381a9f64d0
chore: version packages ( #2445 )
...
This PR was opened by the [Changesets
release](https://github.com/changesets/action ) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @langchain/langgraph-checkpoint@1.0.3
### Patch Changes
- [#2352 ](https://github.com/langchain-ai/langgraphjs/pull/2352 )
[`14f2a79`](https://github.com/langchain-ai/langgraphjs/commit/14f2a796912e81d7f52f0a4f16747f6d0a269209 )
Thanks [@Nagendhra-web](https://github.com/Nagendhra-web )! -
fix(langgraph-checkpoint): block prototype pollution in MemorySaver via
reserved storage keys
`MemorySaver` previously embedded `thread_id`, `checkpoint_ns`,
`checkpoint_id`, and `task_id` directly into property accesses on the
nested plain objects `this.storage` and `this.writes`. A caller able to
shape any of those fields (every quickstart, tutorial, and test fixture
uses `MemorySaver` by default) could pass `"__proto__"`,
`"constructor"`, or `"prototype"` and have the subsequent assignment
mutate `Object.prototype`. From that point every plain object in the
process inherits the injected property, breaking `for...in` loops,
truthy short-circuits, and downstream serializers across unrelated code
paths. CWE-1321.
Adds an `assertSafeStorageKey` chokepoint applied at every public entry
that touches `storage` or `writes` (`put`, `putWrites`, `deleteThread`,
`getTuple`, `list`). The guard rejects non-string values, the empty
string (unless explicitly opted-in for `checkpoint_ns`), and the three
prototype-pollution keys. Behaviour for valid string identifiers is
unchanged.
## @langchain/langgraph-checkpoint-redis@1.0.6
### Patch Changes
- [#2350 ](https://github.com/langchain-ai/langgraphjs/pull/2350 )
[`1e73c6b`](https://github.com/langchain-ai/langgraphjs/commit/1e73c6b4630bbc4aa976eea4bfc33c4f753b7ee9 )
Thanks [@Nagendhra-web](https://github.com/Nagendhra-web )! -
fix(checkpoint-redis): block Redis KEYS / SCAN pattern injection via
top-level identifiers
`RedisSaver` and `ShallowRedisSaver` previously embedded `thread_id`,
`checkpoint_ns`, `checkpoint_id`, and `task_id` directly into Redis keys
and `client.keys(pattern)` calls with no validation. A caller able to
shape any of those fields (multi-tenant SDK deployments where the
`RunnableConfig` originates from request input, or webhook payloads that
flow into a persisted thread) could promote a string identifier into a
glob pattern (`*`, `?`, `[...]`) or escape character (`\`).
The most severe sink is `deleteThread`: a `threadId` of `*` issues
`client.keys("checkpoint:*:*")` followed by `client.del(...)`, deleting
every checkpoint in the database across every tenant. `getTuple`,
`list`, and `loadPendingWrites` are exposed to the same pattern via
the fallback paths that bypass the existing `escapeRediSearchTagValue`
defense.
Adds a single `assertSafeKeyComponent` helper exported from
`./utils.js` and applies it at every key-building site. The guard
asserts the value is a non-empty string (the empty `checkpoint_ns`
default is opt-in via `{ allowEmpty: true }`) and rejects the Redis
pattern meta-characters `* ? [ ] \`. The `:` delimiter is intentionally
permitted because LangGraph emits it as a legitimate part of
`checkpoint_ns` for subgraphs / nested graphs, where it only ever
appears as a literal in the key. Behavior for valid string identifiers
is unchanged.
## @langchain/langgraph-api@1.2.3
### Patch Changes
- [#2447 ](https://github.com/langchain-ai/langgraphjs/pull/2447 )
[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: fold forkFrom client-side and honor per-run
multitaskStrategy
The SDK now folds the ergonomic `forkFrom` option into
`config.configurable.checkpoint_id` before sending `run.start`, so the
agent server only ever accepts the single, legacy-compliant fork field
(`forkFrom` no longer hits the wire). The protocol-v2 reference servers
drop their top-level `forkFrom` normalization accordingly.
The protocol-v2 servers now honor the caller's `multitaskStrategy` per
run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead
of
hardcoding it, falling back to `enqueue` when omitted or unrecognized.
