085a07f569
feat(core): event based streaming ( #2314 )
...
All stream v2 changes consolidated.
---------
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-05-05 00:13:12 -07:00
fe09385cb1
chore(deps): bump the langchain group across 1 directory with 9 updates ( #2358 )
...
Bumps the langchain group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs ) |
`1.3.26` | `1.3.28` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.1.40` | `1.1.43` |
| [langchain](https://github.com/langchain-ai/langchainjs ) | `1.3.0` |
`1.3.5` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs ) |
`1.4.1` | `1.4.5` |
| [@langchain/groq](https://github.com/langchain-ai/langchainjs ) |
`1.1.5` | `1.2.0` |
| [@langchain/mistralai](https://github.com/langchain-ai/langchainjs ) |
`1.0.7` | `1.0.8` |
| [@langchain/ollama](https://github.com/langchain-ai/langchainjs ) |
`1.2.6` | `1.2.7` |
| [@langchain/classic](https://github.com/langchain-ai/langchainjs ) |
`1.0.27` | `1.0.32` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk ) | `0.5.20`
| `0.6.0` |
Updates `@langchain/anthropic` from 1.3.26 to 1.3.28
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/anthropic's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/anthropic</code><a
href="https://github.com/1 "><code>@1</code></a>.3.27</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10726 ">#10726</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ad153c185b6cf813d4b7695740d9a4453d2cb63f "><code>ad153c1</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(anthropic): add Claude Opus 4.7 compatibility updates</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7 "><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4 "><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.41</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.1.40 to 1.1.43
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.41</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10733 ">#10733</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7 "><code>589f29c</code></a>
Thanks <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a>! -
fix(core): Update inheritance behavior for tracer metadata for special
keys</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10711 ">#10711</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4 "><code>2e9e696</code></a>
Thanks <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a>! -
feat(core): Add chat model and llm invocation params to traced
metadata</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain` from 1.3.0 to 1.3.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">langchain's
releases</a>.</em></p>
<blockquote>
<h2>langchain@1.3.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10713 ">#10713</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/49ac9e7404e5a9269b9ac047711ee96dd928b231 "><code>49ac9e7</code></a>
Thanks <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a>! -
feat(langchain): Adds ls_agent_type to create agent runs as tracing
metadata</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7 "><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4 "><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.41</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386 ">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192 "><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle "><code>@Josh-Engle</code></a>! -
Prevent local file corruption when using <code>LocalFileStore</code></p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f "><code>d3e0809</code></a>]:</p>
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.40</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10693 ">#10693</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8 "><code>5a6e0ab</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(agents): derive middleware hook state from invocation state</p>
<p>Prevents middleware state from leaking across threads by deriving
middleware hook input state from the current invocation state instead of
cross-node cached state.</p>
</li>
</ul>
<h2>langchain@1.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10673 ">#10673</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f0693657b7e5bdbf888a46d04e68431e446c7bc0 "><code>f069365</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
bump langgraph dependency to 1.2.8</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6845a1ef129450cd6e75bb8a8e7390a416ab3d9c "><code>6845a1e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10690 ">#10690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8 "><code>5a6e0ab</code></a>
fix(agents): derive middleware hook state from invocation state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10693 ">#10693</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/607696e8143ad30faeebb800028e244a11d46638 "><code>607696e</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10696 ">#10696</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/1f8b2c0b863645da45114d8756dc5b66fcb43c98 "><code>1f8b2c0</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10695 ">#10695</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2ff51cf0688e45d5d237b2b435334b5fd987afa9 "><code>2ff51cf</code></a>
fix(aws): normalize Bedrock Converse object errors for tracing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10688 ">#10688</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4a91db32a80a1b9da3bea4f6333eff63980b28b4 "><code>4a91db3</code></a>
chore(deps): bump langsmith from 0.5.9 to 0.5.18 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10687 ">#10687</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/312d60536da66827791e9b0f4a9d5d9091439183 "><code>312d605</code></a>
