[mfortman11]

Fixes
(CVE-2026-93748)[https://github.com/advisories/GHSA-ch52-4w7c-c8xp]
(CVE-2026-93753)[https://github.com/advisories/GHSA-gcqx-w48m-w2h4]

Summary by CodeRabbit

• Chores
  • Updated documentation tooling to identify unexpected use of an unused dependency during imports. This change affects documentation maintenance and does not alter the product’s user-facing features or behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: langflow-ai/openrag/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 216c7219-9635-4bb0-968d-5e67dc72374f

📥 Commits

Reviewing files that changed from the base of the PR and between f45a603 and f169061.

⛔ Files ignored due to path filters: 1

• docs/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 3

• docs/package.json
• docs/stubs/deepmerge-unused/index.js
• docs/stubs/deepmerge-unused/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The docs package now resolves deepmerge to a local stand-in package. The stand-in identifies its role in its manifest and throws an error if imported.

Changes

Docs dependency override

Layer / File(s)	Summary
Override and import guard docs/package.json, docs/stubs/deepmerge-unused/*	The docs package adds a local deepmerge dependency and override. The stand-in package manifest identifies its role, and its entry point throws an error when imported.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested labels: bug

Suggested reviewers: lucaseduoli

Merge Risk: ⚪ Minimal · up to f1690

The docs override uses a synchronized local stand-in, and the inspected build path does not import it. No actionable merge risk is evident.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the pull request as maintenance work to address overdue CVEs, which matches the stated objective to fix CVE-2026-93748 and CVE-2026-93753.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

[VisveshJ]

lgtm