Vulnerable Go dependencies in langchain/langgraph-api:3.14 core-api-grpc

Checked other resources

• This is a bug, not a usage question.
• I added a clear and descriptive title that summarizes this issue.
• I used the GitHub search to find a similar question and didn't find it.
• I am sure that this is a bug in LangGraph rather than my code.
• The bug is not resolved by updating to the latest stable version of LangGraph (or the specific integration package).
• This is not related to the langchain-community package.
• I posted a self-contained, minimal, reproducible example. A maintainer can copy it and run it AS IS.

Related Issues / PRs

No related public LangGraph issue or pull request found.

Reproduction Steps / Example Code (Python)

import subprocess

image = (
    "langchain/langgraph-api:3.14@"
    "sha256:647a0a639deabf60a6ab3a73b6f306cd96ddbd9815643d123a60c0f42c3ed905"
)

subprocess.run(["docker", "pull", image], check=True)
subprocess.run(
    [
        "trivy",
        "image",
        "--scanners",
        "vuln",
        "--severity",
        "HIGH",
        image,
    ],
    check=True,
)

Error Message and Stack Trace (if applicable)

No Python exception or stack trace is produced. This is a container-image
vulnerability finding.

The scan attributes the findings to:

/usr/local/bin/core-api-grpc

Embedded Go dependencies reported:

golang.org/x/crypto
- Installed versions: v0.53.0 and v0.54.0
- Fixed version: v0.56.0
- CVE-2026-56854
- CVE-2026-56855
- CVE-2026-78662

google.golang.org/grpc
- Installed version: v1.82.1
- Fixed version: v1.83.1
- CVE-2026-84304
- CVE-2026-84445

Description

The official langchain/langgraph-api:3.14 container image contains vulnerable Go dependencies embedded in /usr/local/bin/core-api-grpc.

Affected image:

langchain/langgraph-api:3.14 sha256:647a0a639deabf60a6ab3a73b6f306cd96ddbd9815643d123a60c0f42c3ed905

core-api-grpc is supplied by the LangGraph base image and is not built or declared by applications deriving from this image. Consequently, downstream users cannot update these Go modules directly.

Expected behavior:

The published image should contain a rebuilt core-api-grpc using:

• golang.org/x/crypto >= v0.56.0
• google.golang.org/grpc >= v1.83.1

Current behavior:

Container vulnerability scanners report the older embedded versions and the HIGH-severity CVEs listed above.

Could you please publish a patched image and provide its tag and digest? Please also provide an estimated release date or recommended temporary mitigation.

System Info

System Information

OS: Linux OS Version: #1 SMP Sat May 17 08:28:57 UTC 2025 Python Version: 3.14.7 (main, Aug 31 2026, 23:42:40) [GCC 14.2.0]

Package Information

langchain_core: 1.4.8 langsmith: 0.8.18 langchain_protocol: 0.0.18 langgraph_api: 0.14.1 langgraph_grpc_common: 0.1.0 langgraph_sdk: 0.4.4

Optional packages not installed

deepagents deepagents-cli

Other Dependencies

cloudpickle: 3.1.2 cryptography: 50.0.0 grpcio: 1.81.1 grpcio-health-checking: 1.81.1 grpcio-tools: 1.81.1 httptools: 0.7.1 httpx: 0.28.1 jsonpatch: 1.33 jsonschema-rs: 0.44.1 langgraph: 1.2.6 langgraph-checkpoint: 4.2.0 opentelemetry-api: 1.42.1 opentelemetry-exporter-otlp-proto-http: 1.42.1 opentelemetry-exporter-prometheus: 0.63b1 opentelemetry-sdk: 1.42.1 orjson: 3.11.9 packaging: 26.2 prometheus-client: 0.25.0 protobuf: 6.33.6 pydantic: 2.13.4 pyjwt: 2.13.0 pyyaml: 6.0.3 requests: 2.34.2 requests-toolbelt: 1.0.0 sse-starlette: 3.3.4 starlette: 1.3.1 structlog: 25.5.0 tenacity: 9.1.4 truststore: 0.10.4 typing-extensions: 4.15.0 uuid-utils: 0.16.2 uvicorn: 0.47.0 uvloop: 0.22.1 watchfiles: 1.2.0 websockets: 15.0.1 xxhash: 3.7.0 zstandard: 0.25.0