chore(deps): bump axios from 1.13.6 to 1.15.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10686 ">#10686</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3e071bb44ec9c80a0eb964eff089434f4edd78b2 "><code>3e071bb</code></a>
chore: remove suppressed CodeQL query filter and deduplicate
paths-ignore (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e5b6e1c8568115cdda53eccafbdcd23537f554c5 "><code>e5b6e1c</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10682 ">#10682</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2 "><code>2301260</code></a>
fix(openai): add index to streaming reasoning content blocks for proper
chunk...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/langchain@1.3.0...@langchain/aws@1.3.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/openai` from 1.4.1 to 1.4.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/openai's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.4</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10681 ">#10681</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2 "><code>2301260</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(openai): add index to streaming reasoning content blocks for proper
chunk merging</li>
</ul>
<h2><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10670 ">#10670</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a "><code>6b8ef6c</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(openai): preserve plain string responses content</li>
</ul>
<h2><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10614 ">#10614</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1 "><code>d6bf4fc</code></a>
Thanks <a
href="https://github.com/colifran "><code>@colifran</code></a>! -
feat(openai): imput placeholder filenames for openai file inputs</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383 "><code>d3d0922</code></a>]:</p>
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/groq` from 1.1.5 to 1.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/groq's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/groq</code><a
href="https://github.com/1 "><code>@1</code></a>.2.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10603 ">#10603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/66effb028baf5c923501801c989c7377efb8b77a "><code>66effb0</code></a>
Thanks <a
href="https://github.com/apps/dependabot "><code>@dependabot</code></a>!
- chore(deps): bump groq-sdk from 0.37.0 to 1.1.2</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/daece6df71e0095c7a354270667a0b851a8cee4d "><code>daece6d</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10560 ">#10560</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9781bff525bffdd3b6a75adfa8a30fdb4bfc505e "><code>9781bff</code></a>
fix(google): align ChatGoogle mediaResolution with Gemini scalar type
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10550 ">#10550</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3bd85c17869e95d5d1a67c5fccc0c4cab2646616 "><code>3bd85c1</code></a>
feat(langchain): add ChatGoogle support to initChatModel (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10654 ">#10654</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383 "><code>d3d0922</code></a>
feat(core): support for headless tools (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10430 ">#10430</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/793bc69a8af8198de9d157c21070871660e6bb13 "><code>793bc69</code></a>
feat(aws): impute file name for document content blocks#963 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10658 ">#10658</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1 "><code>d6bf4fc</code></a>
feat(openai): impute placeholder filenames for openai file inputs (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10614 ">#10614</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0a7a7298b719f579854e41adddb04f17dc82640b "><code>0a7a729</code></a>
fix(examples): update dependencies (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10651 ">#10651</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6f8dafcb9deee169473eadaae6416ad255277a5b "><code>6f8dafc</code></a>
Bump vitest (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10649 ">#10649</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e89cfd29f36e0b2fee20a7443e6c30c88039d735 "><code>e89cfd2</code></a>
chore(deps): bump <code>@cloudflare/workers-types</code> from
4.20260207.0 to 4.20260402.1...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0de2c14d38716d9c66c546e18a490c5bfda75134 "><code>0de2c14</code></a>
chore(deps): bump <code>@aws-sdk/client-bedrock-agent-runtime</code>
from 3.1006.0 to 3.10...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/groq@1.1.5...@langchain/groq@1.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/mistralai` from 1.0.7 to 1.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/mistralai's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f "><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192 "><code>71e53f1</code></a>]:
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.40</li>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590 ">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28 "><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- feat: scaffold <code>@langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e "><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86 "><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e "><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383 "><code>d3d0922</code></a>]:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.28</li>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7ea8874715f76c17d3ec3d2ff0503dd12abbc5e9 "><code>7ea8874</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9716 ">#9716</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5707c3edc6a4d43934da0d3e7b9666b2fc144440 "><code>5707c3e</code></a>
