langchain-ai/langgraphjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraphjs.git synced 2026-07-22 00:55:26 -04:00
Code Issues 108 Packages Projects Releases 20 Wiki Activity
2,902 Commits 162 Branches 537 Tags
@langchain/langgraph-checkpoint-postgres@1.0.2
Commit Graph

370 Commits

Author SHA1 Message Date
github-actions[bot] d2ca90f8e2 chore: version packages (#2453) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.0.4

### Patch Changes

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

## @langchain/langgraph-checkpoint-mongodb@1.3.2

### Patch Changes

- [#2186](https://github.com/langchain-ai/langgraphjs/pull/2186)
[`26c2e32`](https://github.com/langchain-ai/langgraphjs/commit/26c2e325f435a2c061d6b78a7bd6af089cb1e0e6)
Thanks [@jackjin1997](https://github.com/jackjin1997)! - fix: metadata
filter in list() now works by querying a plain JSON shadow copy instead
of the serialized binary blob

## @langchain/langgraph-checkpoint-postgres@1.0.2

### Patch Changes

- [#2255](https://github.com/langchain-ai/langgraphjs/pull/2255)
[`e82a50b`](https://github.com/langchain-ai/langgraphjs/commit/e82a50b961a9413dab1ad2248747d5c73a6a1e58)
Thanks [@leesta24](https://github.com/leesta24)! -
fix(checkpoint-postgres): move serialization outside transaction in
put()

## @langchain/langgraph-checkpoint-redis@1.0.7

### Patch Changes

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

## @langchain/langgraph-api@1.2.4

### Patch Changes

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

-   Updated dependencies \[]:
    -   @langchain/langgraph-ui@1.2.4

## @langchain/langgraph-cli@1.2.4

### Patch Changes

- [#1925](https://github.com/langchain-ai/langgraphjs/pull/1925)
[`6503319`](https://github.com/langchain-ai/langgraphjs/commit/65033191cc3dd671d64dfac78ccdad453fdfbda2)
Thanks [@jbrody-nexxa](https://github.com/jbrody-nexxa)! - fix(cli): add
--no-reload flag to dev command

- Updated dependencies
\[[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-api@1.2.4

## @langchain/langgraph@1.3.3

### Patch Changes

- [#2037](https://github.com/langchain-ai/langgraphjs/pull/2037)
[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f)
Thanks [@pawel-twardziak](https://github.com/pawel-twardziak)! -
Decouple `ContextType` generic from `configurable` in `PregelOptions` so
that providing a custom context type no longer incorrectly narrows the
configurable parameter.

- [#2457](https://github.com/langchain-ai/langgraphjs/pull/2457)
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): pass context with stateful RemoteGraph runs

Pop `thread_id` from run `config.configurable` and forward `context` to
the SDK so checkpointed remote runs accept user context without a 400
from ambiguous parameters. Closes
[#1922](https://github.com/langchain-ai/langgraphjs/issues/1922).

- [#1988](https://github.com/langchain-ai/langgraphjs/pull/1988)
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7)
Thanks [@Axadali](https://github.com/Axadali)! - Fix race condition in
IterableReadableWritableStream.push() that caused ERR_INVALID_STATE
errors when streaming with multiple parallel nodes and aborting the
stream.

- [#2409](https://github.com/langchain-ai/langgraphjs/pull/2409)
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3)
Thanks [@pragnyanramtha](https://github.com/pragnyanramtha)! - Preserve
non-plain objects passed through `Send` and `Command` argument
deserialization.

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11
    -   @langchain/langgraph-checkpoint@1.0.4

## @langchain/langgraph-supervisor@1.0.4

### Patch Changes

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

## @langchain/langgraph-sdk@1.9.11

### Patch Changes

- [#2455](https://github.com/langchain-ai/langgraphjs/pull/2455)
[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856)
Thanks [@JHSeo-git](https://github.com/JHSeo-git)! - fix(sdk): prefer
completed task's direct mapping over pending checkpoint's positional
guess in fetchSubagentHistory

- [#2344](https://github.com/langchain-ai/langgraphjs/pull/2344)
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)
Thanks [@dependabot](https://github.com/apps/dependabot)! - chore(deps):
bump uuid to 14.0.0 and keep checkpoint ID ordering stable

Bump `uuid` from 10.x/13.x to 14.0.0 across packages. Starting with uuid
11, `v6({ clockseq })` no longer advances the sub-millisecond time
counter when an explicit `clockseq` is passed, so checkpoint IDs created
within the same millisecond were ordered only by `clockseq`. Since
checkpoint IDs are sorted lexicographically, this broke ordering — most
visibly for the negative `clockseq` used by the first ("input")
checkpoint, which sorted as the newest.

