fix(security): bump python-dotenv 1.2.1->1.2.2, suppress langchain-text-splitters SSRF (ENG-14769/14677) (#28)

- python-dotenv >=1.2.2 floor pin (CVE-2026-28684 — symlink file overwrite)
- osv-scanner.toml: suppress GHSA-fv5p-p927-qmxr (langchain-text-splitters SSRF; fix requires 1.1.2 which needs langchain-core>=1.2.31, incompatible with langchain-community 0.3.x ecosystem)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: andriy-sudo

langchain/poetry.lock

@@ -33,6 +33,7 @@ orjson = ">=3.11.6"
 requests = ">=2.33.0"
 pygments = ">=2.20.0"
 aiohttp = ">=3.13.5"
+python-dotenv = ">=1.2.2"
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "T201"]

langchain/pyproject.toml

@@ -1,3 +1,8 @@
+[[IgnoredVulns]]
+id = "GHSA-fv5p-p927-qmxr"
+ignoreUntil = "2026-07-24T00:00:00Z"
+reason = "langchain-text-splitters SSRF redirect bypass in HTMLHeaderTextSplitter.split_text_from_url (MEDIUM). Fix requires langchain-text-splitters>=1.1.2 which requires langchain-core>=1.2.31 — a breaking major change. langchain-community 0.3.x hard-constrains langchain-core<1.0.0, making a semver-compatible upgrade impossible. HTMLHeaderTextSplitter is not used by langchain-agentql. Related: ENG-14677."
+
 [[IgnoredVulns]]
 id = "GHSA-2g6r-c272-w58r"
 ignoreUntil = "2026-06-15T00:00:00Z"