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )]:
- @langchain/langgraph-ui@1.2.3
## @langchain/langgraph-cli@1.2.3
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-api@1.2.3
## @langchain/langgraph-ui@1.2.3
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
## @langchain/langgraph-sdk@1.9.10
### Patch Changes
- [#2447 ](https://github.com/langchain-ai/langgraphjs/pull/2447 )
[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: fold forkFrom client-side and honor per-run
multitaskStrategy
The SDK now folds the ergonomic `forkFrom` option into
`config.configurable.checkpoint_id` before sending `run.start`, so the
agent server only ever accepts the single, legacy-compliant fork field
(`forkFrom` no longer hits the wire). The protocol-v2 reference servers
drop their top-level `forkFrom` normalization accordingly.
The protocol-v2 servers now honor the caller's `multitaskStrategy` per
run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead
of
hardcoding it, falling back to `enqueue` when omitted or unrecognized.
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
## @langchain/angular@1.0.10
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
## @langchain/react@1.0.10
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
## @langchain/svelte@1.0.10
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
## @langchain/vue@1.0.10
### Patch Changes
- [#2443 ](https://github.com/langchain-ai/langgraphjs/pull/2443 )
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom
Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
plain checkpoint id string and align protocol-v2 servers and docs.
- [#2448 ](https://github.com/langchain-ai/langgraphjs/pull/2448 )
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume
The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
prompts), which sequential `respond()` calls cannot handle.
`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
onto the run that services the `input.respond` command.
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
## @example/ai-elements@0.1.25
### Patch Changes
- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/react@1.0.10
## @examples/assistant-ui-claude@0.1.25
### Patch Changes
- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/react@1.0.10
## @examples/ui-angular@0.0.35
### Patch Changes
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
- @langchain/angular@1.0.10
## @examples/ui-multimodal@0.0.11
### Patch Changes
- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/react@1.0.10
## @examples/ui-react@0.0.11
### Patch Changes
- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9 ),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532 ),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d )]:
- @langchain/langgraph-sdk@1.9.10
- @langchain/react@1.0.10
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-05-29 00:08:20 -07:00
14f2a79691
fix(langgraph-checkpoint): block prototype pollution in MemorySaver via reserved storage keys ( #2352 )
...
## Summary
Closes a prototype-pollution sink (CWE-1321) in `MemorySaver`. A caller
able to shape `thread_id`, `checkpoint_ns`, `checkpoint_id`, or
`task_id` (every quickstart, tutorial, and test fixture uses
`MemorySaver` by default) can pass `\"__proto__\"`, `\"constructor\"`,
or `\"prototype\"` and have the subsequent property assignment mutate
`Object.prototype`.
The audit posted in #2346 (cc @etairl) listed *`__proto__` prototype
pollution in `MemorySaver`* among the unfiled findings from the same
security-review pass that produced #2337 . This PR confirms the finding
and closes it across all five entry points.
## Vulnerable sinks
`libs/checkpoint/src/memory.ts`:
| Method | Sink |
|---|---|
| `put` | `this.storage[threadId][checkpointNamespace][checkpoint.id] =
...` |
| `putWrites` | `this.writes[outerKey][innerKeyStr] = ...` (with
caller-controlled `taskId` flowing into `innerKeyStr`) |
| `deleteThread` | `delete this.storage[threadId]` |
| `getTuple` |
`this.storage[thread_id]?.[checkpoint_ns]?.[checkpoint_id]` |
| `list` | `this.storage[threadId]?.[checkpointNamespace]` plus
`Object.keys(this.storage[threadId] ?? {})` |
## Proof of concept
\`\`\`ts
import { MemorySaver } from \"@langchain/langgraph-checkpoint\";
const saver = new MemorySaver();
await saver.put(
{ configurable: { thread_id: \"__proto__\", checkpoint_ns: \"\" } },
/* checkpoint */ { id: \"cp-1\", v: 4, ts: new Date().toISOString(),
channel_values: {}, channel_versions: {}, versions_seen: {} } as any,
/* metadata */ { source: \"input\", step: 0, parents: {} } as any,
{}
);
// Object.prototype is now polluted; every plain object in the process
// inherits the injected key.
const probe: Record<string, unknown> = {};
console.log(\"polluted\" in probe); // true
console.log(probe[\"\"]); // the (formerly per-tenant) saved checkpoint
\`\`\`
Same shape works for `\"constructor\"` and `\"prototype\"`. Non-string
identifiers (`{ \$ne: null }`, arrays, numbers, booleans) reach the same
sinks unchecked.
