@n8n/n8n-nodes-langchain

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

cornelius_n8n_ion8n-matsuuutomin8njan_n8n_ion8n-charliekolb

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:oracledb	AI (phantom-deps): Optional database integration; phantom dep pattern is stable for this plugin package.	ai	2026/07/07
phantom-deps	phantom-dep:@langchain/google-common	AI (phantom-deps): Optional LangChain integration; phantom dep pattern is stable for this plugin package.	ai	2026/07/07
phantom-deps	phantom-dep:@langchain/langgraph-checkpoint	AI (phantom-deps): Config-referenced LangChain integration dependency; stable pattern for this package.	ai	2026/07/07
phantom-deps	phantom-dep:@langchain/langgraph	AI (phantom-deps): Config-referenced LangChain integration dependency; stable pattern for this package.	ai	2026/07/07
phantom-deps	phantom-dep:@n8n/errors	AI (phantom-deps): Same-org scoped package; stable pattern for n8n internal dependencies.	ai	2026/07/07
maintainer-change	maintainer-removed	AI (maintainer-change): Old username removed as part of org rename; not a takeover.	ai	2026/07/06
phantom-deps	phantom-dep:axios	AI (phantom-deps): axios is now a declared runtime dep; phantom-dep is a false positive for this package.	ai	2026/07/06
maintainer-change	maintainer-added	AI (maintainer-change): Internal n8n org rename; same person, different username format.	ai	2026/07/06
source-diff	source-size-tripled	AI (source-diff): Size growth matches 14 new runtime deps and 2491 new source files for new AI provider integrations; SLSA provenance confirms CI build.	ai	2026/06/18
publish-pattern	rapid-publish	AI (publish-pattern): n8n uses automated CI/CD releases; rapid successive publishes are normal for this package.	ai	2026/05/30
phantom-deps	phantom-dep:mysql2	AI (phantom-deps): mysql2 is a declared optional/peer dep for MySQL vector store support; phantom-dep heuristic is a false positive here.	ai	2026/05/30
publish-pattern	new-deps-added	AI (publish-pattern): New deps are feature-driven integrations for a large LangChain node package; consistent with its expansion pattern across 351 versions.	ai	2026/05/29
source-diff	large-new-source-files	AI (source-diff): New files are tokenizer JSON data and node implementations consistent with package scope.	ai	2026/05/24
dependencies	unvetted-dep:@getzep/zep-cloud	AI (dependencies): Zep Cloud memory integration; expected dep.	ai	2026/05/23
dependencies	unvetted-dep:@n8n/typescript-config	AI (dependencies): n8n-scoped TS config; same org, expected dev dep.	ai	2026/05/23
dependencies	unvetted-dep:@microsoft/agents-a365-notifications	AI (dependencies): Microsoft Agents SDK integration; expected dep for MicrosoftAgent365 node.	ai	2026/05/23
dependencies	unvetted-dep:@microsoft/agents-a365-observability	AI (dependencies): Microsoft Agents SDK integration; expected dep for MicrosoftAgent365 node.	ai	2026/05/23
dependencies	unvetted-dep:@n8n/typeorm	AI (dependencies): n8n-scoped TypeORM fork; expected stable dep for this package.	ai	2026/05/23
dependencies	unvetted-dep:@getzep/zep-js	AI (dependencies): Zep memory integration; legitimate dep for LangChain nodes package.	ai	2026/05/23
dependencies	unvetted-dep:@langchain/groq	AI (dependencies): Official LangChain Groq integration; expected dep.	ai	2026/05/23
dependencies	unvetted-dep:@xata.io/client	AI (dependencies): Xata vector store integration; expected dep for this package.	ai	2026/05/23
dependencies	unvetted-dep:generate-schema	AI (dependencies): Utility dep for schema generation; stable for this package.	ai	2026/05/23
phantom-deps	phantom-dep:tmp-promise	AI (phantom-deps): Utility dep; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@microsoft/agents-a365-runtime	AI (phantom-deps): New Microsoft Agent365 integration dep; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@microsoft/agents-a365-notifications	AI (phantom-deps): New Microsoft Agent365 integration dep; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@microsoft/agents-a365-tooling-extensions-langchain	AI (phantom-deps): New Microsoft Agent365 integration dep; stable false positive.	ai	2026/05/12
bogus-package	bogus-package	AI (bogus-package): Official n8n package; short README and no keywords are expected for a monorepo sub-package.	ai	2026/05/12
phantom-deps	phantom-dep:@aws-sdk/client-sso-oidc	AI (phantom-deps): AWS SDK transitive dep loaded by convention; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@n8n/typescript-config	AI (phantom-deps): Same-org build config package; phantom-dep is expected and benign.	ai	2026/05/12
phantom-deps	phantom-dep:@google/generative-ai	AI (phantom-deps): Google AI integration dep; declared correctly.	ai	2026/05/12
phantom-deps	phantom-dep:@getzep/zep-cloud	AI (phantom-deps): Zep cloud integration; declared correctly.	ai	2026/05/12
phantom-deps	phantom-dep:@getzep/zep-js	AI (phantom-deps): Zep memory integration; declared correctly.	ai	2026/05/12
phantom-deps	phantom-dep:mime-types	AI (phantom-deps): Stable false positive; used in document loaders.	ai	2026/05/12
phantom-deps	phantom-dep:langchain	AI (phantom-deps): Core langchain dep; declared correctly, phantom-dep heuristic is a false positive.	ai	2026/05/12
phantom-deps	phantom-dep:cohere-ai	AI (phantom-deps): Cohere integration dep; declared correctly, phantom-dep heuristic is a false positive.	ai	2026/05/12
phantom-deps	phantom-dep:ignore	AI (phantom-deps): Stable false positive for this package; used in config/build tooling.	ai	2026/05/12
phantom-deps	phantom-dep:d3-dsv	AI (phantom-deps): Used by document loaders; declared correctly, phantom-dep is a false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:pg	AI (phantom-deps): pg is a transitive/optional dep used by MemoryPostgresChat; phantom-dep heuristic fires but it's legitimately declared.	ai	2026/05/12