docs(internal): add AGENTS.md file (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9742 ">#9742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8ef152555a945c95322f28209957b69605c04c91 "><code>8ef1525</code></a>
feat(google-common): support thinkingLevel parameter for Gemini models
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9738 ">#9738</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c28d24a8770f6d0e543cde116b0e38b3baf21301 "><code>c28d24a</code></a>
fix(core): use getBufferString for message summarization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9739 ">#9739</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6974516b041ed12befd26e1a4cbe457865a2780 "><code>f697451</code></a>
fix(langchain): keep tool call / AIMessage pairings when summarizing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9740 ">#9740</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/536c7ddacd6c7f80d2edf18ab9caeeab71827ccd "><code>536c7dd</code></a>
fix(langchain): default strict to true in providerStrategy for OpenAI
compati...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/75b3b90c5fa62cbbfa678dfb01f031caed4488ef "><code>75b3b90</code></a>
fix(openai): pass runManager to _streamResponseChunks in responses API
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9737 ">#9737</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/13c9d5bfa3acac7ffb37642e9a50d84dc9004e88 "><code>13c9d5b</code></a>
fix(openai): pass through provider-native content in ToolMessage without
stri...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5cfbedf064ffdc960cb2e5a97e37d7a5900560de "><code>5cfbedf</code></a>
fix(langchain): support callbacks property in stream (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9728 ">#9728</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9ac29de3d3f70c75933913d94ad9a47c6ce39c1d "><code>9ac29de</code></a>
fix(langchain-aws): add support for Amazon Nova embedding models (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9701 ">#9701</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/mistralai@1.0.7...@langchain/classic@1.0.8 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/ollama` from 1.2.6 to 1.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/ollama's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f "><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192 "><code>71e53f1</code></a>]:
<ul>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.40</li>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@langchain/neo4j</code><a
href="https://github.com/0 "><code>@0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590 ">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28 "><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- feat: scaffold <code>@langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e "><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86 "><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e "><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383 "><code>d3d0922</code></a>]:
<ul>
<li><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.28</li>
<li><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/bd72d8eb8bde1b2282c9ec88f2ebadd0747dc7b7 "><code>bd72d8e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9762 ">#9762</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/578574906bdbd9cfce95e34030c1a3d97e63d1c1 "><code>5785749</code></a>
fix(internal): fix changeset config (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9768 ">#9768</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/ddd72b8122e9dc68242b8467292bbee62e1dda2e "><code>ddd72b8</code></a>
chore(standard-tests): move standard-tests into ./internal (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9755 ">#9755</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/739d4e88cc78b8f578ab019b526c97d63d9c2144 "><code>739d4e8</code></a>
Feat/xai responses implementation (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9718 ">#9718</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e0360d9bdc0e7725d59625902bcfc98c39931e2a "><code>e0360d9</code></a>
fix(langchain): ensure models only make on write_todo call at a time (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9761 ">#9761</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8619adb81f16977b3ab8d4607ad5c30f79c41e3d "><code>8619adb</code></a>
fix: add properties to check valid props (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9757 ">#9757</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/23be5afd59b5f4806edef11937ce5e2ba300f7ee "><code>23be5af</code></a>
feat(langchain): consolidate type generics in bags (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9517 ">#9517</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/85820be04995b4047a798ec44da6077cd1908d7a "><code>85820be</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9754 ">#9754</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a46a24983fd0fea649d950725a2673b3c435275f "><code>a46a249</code></a>
fix(core): allow shared object references in serialization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9753 ">#9753</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3c8ba0d97f1c08e8f8c67ffddff5d57daba46f85 "><code>3c8ba0d</code></a>
