chore(deps): bump the security-updates group across 1 directory with 2 updates

[dependabot]

Bumps the security-updates group with 2 updates in the / directory: langchain-core and pyopenssl.

Updates langchain-core from 1.2.20 to 1.2.22

Release notes

Sourced from langchain-core's releases.

langchain-core==1.2.22

Changes since langchain-core==1.2.21

release(core): 1.2.22 (#36201) fix(core): validate paths in prompt.save and load_prompt, deprecate methods (#36200)

langchain-core==1.2.21

Changes since langchain-core==1.2.20

release(core): 1.2.21 (#36179) fix(core,model-profiles): add missing ModelProfile fields, warn on schema drift (#36129) chore(core): remove stale blockbuster allowlist for deleted context module (#36168) ci: suppress pytest streaming output in CI (#36092)

Commits

• d22df94 release(core): 1.2.22 (#36201)
• 27add91 fix(core): validate paths in prompt.save and load_prompt, deprecate metho...
• 7563fce chore(model-profiles): refresh model profile data (#36195)
• 3e64c25 chore: use repo permissions instead of org membership for maintainer override...
• 1778b08 chore(partners): bump langchain-core min to 1.2.21 (#36183)
• ad574fc fix(openai): bump min core version (#36180)
• 19f81cf release(core): 1.2.21 (#36179)
• 6d07ef2 release(openai): 1.1.12 (#36178)
• 2f64d80 fix(core,model-profiles): add missing ModelProfile fields, warn on schema d...
• 5ffece5 chore(core): remove stale blockbuster allowlist for deleted context module (#...
• Additional commits viewable in compare view

Updates pyopenssl from 25.3.0 to 26.0.0

Changelog

Sourced from pyopenssl's changelog.

26.0.0 (2026-03-15)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Dropped support for Python 3.7.
• The minimum cryptography version is now 46.0.0.

Deprecations: ^^^^^^^^^^^^^

Changes: ^^^^^^^^

• Added support for using aws-lc instead of OpenSSL.
• Properly raise an error if a DTLS cookie callback returned a cookie longer than DTLS1_COOKIE_LENGTH bytes. Previously this would result in a buffer-overflow. Credit to dark_haxor for reporting the issue. CVE-2026-27459
• Added OpenSSL.SSL.Connection.get_group_name to determine which group name was negotiated.
• Context.set_tlsext_servername_callback now handles exceptions raised in the callback by calling sys.excepthook and returning a fatal TLS alert. Previously, exceptions were silently swallowed and the handshake would proceed as if the callback had succeeded. Credit to Leury Castillo for reporting this issue. CVE-2026-27448

Commits

• 358cbf2 Prepare for 26.0.0 release (#1487)
• a8d28e7 Bump actions/cache from 4 to 5 (#1486)
• 6fefff0 Add aws-lc compatibility to tests and CI (#1476)
• a739f96 Bump actions/download-artifact from 8.0.0 to 8.0.1 (#1485)
• 8b4c66b Bump actions/upload-artifact in /.github/actions/upload-coverage (#1484)
• 02a5c78 Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#1483)
• d973387 Bump actions/download-artifact from 7.0.0 to 8.0.0 (#1482)
• 57f09bb Fix buffer overflow in DTLS cookie generation callback (#1479)
• d41a814 Handle exceptions in set_tlsext_servername_callback callbacks (#1478)
• 7b29beb Fix not using a cryptography wheel on uv (#1475)
• Additional commits viewable in compare view

---

Note

Medium Risk
Dependency lockfile changes include a major pyopenssl upgrade and multiple version shifts (including downgrades), which can affect TLS/crypto behavior and runtime compatibility across networked integrations.

Overview
Updates uv.lock dependency resolutions, including bumps for security-related packages (pyopenssl 25.3.0 → 26.0.0, langchain-core 1.2.20 → 1.2.22).

Also adjusts other resolved versions (notably snowflake-connector-python 4.3.0 → 4.4.0, plus downgrades of aiohttp 3.13.5 → 3.13.4 and couchbase 4.6.0 → 4.5.0) and adds uv resolution options (exclude-newer / exclude-newer-span) to pin resolution timing.

^{Written by Cursor Bugbot for commit d52db59. This will update automatically on new commits. Configure here.}