": "Apache-2.0", "dependencies": { "@grpc/proto-loader": "^0.8.0", diff --git a/samples/aks-langchain/package-lock.json b/samples/aks-langchain/package-lock.json index 4c14425..209dc3b 100644 --- a/samples/aks-langchain/package-lock.json +++ b/samples/aks-langchain/package-lock.json @@ -244,9 +244,9 @@ } }, "node_modules/@grpc/grpc-js": { - "version": "1.14.4", - "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.4.tgz", - "integrity": "sha1-5z/1fZeALwY5mVRfQ+uyseymXZ0=", + "version": "1.14.5", + "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.5.tgz", + "integrity": "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==", "license": "Apache-2.0", "dependencies": { "@grpc/proto-loader": "^0.8.0",