chore(internal): Turborepo improvements (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9744 ">#9744</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/ollama@1.2.6...langchain@1.2.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/classic` from 1.0.27 to 1.0.32
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/classic's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.31</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386 ">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192 "><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle "><code>@Josh-Engle</code></a>! -
Prevent local file corruption when using
<code>LocalFileStore</code></li>
</ul>
<h2><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.30</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2 "><code>2301260</code></a>]:
<ul>
<li><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.4</li>
</ul>
</li>
</ul>
<h2><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a "><code>6b8ef6c</code></a>]:
<ul>
<li><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.3</li>
</ul>
</li>
</ul>
<h2><code>@langchain/classic</code><a
href="https://github.com/1 "><code>@1</code></a>.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10591 ">#10591</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e "><code>d7a98cd</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- feat: add <code>@langchain/perplexity</code> standalone provider
package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10594 ">#10594</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86 "><code>884c2d3</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- feat(fireworks): extract standalone provider package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10593 ">#10593</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e "><code>0fb6fa4</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- feat(together-ai): migrate Together AI into provider package</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1 "><code>d6bf4fc</code></a>]:</p>
<ul>
<li><code>@langchain/openai</code><a
href="https://github.com/1 "><code>@1</code></a>.4.2</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langsmith` from 0.5.20 to 0.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langsmith-sdk/releases ">langsmith's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(js): bump JS to 0.4.3 by <a
href="https://github.com/dqbd "><code>@dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2253 ">langchain-ai/langsmith-sdk#2253</a></li>
<li>Revert "feat: add js prompt caching" by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2258 ">langchain-ai/langsmith-sdk#2258</a></li>
<li>Revert "feat: Replace UUID5 with deterministic UUID7 for
replicas" by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2257 ">langchain-ai/langsmith-sdk#2257</a></li>
<li>release(js): bump to 0.4.4 by <a
href="https://github.com/dqbd "><code>@dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2259 ">langchain-ai/langsmith-sdk#2259</a></li>
<li>feat: add prompt cache back and setup environment tests by <a
href="https://github.com/langchain-infra "><code>@langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2260 ">langchain-ai/langsmith-sdk#2260</a></li>
<li>feat(python): Bump pydantic to v2 by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2248 ">langchain-ai/langsmith-sdk#2248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0 ">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0 </a></p>
<h2>v0.6.0rc0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(js): Add support for tracing AI SDK 6 by <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2237 ">langchain-ai/langsmith-sdk#2237</a></li>
<li>fix(js): Remove default Jestlike timeout by <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2243 ">langchain-ai/langsmith-sdk#2243</a></li>
<li>feat(js): Add support for tracing tool loop agent by <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2244 ">langchain-ai/langsmith-sdk#2244</a></li>
<li>feat: Replace UUID5 with deterministic UUID7 for replicas by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2249 ">langchain-ai/langsmith-sdk#2249</a></li>
<li>feat: add prompt caching to python sdk by <a
href="https://github.com/langchain-infra "><code>@langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2246 ">langchain-ai/langsmith-sdk#2246</a></li>
<li>feat: add js prompt caching by <a
href="https://github.com/langchain-infra "><code>@langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2251 ">langchain-ai/langsmith-sdk#2251</a></li>
<li>fix(claude): correctly parse llm and tool inputs in claude agent sdk
by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2255 ">langchain-ai/langsmith-sdk#2255</a></li>
<li>bump(python): 0.5.2 by <a
href="https://github.com/angus-langchain "><code>@angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2256 ">langchain-ai/langsmith-sdk#2256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0 ">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.6.0 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-04 22:42:09 -07:00
7f3320cda8
fix: patch 6 medium-severity security alerts ( #2333 )
...
## Security Alert Patch (medium-tier follow-up)
Follow-up to #2329 , which patched the critical+high tier. This PR
resolves the remaining **6 medium-severity Dependabot alerts** via
`pnpm.overrides` plus one published-path constraint bump. All fixes are
patch/minor bumps within the current major — no breaking changes.
