build(deps): Bump the npm-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the npm-dependencies group with 3 updates in the /actions/release/summarize-changelog directory: @langchain/anthropic, @langchain/openai and langchain.

Updates @langchain/anthropic from 1.5.4 to 1.5.5

Release notes

Sourced from @​langchain/anthropic's releases.

@​langchain/anthropic@​1.5.5

Patch Changes

• #11359 d36ec6a Thanks @​talarari! - fix(anthropic): preserve gateway cost on the native stream path

  convertAnthropicStream now surfaces an Anthropic-compatible gateway's numeric usage.cost at response_metadata.usage.cost, matching the chunk path. Token accounting in usage_metadata is unchanged.

Commits

• 242b986 chore: version packages (#11361)
• 2d1f744 chore(langchain): add missing changeset (#11363)
• f401396 feat(langchain): add langsmith gateway to initChatModel (#11362)
• d36ec6a fix(anthropic): preserve gateway cost on the native stream path (#11359)
• b0a61cf chore: version packages (#11343)
• 3fe4c43 fix(openai): include usage in response_metadata when system_fingerprint is ab...
• f08e0c6 fix(core,langchain): override instanceof where applicable (#11344)
• 18765b0 fix(langchain): exclude middleware-internal model calls from the message proj...
• 86978c0 fix(deps): update vulnerable transitive dependencies (#11335)
• See full diff in compare view

Updates @langchain/openai from 1.5.6 to 1.5.7

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.7

Patch Changes

• #11347 3fe4c43 Thanks @​talarari! - fix(openai): include usage in response_metadata when system_fingerprint is absent

Commits

• b0a61cf chore: version packages (#11343)
• 3fe4c43 fix(openai): include usage in response_metadata when system_fingerprint is ab...
• f08e0c6 fix(core,langchain): override instanceof where applicable (#11344)
• 18765b0 fix(langchain): exclude middleware-internal model calls from the message proj...
• 86978c0 fix(deps): update vulnerable transitive dependencies (#11335)
• See full diff in compare view

Updates langchain from 1.5.5 to 1.5.8

Release notes

Sourced from langchain's releases.

langchain@1.5.8

Patch Changes

• #11366 c068bbf Thanks @​hntrl! - fix(core,langchain): patch and release core, update peer dependencies

langchain@1.5.7

Patch Changes

• #11363 2d1f744 Thanks @​hntrl! - feat(langchain): add langsmith gateway to initChatModel- #11362

langchain@1.5.6

Patch Changes

• #11331 18765b0 Thanks @​thushanth-bengre-langchain! - fix(langchain): exclude middleware-internal model calls from the message projection

  Bookkeeping model calls made by summarizationMiddleware and toolEmulatorMiddleware no longer appear in run.messages or stream({ streamMode: "messages" }), and the summary summarizationMiddleware writes back to state is no longer projected as a new message. These calls remain observable via streamEvents({ version: "v2" }), identified by lc_source.

• #11344 f08e0c6 Thanks @​hntrl! - fix: apply [Symbol.hasInstance] method to all comparable properties using .isInstance()

  We have some internal schemas that rely on z.instanceof(). This uses a strict instanceof check which can conflict if there are multiple versions of core installed. This overrides the Symbol.hasInstance method to use the same logic as .isInstance() to compare objects at runtime.

Commits

• 3fedf7f chore: version packages (#11367)
• c068bbf fix(core,langchain): patch and release core, update peer dependencies (#11366)
• 242b986 chore: version packages (#11361)
• 2d1f744 chore(langchain): add missing changeset (#11363)
• f401396 feat(langchain): add langsmith gateway to initChatModel (#11362)
• d36ec6a fix(anthropic): preserve gateway cost on the native stream path (#11359)
• b0a61cf chore: version packages (#11343)
• 3fe4c43 fix(openai): include usage in response_metadata when system_fingerprint is ab...
• f08e0c6 fix(core,langchain): override instanceof where applicable (#11344)
• 18765b0 fix(langchain): exclude middleware-internal model calls from the message proj...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Hi, thank you for creating your PR, we will check it out very soon

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

TRIVY

Report Summary

┌──────────────────────────────────────────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│                                      Target                                      │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ actions/release/summarize-changelog/package-lock.json                            │    npm     │        1        │         -         │    -    │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                                                                       │ dockerfile │        -        │         0         │    -    │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/argocd-app-of-apps/ci/apps/ci-test/test-app-single-source/expected.yml     │ kubernetes │        -        │         0         │    -    │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/argocd-app-of-apps/ci/apps/ci-test/test-app/expected.yml                   │ kubernetes │        -        │         0         │    -    │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/argocd-app-of-apps/ci/manifests/ci-test/test-app-single-source/expected.y- │ kubernetes │        -        │         0         │    -    │
│ ml                                                                               │            │                 │                   │         │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ tests/argocd-app-of-apps/ci/manifests/ci-test/test-app/expected.yml              │ kubernetes │        -        │         0         │    -    │
└──────────────────────────────────────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


actions/release/summarize-changelog/package-lock.json (npm)
===========================================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                          │
├──────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤
│ deepmerge-ts │ CVE-2026-40345 │ HIGH     │ fixed  │ 7.1.5             │ 8.0.0         │ DeepmergeTS has stack exhaustion when merging recursive │
│              │                │          │        │                   │               │ object graphs                                           │
│              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-40345              │
└──────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────┘