GHSA-47pj-3jcm-6whg: LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters. Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient. We have no evidence of this behavior being exploited in the wild. Affected users / systems You may be affected if you: - use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and - rely on the namespace to separate data between users or tenants, and - have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or % Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected. Three distinct cases were possible: - Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",). - Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",). - Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice. This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value *was itself* a LIKE pattern whose metacharacters were not neutralized. Impact - Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user bounda