`uuid6()` now maintains its own monotonic `(msecs, nsecs)` clock
(mirroring uuid 10's internal v1 behavior) so the time component is
always strictly increasing and checkpoint ordering no longer depends on
the `clockseq` value. `emptyCheckpoint()` also uses a non-negative
`clockseq`.

## @langchain/angular@1.0.11

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11

## @langchain/react@1.0.11

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11

## @langchain/svelte@1.0.11

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11

## @langchain/vue@1.0.11

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11

## @langchain/langgraph-ui@1.2.4



## @example/ai-elements@0.1.26

### Patch Changes

- Updated dependencies
\[[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph@1.3.3
    -   @langchain/react@1.0.11

## @examples/assistant-ui-claude@0.1.26

### Patch Changes

- Updated dependencies
\[[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph@1.3.3
    -   @langchain/react@1.0.11

## @examples/ui-angular@0.0.36

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11
    -   @langchain/langgraph@1.3.3
    -   @langchain/angular@1.0.11

## @examples/ui-multimodal@0.0.12

### Patch Changes

- Updated dependencies
\[[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph@1.3.3
    -   @langchain/react@1.0.11

## @examples/ui-react@0.0.12

### Patch Changes

- Updated dependencies
\[[`863b555`](https://github.com/langchain-ai/langgraphjs/commit/863b555346de02c2c0be290e877b7d260a3f8856),
[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph-sdk@1.9.11
    -   @langchain/langgraph@1.3.3
    -   @langchain/react@1.0.11

## langgraph@1.0.35

### Patch Changes

- Updated dependencies
\[[`9eb478f`](https://github.com/langchain-ai/langgraphjs/commit/9eb478ffeeda2ad9c3bff2cd0f0ac602b0a79f4f),
[`91a5494`](https://github.com/langchain-ai/langgraphjs/commit/91a54947155b3fad3234001e63e20099a63ed999),
[`6d4bf92`](https://github.com/langchain-ai/langgraphjs/commit/6d4bf927e5cf3744034205528bcd09964949d6d7),
[`101b70a`](https://github.com/langchain-ai/langgraphjs/commit/101b70aa8d7ec26ec1654ef814689b832f1e17f3),
[`0125920`](https://github.com/langchain-ai/langgraphjs/commit/0125920a2c4a87dc1d66aaf541ea16146f8cf842)]:
    -   @langchain/langgraph@1.3.3

