LibreChat using vulnerable versions of packages

[djriversq]

AWS Security Hub is reporting that LibreChat contains the following critical vulnerabilities due to the versions of langchain and elliptic in use:

• https://github.com.mcas.ms/advisories/GHSA-vjh7-7g9h-fjfh with a 9.0/10 severity
• https://github.com.mcas.ms/advisories/GHSA-6m59-8fmv-m5f9 although given a 2.1/10 severity by GitHub, it is given a score of 9.8 (Critical) by NIST on https://nvd.nist.gov/vuln/detail/cve-2024-7042

Is there a plan to get these package versions uplifted as soon as practicable?

[rubentalstra]

GHSA-vjh7-7g9h-fjfh

fixed already

#5848

[rubentalstra]

regarding the other one: https://security.snyk.io/vuln/SNYK-JS-LANGCHAIN-8310492

[rubentalstra]

I can create a PR bump but it's not really urgent.

[djriversq]

Considering it's been patched and there's mixed reports about it's criticality, please do.

[rubentalstra]

all good.