### Packages Updated
| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |
|---------|---------------|----------------|----------|-------|---------------|
| `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved
1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts`
devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175
(cloud metadata exfiltration) |
| `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override);
resolved **3.4.0** | C (override) | dev-only (private
`@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS
bypasses FORBID_TAGS) |
| `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new
override); resolved **1.16.0** | C (override) | dev-only (via
`@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on
cross-domain redirect) |
| `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in
`libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest
bump)** | **published** — direct dep of `@langchain/langgraph-api` |
CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming
redaction bypass) |
| `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via
`@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19
<1` (new override) | C (override) | dev-only | same as above (flushes
vulnerable transitive copies) |
*Strategy C overrides follow the existing repo pattern — axios, qs,
undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and
defu are already overridden the same way.*
### Published-path rationale
`@langchain/langgraph-api` exercises `langsmith` at runtime for tracing
and streaming, which touches the affected internal code paths (lodash
`set()` prototype-pollution guard, token-event redaction). Therefore the
fix is Strategy A (raise the published lower bound) rather than
A-lockfile — this protects end users who pin `@langchain/langgraph-api`.
The lockfile already resolved `langsmith@0.5.20` before this change, so
installs are unchanged at HEAD; the bump is a downstream-safety
constraint tightening.
### Deferred (not fixed in this PR)
- **`protobufjs@6.11 .5`** (CRITICAL, CVE-2026-41242) — reached via
`@xenova/transformers@2.17 .2` in `libs/langgraph-core` devDeps +
examples. `@xenova/transformers` is abandoned; the successor is
`@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross
a breaking API boundary. **Upstream issue — requires a manual migration,
tracked separately.** (See #2329 body for full context.)
- **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) —
`first_patched_version` is `null`; upstream has not released a fix.
Defer until a patched version ships.
### CVE Details
- **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname
Normalization Bypass Leads to SSRF —
https://github.com/advisories/GHSA-3p68-rc4w-qgx5
- **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud
Metadata Exfiltration via Header Injection Chain —
https://github.com/advisories/GHSA-fvcv-3m26-pcqx
- **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS`
via short-circuit evaluation —
https://github.com/advisories/GHSA-39q2-94rc-95cp
- **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication
headers to cross-domain redirect targets —
https://github.com/advisories/GHSA-r4q5-vmmm-2653
- **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` —
https://github.com/advisories/GHSA-fw9q-39r9-c252
- **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass
output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv
### Linear Tickets
Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No
ticket IDs included in the title.
### Verification
- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — **No known vulnerabilities found**
- [x] `pnpm typecheck` on `libs/langgraph-api` — clean
- [x] No staged secrets (`gitleaks git --staged`)
🤖 Submitted by langster-patch
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-04-22 09:26:44 -07:00
076f7f81f0
fix: patch 7 security alerts (critical + high severity) ( #2329 )
...
## Security Alert Patch
Resolves **7 Dependabot security alerts** in the critical + high
severity tier via `pnpm.overrides` in the root `package.json`. All fixes
are patch/minor bumps within the current major — no breaking changes.
### Packages Updated
| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |
|---------|---------------|----------------|----------|-------|---------------|
| `protobufjs` | (transitive, resolved 7.5.4) | `>=7.5.5 <8` | C
(override) | dev-only (testcontainers chain + `@xenova/transformers`
devDeps) | CVE-2026-41242 |
| `basic-ftp` | (transitive, resolved 5.2.0) | `>=5.3.0 <6` | C
(override) | effectively dev-only (reached only via `@vitest/browser` —
an optional peerDep of vitest — through webdriverio→proxy-agent) |
GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg, CVE-2026-39983 |
| `vite` (7.x only) | (transitive via vitest peer, resolved 7.3.1) |
`>=7.3.2` | C (override, scoped to vite@7) | effectively dev-only (vite
is a peerDependency of vitest — end users supply their own vite) |
CVE-2026-39363, CVE-2026-39364 |
| `defu` | (transitive, resolved 6.1.4) | `>=6.1.5 <7` | C (override) |
dev-only (`internal/build` via tsdown) | CVE-2026-35209 |
*Strategy C (pnpm.overrides) follows the existing pattern in this repo —
axios, qs, undici, minimatch, brace-expansion, etc. are already
overridden the same way.*
### Side-effect Fixes
Bumping `vite@7` to 7.3.2 also resolves one **medium** alert that wasn't
in the primary batch:
- CVE-2026-39365 / GHSA-4w7w-66w2-5vf9 — vite Path Traversal in
Optimized Deps `.map` Handling
### Upstream / Design Issues (NOT fixed in this PR)
- **`protobufjs@6.11 .x`** persists in the dependency graph via
`@xenova/transformers@2.17 .2` (`libs/langgraph-core` devDep + 9 example
apps). `@xenova/transformers` is abandoned and rebranded as
`@huggingface/transformers@3`; a migration would be a separate manual
dev-only upgrade. The 6.x line is in devDependencies only and does not
ship to published package consumers. Dependabot may continue to flag the
6.x range because the advisory's `vulnerable_range` is `< 7.5.5`.