## Severity
Proposed CVSS 3.1: **High**. `MemorySaver` is the default in every
quickstart and tutorial, and prototype pollution in Node.js is a
documented stepping stone to RCE through gadget chains in downstream
serializers, template engines, and dependency-resolution helpers.
Network-reachable, low-complexity, only the privilege the SDK already
grants to a caller.
## Fix
A single private `assertSafeStorageKey` helper in `memory.ts`, applied
at every public entry that touches `storage` or `writes` (15 call sites
across 5 methods). The guard:
* Asserts the value is a non-empty string (the documented empty
`checkpoint_ns` default is opt-in via `{ allowEmpty: true }`).
* Rejects the three prototype-pollution keys `__proto__`, `constructor`,
`prototype`.
* The `getTuple` and `list` read paths intentionally allow an empty or
undefined `checkpoint_id` so the documented \"fetch latest\" behaviour
continues to work; both paths still reject the magic keys.
\`\`\`ts
const POLLUTION_KEYS = new Set([\"__proto__\", \"constructor\",
\"prototype\"]);
function assertSafeStorageKey(
field: string,
value: unknown,
options: { allowEmpty?: boolean } = {}
): asserts value is string {
/* type check, empty check, pollution check, all with precise
diagnostics */
}
\`\`\`
The guard is a TypeScript `asserts` predicate so call-sites get type
narrowing for free and the compiler enforces that no later code path
uses an unvalidated identifier.
## Why this design
* Mirrors the chokepoint pattern used in PR #2349 (`MongoDBSaver`) and
PR #2350 (`RedisSaver` / `ShallowRedisSaver`). All three savers now
share the same defensive posture at their boundary.
* Single private function: it is impossible for a future call-site to
forget validation, and the `asserts` annotation surfaces missed sites at
compile time.
* No new dependencies, no API changes for valid inputs, no behaviour
change for any documented happy path.
## Test plan
* [x] 22 new tests in
`libs/checkpoint/src/tests/memory-pollution.test.ts` under
`describe(\"MemorySaver prototype-pollution guard\")`, parameterised
across all three pollution keys plus type / empty / accept paths for
every entry point. Includes a cross-test invariant (`afterEach`
snapshots `Object.getOwnPropertyNames(Object.prototype)`) that asserts
pollution did not actually occur even if the guard had been absent.
* [x] Existing checkpoint suite green (\`pnpm --filter
@langchain/langgraph-checkpoint test\`, 93 of 93 including the 22 new
ones).
* [x] Lint clean (\`oxlint\`, 0 warnings, 0 errors on the changed
files).
* [x] Format clean (\`oxfmt --check\`).
* [x] No new dependencies, no public API changes, no behaviour change
for valid string identifiers.
## Disclosure
Original finding credited to @etairl (audit posted in #2346 ). This PR
was prepared for coordinated public disclosure since the audit list is
already public. Happy to coordinate timing with a private GHSA if the
maintainers prefer.
Pairs with the two earlier sibling fixes from the same audit pass:
* PR #2349 / GHSA-98xf-r82g-9mhx (MongoDB NoSQL injection)
* PR #2350 / GHSA-x3wm-3wx7-g6xm (Redis KEYS / SCAN injection)
---------
Co-authored-by: Nagendhra <nagendhra405@gmail.com >
Co-authored-by: Christian Bromann <git@bromann.dev >
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-05-28 13:23:15 -07:00
1f11df2668
chore: version packages ( #2364 )
...
This PR was opened by the [Changesets
release](https://github.com/changesets/action ) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @langchain/angular@1.0.0
### Major Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the Angular event streaming integration.
Angular applications can now build on the shared event streaming runtime
with
`useStream`, `injectStream`, `StreamService`, `provideStream`,
`provideStreamDefaults`, `injectProjection`, and selector helpers for
messages,
values, tool calls, custom channels, extensions, media, message
metadata, and
submission queues. The integration supports thread switching, run
submission,
reattachment, interrupts, WebSocket and SSE/custom transports, headless
tools,
subgraphs, subagents, and typed event projections.
