📦 chore: Patch axios to address CVE-2025-27152 (#6222)

* 📦 chore: remove `langchain` (no longer used)

* chore: patch `axios` to address CVE-2025-27152

api/package.json

@@ -40,14 +40,15 @@
     "@googleapis/youtube": "^20.0.0",
     "@keyv/mongo": "^2.1.8",
     "@keyv/redis": "^2.8.1",
-    "@langchain/community": "^0.3.14",
+    "@langchain/community": "^0.3.34",
     "@langchain/core": "^0.3.40",
     "@langchain/google-genai": "^0.1.9",
     "@langchain/google-vertexai": "^0.2.0",
     "@langchain/textsplitters": "^0.1.0",
     "@librechat/agents": "^2.2.0",
+    "@librechat/data-schemas": "*",
     "@waylaidwanderer/fetch-event-source": "^3.0.1",
-    "axios": "1.7.8",
+    "axios": "^1.8.2",
     "bcryptjs": "^2.4.3",
     "cohere-ai": "^7.9.1",
     "compression": "^1.7.4",
@@ -74,9 +75,7 @@
     "keyv": "^4.5.4",
     "keyv-file": "^0.2.0",
     "klona": "^2.0.6",
-    "langchain": "^0.2.19",
     "librechat-data-provider": "*",
-    "@librechat/data-schemas": "*",
     "librechat-mcp": "*",
     "lodash": "^4.17.21",
     "meilisearch": "^0.38.0",

package.json

@@ -114,6 +114,7 @@
     "elliptic": "^6.6.1"
   },
   "overrides": {
+    "axios": "1.8.2",
     "elliptic": "^6.6.1",
     "mdast-util-gfm-autolink-literal": "2.0.0",
     "remark-gfm": {

packages/data-provider/package.json

@@ -39,7 +39,7 @@
   },
   "homepage": "https://librechat.ai",
   "dependencies": {
-    "axios": "^1.7.7",
+    "axios": "^1.8.2",
     "js-yaml": "^4.1.0",
     "zod": "^3.22.4"
   },