- **Published-path caveat for `basic-ftp` and `vite`:** Both transit
through `@langchain/langgraph-checkpoint-validation`'s
`dependencies.vitest`. However, `vite` is declared as a
**peerDependency** of vitest (end users supply their own), and
`basic-ftp` reaches end users only through `@vitest/browser` — an
**optional peerDependency** that users must explicitly opt into.
Overrides in this PR protect local dev and CI; end users of
`@langchain/langgraph-checkpoint-validation` are not exposed unless they
independently install and configure the browser-testing chain.
### Deferred (medium + low tier)
Per security-alert-patch policy, only the highest active severity tier
was patched in this PR. The following remain open and would be addressed
in a follow-up batch:
- 6 medium: axios ×2 (SSRF + cloud-metadata exfil — existing `axios:
>=1.13.5` override doesn't cover 1.15.0), dompurify, langsmith ×2,
follow-redirects
- 1 low: elliptic (no `first_patched_version` published — upstream has
not released a fix)
### Verification
- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — 0 critical, 0 high remaining (3 moderates =
the deferred medium alerts)
- [x] No staged secrets (gitleaks)
### Linear Tickets
Linear ticket lookup skipped — CLI not authenticated in this
environment. No ticket IDs included in title.
🤖 Submitted by langster-patch
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-04-20 21:47:08 -07:00
786fe03646
chore(deps): bump vite from 7.3.2 to 8.0.5 ( #2322 )
2026-04-20 20:07:04 -07:00
ac9947f64d
chore(deps): bump langsmith from 0.5.19 to 0.5.20 ( #2323 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.19 to 0.5.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-16 03:45:01 +00:00
a9db0172df
chore(deps): bump hono from 4.12.12 to 4.12.14 ( #2321 )
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.12 to 4.12.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases ">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.14</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Improper handling of JSX attribute names in hono/jsx SSR</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX attribute names
during server-side rendering, which could allow malformed attribute keys
to corrupt the generated HTML output and inject unintended attributes or
elements. GHSA-458j-xx4x-4375</p>
<h2>Other changes</h2>
<ul>
<li>fix(aws-lambda): handle invalid header names in request processing
(<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)
fa2c74fe</li>
</ul>
<h2>v4.12.13</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(types): infer response type from last handler in app.on
9-/10-handler overloads by <a
href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
<li>feat(trailing-slash): add <code>skip</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4862 ">honojs/hono#4862</a></li>
<li>feat(cache): add <code>onCacheNotAvailable</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4876 ">honojs/hono#4876</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 ">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba "><code>cf2d2b7</code></a>
4.12.14</li>
<li><a
href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee "><code>66daa2e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e "><code>fa2c74f</code></a>
fix(aws-lambda): handle invalid header names in request processing (<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779 "><code>3779927</code></a>
4.12.13</li>
<li><a
href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720 "><code>faa6c46</code></a>
feat(cache): add <code>onCacheNotAvailable</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4876 ">#4876</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d "><code>f23e97b</code></a>
feat(trailing-slash): add <code>skip</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4862 ">#4862</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb "><code>1aa32fb</code></a>
fix(types): infer response type from last handler in app.on 9- and
10-handler...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-15 19:45:00 -07:00
9102d526c8
fix(langgraph): propagate tracer metadata defaults from configurable ( #2315 )
...
