dependency-review

<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. --> <!-- SPDX-License-Identifier: Apache-2.0 -->

LangChain Deep Agents Code Dependency Review

This file records the reviewed dependency baseline for the Deep Agents Code sandbox base image. Update it whenever `requirements.lock` changes.

• Lockfile: `agents/langchain-deepagents-code/requirements.lock`
• Lockfile SHA-256: `7f63e63a256ec1a5e708e9db0d6f406069cf08b6dfba2979f3c0360e828ef3c3`
• Audit command: `uv tool run --python 3.13 pip-audit -r agents/langchain-deepagents-code/requirements.lock --progress-spinner off --disable-pip`
• Audit date: October 3, 2026
• Targeted audit result: `aiohttp 3.14.3, cryptography 50.0.0, uv 0.11.33, langgraph-checkpoint-sqlite 3.1.1, MCP 2.0.0, Pillow 12.3.0, and pyasn1 0.6.4 have no known vulnerabilities`
• Complete-lock audit result: `No known vulnerabilities found`

The Dockerfile installs this lockfile with `pip3 install --require-hashes`, so this review covers the exact package versions selected for the managed image install. The lock now selects `aiohttp==3.14.3`, `cryptography==50.0.0`, `uv==0.11.33`, `langgraph-checkpoint-sqlite==3.1.1`, `mcp==2.0.0`, `Pillow==12.3.0`, and `pyasn1==0.6.4`. These selections clear `GHSA-cq5v-8q36-5273`, `GHSA-g6cj-pr64-35w5`, and `GHSA-47pj-3jcm-6whg`. The direct `langgraph-checkpoint-sqlite==3.1.1` requirement is a hash-locked security constraint for `GHSA-47pj-3jcm-6whg`. Remove it when the selected Deep Agents Code graph resolves `3.1.1` or later without the direct constraint and the complete-lock audit remains clear. The Deep Agents Code selector is the published `0.1.71` release at commit `d1674e602f7883a5e5ccce5312b7c8d297f3b36d`. Its reviewed wheel is `deepagents_code-0.1.71-py3-none-any.whl` with SHA-256 `9a4de608fe31efa4ba1f5478e77464af9fd7b6609f6a3ed1b5f42e454f3cbf7d`; the corresponding source archive has SHA-256 `17de53006896f341c27ee8b9ab3b074ac994bbac0189eb2db77212f9a79129ee`. This semantic migration from `0.1.55` through `0.1.71` crosses the mapped MCP, TUI, tool-streaming, plugin-wait, and harness-profile contracts. MCP `2.0.0` satisfies the new consumer requirement while retaining Host/Origin validation. The managed patch follows the renamed MCP discovery function, the shared server environment builder, the module entrypoint import, and all six package-mutation subprocess sites. These changes retain the managed hook, approval, credential, update, and startup-mode guards at the NemoClaw launcher and exact-version package-patch boundaries.

The image build runs `pip3 check` and asserts all eight installed package versions, including Deep Agents Code itself, before publishing. The audit includes the updated `httpx2==2.13.1`, `pyjwt==2.15.1`, `setuptools==84.0.0`, `soupsieve==2.10`, and `urllib3==2.8.0` selections. The complete lock has no known vulnerabilities in the audit database on the recorded date.

Managed QuickJS Wasmtime Configuration

Deep Agents Code `0.1.71` selects `langchain-quickjs==0.3.5`, `quickjs-rs==0.2.5`, and `wasmtime==46.0.1`. The released `quickjs-rs` package creates a default Wasmtime engine. On Linux, Wasmtime's default copy-on-write linear-memory initialization creates `wasm-memory-image` with `memfd_create` flags `MFD_CLOEXEC | MFD_ALLOW_SEALING`. OpenShell blocks that syscall in the managed sandbox, so the first interactive model turn fails when Deep Agents initializes its JavaScript interpreter.

The managed image patches the exact `quickjs-rs==0.2.5` engine constructor to set `Config.memory_init_cow = False`. This Wasmtime option uses ordinary memory initialization and does not require NemoClaw to weaken the OpenShell sandbox restriction. The image build rejects another `quickjs-rs` version or source shape. After patching, the image build runs `validate-quickjs-runtime.py` through the pinned LangChain REPL. It exercises the worker thread, OXC transform, async shell-tool bridge, snapshot restoration, and a second synchronous tool call. The live Deep Agents TUI check runs the same validator with `--require-memfd-denied` before its interactive sessions. That mode requires `EPERM` before importing Wasmtime, so cached artifacts cannot hide initialization failures. It adds no syscall permissions. The build and sandbox probes have bounded process deadlines, and failure messages omit third-party exception text.

PR #11972 first appears in release source at `v0.0.128`. The reopened #11847 report used `v0.0.127`, whose source does not contain the patch. That report does not establish a regression of the patch. Existing sandboxes require a rebuilt managed image; updating the host CLI alone does not patch installed packages.

Remove this patch when a reviewed `quickjs-rs` or Deep Agents Code release provides an equivalent non-memfd Wasmtime configuration and the live check passes through that upstream path.

Native NVIDIA Model Credentials

The hardened DCode model constructor ignores mutable `config.toml` credentials. For the root-owned `https://integrate.api.nvidia.com/v1` route, it reads the supervisor-provided `NVIDIA_INFERENCE_API_KEY` placeholder and requires that the complete placeholder names that environment variable. Missing values, real keys, and placeholders for other variables fail before constructing the model. OpenShell resolves the placeholder at its proxy; the model process receives no real inference key. Other managed routes retain the synthetic inference token. The constructor regression test exercises this installed package patch, including versioned placeholders, instead of relying on a configuration round trip.

Progressive MCP Tool Catalog Compatibility

Deep Agents Code `0.1.71` with LangChain `1.4.3` can supply `search_tools` with a `ToolRuntime.tools` view that omits loaded MCP tools. The next model request can still expose those tools, but a search against only the middleware runtime view reports no match and cannot disclose them.

NemoClaw own