From 3854f51547312cebbe2a4849b0272fccc121a921 Mon Sep 17 00:00:00 2001
From: Rafal Lagowski <423235+rafeekpro@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:35:03 +0200
Subject: [PATCH] fix(deps): langgraph-checkpoint-sqlite 3.1.0 -> 3.1.1
 (PYSEC-2026-3636)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI run #1734 failed pip-audit on branch chore/sync-pr-review-gate (#868), which
carries a two-line gate sync and nothing else — the advisory landed after the
last green run on develop and now blocks an unrelated PR.

Same shape and same remedy as the postgres sibling in 8f3db0e. The direct
requirement in apps/engine is `langgraph-checkpoint-sqlite>=2.0.0`, which
resolved happily to the vulnerable 3.1.0, so the floor goes in the `constraints`
list beside the other advisory floors rather than being tightened at the
requirement — one list, read in one place, when the next advisory lands. That is
the convention the langgraph-checkpoint / langsmith / msgpack entries already
established.

Verified with the exact command CI runs (`uv run pip-audit --ignore-vuln
PYSEC-2025-183`) after `uv sync --all-packages --frozen`: "No known
vulnerabilities found". The two skipped rows (code-review-council, dap-database)
are the workspace's own packages — local, not on PyPI, skipped as designed.

uv.lock: langgraph-checkpoint-sqlite 3.1.0 -> 3.1.1, no other resolution moved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/engine/pyproject.toml | 6 ++++++
 uv.lock                    | 7 ++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/apps/engine/pyproject.toml b/apps/engine/pyproject.toml
index bfac3bbe..d9c9ebf1 100644
--- a/apps/engine/pyproject.toml
+++ b/apps/engine/pyproject.toml
@@ -59,6 +59,12 @@ dependencies = [
     # resolutions.
     # langgraph-checkpoint >= 4.1.1 — CVE-2026-48775
     "langgraph-checkpoint>=4.1.1",
+    # langgraph-checkpoint-sqlite >= 3.1.1 — PYSEC-2026-3636. Same shape and same
+    # remedy as the postgres sibling in 8f3db0e: the direct requirement above is
+    # `>=2.0.0`, which resolved happily to the vulnerable 3.1.0, so the floor goes
+    # HERE where the other advisories live rather than being tightened up there —
+    # one list, read in one place, when the next advisory lands.
+    "langgraph-checkpoint-sqlite>=3.1.1",
     # langsmith >= 0.8.18 — GHSA-f4xh-w4cj-qxq8
     "langsmith>=0.8.18",
     # msgpack >= 1.2.1 — GHSA-6v7p-g79w-8964
diff --git a/uv.lock b/uv.lock
index 995187cd..592717ad 100644
--- a/uv.lock
+++ b/uv.lock
@@ -589,6 +589,7 @@ requires-dist = [
     { name = "langgraph-checkpoint", specifier = ">=4.1.1" },
     { name = "langgraph-checkpoint-postgres", specifier = ">=2.0" },
     { name = "langgraph-checkpoint-sqlite", specifier = ">=2.0.0" },
+    { name = "langgraph-checkpoint-sqlite", specifier = ">=3.1.1" },
     { name = "langsmith", specifier = ">=0.8.18" },
     { name = "msgpack", specifier = ">=1.2.1" },
     { name = "packaging", specifier = ">=24.0" },
@@ -1181,16 +1182,16 @@ wheels = [
 
 [[package]]
 name = "langgraph-checkpoint-sqlite"
-version = "3.1.0"
+version = "3.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiosqlite" },
     { name = "langgraph-checkpoint" },
     { name = "sqlite-vec" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e3/ea/83917c2369acf8a10a894d4247655fd063c07924ba5bc4e83c85d2eaeded/langgraph_checkpoint_sqlite-3.1.0.tar.gz", hash = "sha256:f926916ebc1b985d802cc9c820026036e84db9d910d62c97b57e4ba64f67d5ae", size = 147902, upload-time = "2026-05-12T03:34:52.503Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/54/b1/26fef7572c4fce0322740ef3fcee471510028355d4d4c1d800f0fd432d73/langgraph_checkpoint_sqlite-3.1.1.tar.gz", hash = "sha256:6fcb20db4c37ef7aad52f29b539eb98c38e2dad6fab7c2446a2a9db24f37a70e", size = 146805, upload-time = "2026-07-30T19:19:37.516Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/97/07/b342811a16327900af2747c752ea19676172fcddf9b592cc384031076623/langgraph_checkpoint_sqlite-3.1.0-py3-none-any.whl", hash = "sha256:cc9b40df0076feae8a9ad42ae713621b148b00ac23adc09dc1dc66090a46e5ad", size = 38587, upload-time = "2026-05-12T03:34:51.231Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/b9/e458601a1718337839bcfeec9d1b27b8b16ce135be2bd50ed0395d33a878/langgraph_checkpoint_sqlite-3.1.1-py3-none-any.whl", hash = "sha256:8505c54c94a658080525d7e6780fdd4e0c078ff2566b30d399c02cc9f9af1c63", size = 40785, upload-time = "2026-07-30T19:19:36.424Z" },
 ]
 
 [[package]]