## Summary
This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.
## Changes
### `@langchain/langgraph` (`libs/langgraph-core`)
- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
- `thread_id`
- `checkpoint_id`
- `checkpoint_ns`
- `task_id`
- `run_id`
- `assistant_id`
- `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
2026-04-15 18:48:41 -07:00
7da383a8e6
chore(deps-dev): bump vite from 7.3.1 to 7.3.2 ( #2297 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite )
from 7.3.1 to 7.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.3.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2 ">7.3.2</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161 ">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 ">09d8c90</a>)</li>
<li>backport <a
href="https://redirect.github.com/vitejs/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22162 ">#22162</a>)
(<a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 ">19db0f2</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160 ">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 ">f8103cc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999 "><code>cc383e0</code></a>
release: v7.3.2</li>
<li><a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 "><code>09d8c90</code></a>
fix: avoid path traversal with optimize deps sourcemap handler (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161 ">#22161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 "><code>f8103cc</code></a>
fix: check <code>server.fs</code> after stripping query as well (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160 ">#22160</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 "><code>19db0f2</code></a>
fix: backport <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162 ">#22162</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-16 01:43:26 +00:00
5a0d0d0155
chore(deps): bump langsmith from 0.5.18 to 0.5.19 ( #2319 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.18 to 0.5.19.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-14 16:51:50 -07:00
aa2cfc8bf7
chore(deps): bump langsmith from 0.5.16 to 0.5.18 ( #2307 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.16 to 0.5.18.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-10 13:58:27 -07:00
9c1e3278fe
chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 ( #2300 )
...
Bumps [@hono/node-server](https://github.com/honojs/node-server ) from
1.19.11 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases "><code>@hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
<h2>v1.19.12</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: ignore claude setting by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/314 ">honojs/node-server#314</a></li>
<li>fix: request draining for early 413 responses by <a
href="https://github.com/usualoma "><code>@usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/329 ">honojs/node-server#329</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 ">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90 "><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2 "><code>025c30f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9 "><code>6cdb5a7</code></a>
1.19.12</li>
<li><a
href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94 "><code>70250f7</code></a>
fix: request draining for early 413 responses (<a
href="https://redirect.github.com/honojs/node-server/issues/329 ">#329</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb "><code>cfc08b3</code></a>
chore: ignore claude setting (<a
href="https://redirect.github.com/honojs/node-server/issues/314 ">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 17:27:00 -07:00
96a92c01a6
chore(deps): bump hono from 4.12.7 to 4.12.12 ( #2301 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 14:34:47 -07:00
2b62610710
feat(sdk): support for headless tools ( #2281 )
2026-04-03 22:07:54 -07:00
90631859ba
fix: patch 7 security alerts (high+medium severity) ( #2282 )
...
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-04-04 03:43:41 +00:00
e72c8e769e
chore(deps-dev): bump the svelte group across 1 directory with 3 updates ( #2272 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-04-03 09:59:39 -07:00
2bb2ed4565
chore(deps): bump the vue group across 1 directory with 4 updates ( #2273 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-04-02 00:37:15 -07:00
271f9750f0
chore(deps): bump the langchain group across 1 directory with 7 updates ( #2270 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 23:59:19 -07:00
73ae630253
chore(deps): bump the angular group with 13 updates ( #2271 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 21:30:32 -07:00
4d2963c313
fix: patch 11 security alerts (critical+high severity) ( #2258 )
...