This release also adds Angular-specific media helpers, including
`injectMediaUrl` and selectors for audio, images, video, and files. The
package
now exports the shared stream, media, transport, headless-tool, and type
inference types needed to compose strongly typed streaming UIs.
The documentation has been refreshed with guides for dependency
injection,
`injectStream`, selectors, transports, custom transports, interrupts,
submission queues, headless tools, subagents/subgraphs, type safety,
testing,
and migration from the previous SDK surface.
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph-sdk@1.9.0
## @langchain/react@1.0.0
### Major Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the React event streaming integration.
React applications can now use the shared event streaming runtime
through
`useStream`, `useProjection`, `useSuspenseStream`, `StreamProvider`, and
focused selector hooks for messages, values, tool calls, custom
channels,
extensions, media, message metadata, and submission queues. The new
integration
supports thread-scoped runs, reattachment, interrupts, WebSocket and
SSE/custom transports, headless tools, subgraphs, subagents, typed
stream
extensions, and strongly typed state/tool-call inference.
This release also adds media helpers for streaming UI experiences,
including
`useMediaURL`, `useAudioPlayer`, and `useVideoPlayer`, plus selectors
for
audio, images, video, and files. Shared transport, media, protocol
event,
message metadata, and discovery types are exported from the package so
React
components can compose richer streaming interfaces without deep imports.
The package documentation and tests have been expanded around custom
transports, selectors, interrupts, multimodal streaming, suspense,
submission
queues, headless tools, subagents, type safety, and migration from the
previous
streaming API.
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph-sdk@1.9.0
## @langchain/svelte@1.0.0
### Major Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the Svelte event streaming integration.
Svelte applications can now use the shared event streaming runtime
through
`useStream`, `useProjection`, context helpers, and selector runes for
messages,
values, tool calls, custom channels, extensions, media, message
metadata, and
submission queues. The integration supports thread-scoped runs,
reattachment,
interrupts, WebSocket and SSE/custom transports, headless tools,
subgraphs,
subagents, typed stream extensions, and strongly typed state/tool-call
inference.
This release also adds Svelte media helpers, including `useMediaURL`,
`useAudioPlayer`, and `useVideoPlayer`, plus selectors for audio,
images,
video, and files. Shared transport, media, protocol event, message
metadata,
and discovery types are exported from the package so Svelte components
can
compose streaming interfaces without deep imports.
The package now includes focused documentation and tests for context,
custom
transports, selectors, interrupts, hydration, submission queues,
subscriptions, headless tools, subagents, type safety, and migration
from the
previous streaming API.
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph-sdk@1.9.0
## @langchain/vue@1.0.0
### Major Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the Vue event streaming integration.
Vue applications can now use the shared event streaming runtime through
`useStream`, `useProjection`, `provideStream`, `useStreamContext`, and
selector composables for messages, values, tool calls, custom channels,
extensions, media, message metadata, and submission queues. The
integration
supports thread-scoped runs, reattachment, interrupts, WebSocket and
SSE/custom transports, headless tools, subgraphs, subagents, typed
stream
extensions, and strongly typed state/tool-call inference.
This release also adds Vue media helpers, including `useMediaURL`,
`useAudioPlayer`, and `useVideoPlayer`, plus selectors for audio,
images,
video, and files. Shared transport, media, protocol event, message
metadata,
and discovery types are exported from the package so Vue components can
build
rich streaming UIs without deep imports.
The package documentation and tests now cover API usage, custom
transports,
forking, interrupts, multimodal streaming, selectors, shared streams,
subagents, suspense, submission queues, transports, type safety, and
migration
from the previous streaming API.
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph-sdk@1.9.0
## @langchain/langgraph-api@1.2.0
### Minor Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the thread-scoped event streaming protocol used by the new SDK streaming
clients.
This release adds protocol routes for WebSocket and SSE/HTTP streaming,
including thread-local command handling, filtered subscriptions, event
replay,
state inspection, checkpoint listing/forking, interrupt input, agent
tree
queries, and run start/resume commands. Stream events are normalized
into the
canonical protocol shape with ordered sequence IDs so clients can safely
dedupe, resume subscriptions, and coordinate multiple projections from
the same
run.
The experimental embed server now supports the same protocol flow, so
embedded
graphs can serve the new SDK transports without standing up a separate
LangGraph API deployment. The server also gains protocol session tests
and
fixture graphs covering deep agents, interrupts, subgraphs, and SDK
transport
behavior.
