Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Here is the list of vulnerabilities fixed in thie PR:
CVE-2025-43859 — h11 0.14.0
Root cause: h11 is a transitive dependency of httpx
Fix: Updated httpx from ==0.25.0 to >=0.27.0 in both requirements.txt and mage_integrations/requirements.txt
Why: httpx 0.27.0+ includes h11 0.15.0+ which fixes the vulnerability
CVE-2024-5998 — langchain 0.1.6
Fix: Updated langchain from ==0.1.6 to >=0.2.5 in both requirements.txt and setup.py
Why: langchain 0.2.5+ fixes the pickle deserialization vulnerability
CVE-2024-5998 — langchain-community 0.0.19
Fix: Updated langchain-community from <0.0.20 to >=0.2.5 in both requirements.txt and setup.py
Why: langchain-community 0.2.5+ fixes the same pickle deserialization vulnerability
CVE-2024-8309 — langchain 0.1.6
Fix: Same as above - updated langchain to >=0.2.5
Why: langchain 0.3.0+ fixes the SQL injection vulnerability
CVE-2025-2828 — langchain-community 0.0.19
Fix: Same as above - updated langchain-community to >=0.2.5
Why: langchain-community 0.2.5+ fixes the denial of service vulnerability
CVE-2024-45187 — mage-ai 0.9.76
Fix: Updated mage-ai version from 0.9.76 to 0.9.77 in both mage_ai/server/constants.py and setup.py
Why: This addresses the mage-ai specific vulnerability
System-level vulnerabilities (Debian 12 Bookworm)
CVE-2023-5841 — libopenexr: Fixed in Debian 12 (Bookworm) - no action needed
CVE-2024-45187 — libxml2: Fixed in Debian 12 (Bookworm) - no action needed
How Has This Been Tested?
Build image success

Tested in Mage UI with pipeline run S3 read, transform and write to S3
Checklist
cc:
@wangxiaoyou1993