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-03-31 13:09:10 -07:00
d88f29ba25
chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt ( #2256 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com >
2026-03-30 18:08:00 -07:00
50d61a9e72
chore(deps): bump yaml from 2.8.2 to 2.8.3 ( #2246 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-26 14:02:32 -07:00
bdcf290198
fix(langgraph): clean up resolved checkpointer promises to reduce memory retention ( #2242 )
2026-03-26 17:15:20 +00:00
5460157725
Add Angular 21 to @angular/core peer dependency range ( #2217 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-19 23:10:38 -07:00
293cab1c55
fix(examples): react sdk dependency
2026-03-19 22:48:09 -07:00
963db6fbc7
fix(sdk): fetch subagent history ( #2191 )
2026-03-19 21:29:17 -07:00
bd02965cdf
fix(react/vue/svelte/angular): clean up Readme and dev deps ( #2214 )
2026-03-19 21:17:12 -07:00
b07b994043
chore(deps): bump @angular/compiler from 21.2.4 to 21.2.5 ( #2212 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 13:35:19 -07:00
a7f4935ca6
chore(deps): bump @angular/core from 21.2.4 to 21.2.5 ( #2211 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 13:18:53 -07:00
6d84e2b53d
chore(deps): bump @angular/core from 21.2.2 to 21.2.4 ( #2184 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-15 21:11:45 -07:00
7da8b64394
chore(deps): bump @angular/compiler from 21.2.2 to 21.2.4 ( #2185 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-15 20:56:30 -07:00
6816a610df
docs: add integration examples for ai elements and assistant-ui ( #2180 )
2026-03-13 08:09:35 -07:00
a8f1b9d26b
fix(checkpoint-redis): fix dependency ( #2181 )
2026-03-12 17:08:19 -07:00
98da019c92
fix(sdk): revert dependency between old SDK and new react package ( #2168 )
2026-03-10 23:41:03 -07:00
b518c474f6
fix(sdk): update deps ( #2162 )
2026-03-10 14:31:03 -07:00
5eb2a04b72
chore(deps): bump the minor-and-patch group across 1 directory with 4 updates ( #2160 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 14:01:30 -07:00
1c01ba202f
chore(deps): bump the angular group with 10 updates ( #2154 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 13:30:47 -07:00
b753879b68
chore(deps-dev): bump vitest-browser-svelte from 1.1.0 to 2.0.2 in the svelte group ( #2156 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 13:15:58 -07:00
023c3538fc
chore(deps-dev): bump vitest-browser-vue from 0.1.0 to 2.0.2 in the vue group ( #2157 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 13:15:47 -07:00
2897fb639b
chore(deps-dev): bump the react group with 2 updates ( #2158 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 13:15:30 -07:00
64ba35ea70
fix(vue): SDK improvements for Vue ( #2048 )
2026-03-10 12:43:03 -07:00
4bd9babc83
chore(deps): bump @hono/node-server from 1.19.9 to 1.19.10 ( #2047 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 12:06:34 -07:00
4b67893617
chore(deps-dev): bump svelte from 5.51.3 to 5.53.5 ( #2041 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 11:03:19 -07:00
b3bb75c970
chore(deps-dev): bump rollup from 4.55.3 to 4.59.0 ( #2046 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 11:02:59 -07:00
e70df6bb88
chore(deps): bump @angular/core from 20.3.16 to 20.3.17 ( #2044 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 11:02:46 -07:00
f752dd029f
chore(deps): bump hono from 4.11.7 to 4.12.4 ( #2043 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 11:01:31 -07:00
e051ef6aa8
feat(sdk): add vue, svelte, angular implementation of useStream hook ( #2001 )
...
Co-authored-by: Tat Dat Duong <david@duong.cz >
2026-03-10 10:48:46 -07:00
338199f878
chore(deps): bump hono from 4.11.10 to 4.12.4 ( #2029 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-06 14:11:11 -08:00
221da2dd01
chore(deps): bump tar from 7.5.8 to 7.5.10 ( #2033 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-05 19:44:29 -08:00
e39a55cea7
chore(deps): bump @hono/node-server from 1.19.9 to 1.19.10 ( #2030 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-05 14:33:20 -08:00
Christian Bromann