fix: remediate Dependabot alerts by danielchalef · Pull Request #582 · getzep/zep

danielchalef · 2026-07-29T16:44:49Z

Summary

update vulnerable Python example dependencies and Go modules
refresh npm and Yarn lockfiles with patched transitive versions
upgrade the graph visualization Next.js dependency and security resolutions

Validation

GOWORK=off go mod verify && GOWORK=off go test ./... in integrations/adk/go and legacy/src
GOWORK=off go vet ./... in integrations/adk/go
TypeScript typecheck and Vitest suites for ADK, Mastra, and Vercel AI integrations
yarn build in the graph visualization example
uv pip compile --python 3.14 --no-deps --quiet requirements.txt
git diff --check

Note

Low Risk
Lockfile and requirements-only updates for known CVEs; risk is limited to install/build compatibility, not product behavior.

Overview
Addresses Dependabot security alerts by bumping pinned and transitive dependencies across Python examples, Go modules, and npm/Yarn lockfiles—no application logic changes.

Python examples refresh vulnerable packages in Streamlit requirements.txt files (GitPython, pillow) and in the shared examples lock (mcp, python-engineio, python-socketio, soupsieve). The ElevenLabs React demo lockfile picks up patched nanoid and postcss.

TypeScript updates the graph visualization app to Next.js 15.5.21, tightens Yarn resolutions (e.g. js-yaml 4.3.0, sharp 0.35.0, postcss floor), and regenerates yarn.lock. Integration packages (ADK, Mastra, Vercel AI) get refreshed lockfiles (including @hono/node-server 2.x, @modelcontextprotocol/sdk, postcss, js-yaml); Mastra pins js-yaml via overrides.

Go bumps indirect golang.org/x/crypto, net, sys, and google.golang.org/grpc in integrations/adk/go and legacy/src; legacy also moves to Go 1.25.

^{Reviewed by Cursor Bugbot for commit ff0d015. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-07-29T16:45:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality
npm/next@15.5.18 ⏵ 15.5.21		⁺³¹	⁺¹
pypi/pillow@12.2.0 ⏵ 12.3.0		⁺⁷⁵
pypi/gitpython@3.1.50 ⏵ 3.1.55	⁺¹	⁺⁷⁵
pypi/python-engineio@4.12.2 ⏵ 4.13.2	⁺¹	⁺²²
pypi/soupsieve@2.7 ⏵ 2.8.4	⁺¹	⁺²²
pypi/mcp@1.23.0 ⏵ 1.28.1	⁺¹	⁺³¹
pypi/python-socketio@5.14.0 ⏵ 5.16.2	⁺¹	⁺¹⁶

View full report

socket-security · 2026-07-29T16:45:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `@img/sharp-libvips-darwin-arm64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-darwin-arm64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-darwin-arm64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-darwin-x64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-darwin-x64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-darwin-x64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-arm` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-arm@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-arm@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-arm64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-arm64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-arm64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-ppc64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-ppc64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-ppc64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-riscv64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-riscv64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-riscv64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-s390x` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-s390x@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-s390x@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linux-x64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linux-x64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linux-x64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linuxmusl-arm64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linuxmusl-arm64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-arm64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@img/sharp-libvips-linuxmusl-x64` under LGPL-3.0-or-later Location: Package overview From: examples/typescript/zep-graph-visualization/yarn.lock → `npm/next@15.5.21` → `npm/@img/sharp-libvips-linuxmusl-x64@1.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-x64@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: examples/typescript/zep-graph-visualization/package.json → `npm/next@15.5.21` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.21`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `next` Location: Package overview From: examples/typescript/zep-graph-visualization/package.json → `npm/next@15.5.21` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.21`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` under GPL-2.0+ License: GPL-2.0+ - The applicable license policy does not permit this license (5) (pillow-12.3.0.dist-info/licenses/LICENSE) From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` under GPL-2.0+ License: GPL-2.0+ - The applicable license policy does not permit this license (5) (pillow-12.3.0.dist-info/licenses/LICENSE) From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` under GPL-2.0+ License: GPL-2.0+ - The applicable license policy does not permit this license (5) (pillow-12.3.0.dist-info/licenses/LICENSE) From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pillow` Location: Package overview From: examples/python/agent-memory-full-example/requirements.txt → `pypi/pillow@12.3.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pillow@12.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 72 more rows in the dashboard

View full report

github-actions

No actionable findings. The dependency manifests and lockfiles appear consistent with the repository’s current runtime requirements and conventions.

cursor

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1393235. Configure here.}

github-actions

No actionable findings.

The dependency manifests and lockfiles appear internally consistent, and the changes align with the repository’s documented Node, Python, and Go version conventions.

fix: remediate Dependabot alerts

1393235

github-actions Bot reviewed Jul 29, 2026

View reviewed changes

cursor Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread examples/typescript/zep-graph-visualization/package.json Outdated

Comment thread examples/typescript/zep-graph-visualization/package.json Outdated

fix: preserve JavaScript dependency compatibility

ff0d015

github-actions Bot reviewed Jul 29, 2026

View reviewed changes

danielchalef merged commit 1fabdbd into main Jul 29, 2026
20 checks passed

danielchalef deleted the danielchalef/fix-dependabot-issues-v1 branch July 29, 2026 18:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: remediate Dependabot alerts - #582

fix: remediate Dependabot alerts#582
danielchalef merged 2 commits into
mainfrom
danielchalef/fix-dependabot-issues-v1

danielchalef commented Jul 29, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

danielchalef commented Jul 29, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

socket-security Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

danielchalef commented Jul 29, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Jul 29, 2026 •

edited

Loading

socket-security Bot commented Jul 29, 2026 •

edited

Loading