### Patch Changes
- Updated dependencies \[]:
- @langchain/langgraph-ui@1.2.0
## @langchain/langgraph@1.3.0
### Minor Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the in-process event streaming runtime behind `streamEvents`.
LangGraph now exposes the core primitives for event-based streaming,
including
`StreamChannel`, `StreamMux`, `GraphRunStream`, `SubgraphRunStream`,
native
stream transformers, and protocol event conversion utilities. These APIs
let
graphs emit ordered protocol events, derive additional projections,
expose
custom stream channels, and bridge in-process runs to remote SDK
clients.
The runtime includes built-in transformers for messages, values,
lifecycle
events, and subgraph discovery. It also adds support for transformer
registration during graph execution, forwarding remote `StreamChannel`
output,
subgraph-aware event routing, event log multiplexing, and
checkpoint-aware
values streams.
This release also expands test coverage across Pregel streaming, event
conversion, stream muxing, stream channels, run streams, lifecycle
transformers, subgraph transformers, and type-level streaming behavior.
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph-checkpoint@1.0.2
- @langchain/langgraph-sdk@1.9.0
## @langchain/langgraph-sdk@1.9.0
### Minor Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! - Add
the framework-agnostic event streaming SDK.
The SDK now includes a thread-focused streaming client built around
`ThreadStream`, `SubscriptionHandle`, message assembly, media assembly,
typed
stream extensions, and pluggable protocol transports. Applications can
stream
over SSE or WebSocket, provide custom agent-server adapters, subscribe
to
values/messages/tools/custom/lifecycle/checkpoint channels, inspect and
fork
state, respond to interrupts, and replay or dedupe ordered event
streams.
This release also adds the reusable stream runtime used by the React,
Vue,
Svelte, and Angular packages: `StreamController`, `StreamStore`,
`ChannelRegistry`, projection factories, subagent/subgraph discovery,
submission queue coordination, message metadata tracking, root message
projection, media projections, and helper types for agent/deep-agent
state and
tool-call inference.
The client package has been reorganized into focused modules for
assistants,
threads, runs, store, protocol streaming, transports, media, messages,
and UI
helpers. New SDK documentation covers configuration, assistants,
threads, runs,
store, streaming, transports, extensions, interrupts, messages, media,
subagents, and subgraphs.
### Patch Changes
- [#2363 ](https://github.com/langchain-ai/langgraphjs/pull/2363 )
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )
Thanks [@cwlbraa](https://github.com/cwlbraa )! - Add a `returnMinimal`
option to `threads.update`.
## @langchain/langgraph-checkpoint@1.0.2
### Patch Changes
- [#2314 ](https://github.com/langchain-ai/langgraphjs/pull/2314 )
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )
Thanks [@christian-bromann](https://github.com/christian-bromann )! -
Improve `MemorySaver` diagnostics when checkpoint writes are missing a
`thread_id`.
The in-memory checkpointer now explains why `configurable.thread_id` is
required and includes a concrete `graph.stream(..., { configurable: {
thread_id } })` example in the error message. This makes the new
thread-oriented event streaming flows easier to debug when an
application
forgets to provide durable thread configuration.
## @langchain/langgraph-cli@1.2.0
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )]:
- @langchain/langgraph-api@1.2.0
## @langchain/langgraph-ui@1.2.0
## @example/ai-elements@0.1.15
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )]:
- @langchain/langgraph@1.3.0
- @langchain/react@1.0.0
## @examples/assistant-ui-claude@0.1.15
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )]:
- @langchain/langgraph@1.3.0
- @langchain/react@1.0.0
## @examples/ui-angular@0.0.25
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph@1.3.0
- @langchain/langgraph-sdk@1.9.0
- @langchain/angular@1.0.0
## @examples/ui-multimodal@0.0.1
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )]:
- @langchain/langgraph@1.3.0
- @langchain/react@1.0.0
## @examples/ui-react@0.0.1
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb ),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9 )]:
- @langchain/langgraph@1.3.0
- @langchain/langgraph-sdk@1.9.0
- @langchain/react@1.0.0
## langgraph@1.0.32
### Patch Changes
- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb )]:
- @langchain/langgraph@1.3.0
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-05-05 00:41:45 -07:00
github-actions[bot]