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-06-01 09:20:26 -07:00
dependabot[bot] 0125920a2c chore(deps): bump uuid from 10.0.0 to 14.0.0 (#2344) 
Bumps [uuid](https://github.com/uuidjs/uuid) from 10.0.0 to 14.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/releases">uuid's
releases</a>.</em></p>
<blockquote>
<h2>v14.0.0</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a>
(2026-04-19)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>) (<a
href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3">dc4ddb8</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>) (<a
href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4">f2c235f</a>)</li>
<li>Use GITHUB_TOKEN for release-please and enable npm provenance (<a
href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>) (<a
href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c">ffa3138</a>)</li>
</ul>
<h2>v13.0.2</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.1...v13.0.2">13.0.2</a>
(2026-05-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>rerelease to fix provenance. (<a
href="https://github.com/uuidjs/uuid/commit/49ccb35f78c0c4ce1409dd2f1d89f83caadba10b">49ccb35</a>)</li>
</ul>
<h2>v13.0.1</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v13.0.1">13.0.1</a>
(2026-04-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>backport fix for GHSA-w5hq-g745-h8pq (<a
href="https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a">9d27ddf</a>)</li>
</ul>
<h2>v13.0.0</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v12.0.0...v13.0.0">13.0.0</a>
(2025-09-08)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>make browser exports the default (<a
href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>make browser exports the default (<a
href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>) (<a
href="https://github.com/uuidjs/uuid/commit/bce9d72a3ae5b9a3dcd8eb21ef6d1820288a427a">bce9d72</a>)</li>
</ul>
<h2>v12.0.1</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v12.0.0...v12.0.1">12.0.1</a>
(2026-04-29)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md">uuid's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a>
(2026-04-19)</h2>
<h3>Security</h3>
<ul>
<li>Fixes <a
href="https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq">GHSA-w5hq-g745-h8pq</a>:
<code>v3()</code>, <code>v5()</code>, and <code>v6()</code> did not
validate that writes would remain within the bounds of a caller-supplied
buffer, allowing out-of-bounds writes when an invalid
<code>offset</code> was provided. A <code>RangeError</code> is now
thrown if <code>offset &lt; 0</code> or <code>offset + 16 &gt;
buf.length</code>.</li>
</ul>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li><code>crypto</code> is now expected to be globally defined (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
<li>upgrade minimum supported TypeScript version to 5.4.3, in keeping
with the project's policy of supporting TypeScript versions released
within the last two years</li>
</ul>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v12.0.0...v13.0.0">13.0.0</a>
(2025-09-08)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>make browser exports the default (<a
href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>make browser exports the default (<a
href="https://redirect.github.com/uuidjs/uuid/issues/901">#901</a>) (<a
href="https://github.com/uuidjs/uuid/commit/bce9d72a3ae5b9a3dcd8eb21ef6d1820288a427a">bce9d72</a>)</li>
</ul>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v11.1.0...v12.0.0">12.0.0</a>
(2025-09-05)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>update to typescript@5.2 (<a
href="https://redirect.github.com/uuidjs/uuid/issues/887">#887</a>)</li>
<li>remove CommonJS support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/886">#886</a>)</li>
<li>drop node@16 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/883">#883</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>add node@24 to ci matrix (<a
href="https://redirect.github.com/uuidjs/uuid/issues/879">#879</a>) (<a
href="https://github.com/uuidjs/uuid/commit/42b6178aa21a593257f0a72abacd220f0b7b8a92">42b6178</a>)</li>
<li>drop node@16 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/883">#883</a>) (<a
href="https://github.com/uuidjs/uuid/commit/0f38cf10366ab074f9328ae2021eea04d5f2e530">0f38cf1</a>)</li>
<li>remove CommonJS support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/886">#886</a>) (<a
href="https://github.com/uuidjs/uuid/commit/ae786e27265f50bcf7cead196c29f1869297c42f">ae786e2</a>)</li>
<li>update to typescript@5.2 (<a
href="https://redirect.github.com/uuidjs/uuid/issues/887">#887</a>) (<a
href="https://github.com/uuidjs/uuid/commit/c7ee40598ed78584d81ab78dffded9fe5ff20b01">c7ee405</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>improve v4() performance (<a
href="https://redirect.github.com/uuidjs/uuid/issues/894">#894</a>) (<a
href="https://github.com/uuidjs/uuid/commit/5fd974c12718c8848035650b69b8948f12ace197">5fd974c</a>)</li>
<li>restore node: prefix (<a
href="https://redirect.github.com/uuidjs/uuid/issues/889">#889</a>) (<a
href="https://github.com/uuidjs/uuid/commit/e1f42a354593093ba0479f0b4047dae82d28c507">e1f42a3</a>)</li>
</ul>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v11.0.5...v11.1.0">11.1.0</a>
(2025-02-19)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/uuidjs/uuid/commit/7c1ea087a8149b57380fc8bb7f68c3a215cb6e4b"><code>7c1ea08</code></a>
chore(main): release 14.0.0 (<a
href="https://redirect.github.com/uuidjs/uuid/issues/926">#926</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34"><code>3d2c5b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4"><code>f2c235f</code></a>
fix!: expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/529ef0899f5dd503d2ee90d690585d63d78bc212"><code>529ef08</code></a>
chore: upgrade TypeScript and fixup types (<a
href="https://redirect.github.com/uuidjs/uuid/issues/927">#927</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/086fd7976f11433edf9ac80be876b3ad243fe087"><code>086fd79</code></a>
chore: update dependencies (<a
href="https://redirect.github.com/uuidjs/uuid/issues/933">#933</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3"><code>dc4ddb8</code></a>
feat!: drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/0f1f9c9c9cedbae5a1d363d5406c5dfbabe81404"><code>0f1f9c9</code></a>
chore: switch to Biome for parsing and linting (<a
href="https://redirect.github.com/uuidjs/uuid/issues/932">#932</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/e2879e64bf125add903c1eff6e0860542c605013"><code>e2879e6</code></a>
chore: use maintained version of npm-run-all (<a
href="https://redirect.github.com/uuidjs/uuid/issues/930">#930</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c"><code>ffa3138</code></a>
fix: Use GITHUB_TOKEN for release-please and enable npm provenance (<a
href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/0423d49df2dc8efc300c804731d25f4d7e0fccc4"><code>0423d49</code></a>
docs: remove obsolete v1 option notes (<a
href="https://redirect.github.com/uuidjs/uuid/issues/915">#915</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/uuidjs/uuid/compare/v10.0.0...v14.0.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for uuid since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-05-31 23:19:01 -07:00
github-actions[bot] 381a9f64d0 chore: version packages (#2445) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.0.3

### Patch Changes

- [#2352](https://github.com/langchain-ai/langgraphjs/pull/2352)
[`14f2a79`](https://github.com/langchain-ai/langgraphjs/commit/14f2a796912e81d7f52f0a4f16747f6d0a269209)
Thanks [@Nagendhra-web](https://github.com/Nagendhra-web)! -
fix(langgraph-checkpoint): block prototype pollution in MemorySaver via
reserved storage keys

    `MemorySaver` previously embedded `thread_id`, `checkpoint_ns`,
`checkpoint_id`, and `task_id` directly into property accesses on the
nested plain objects `this.storage` and `this.writes`. A caller able to
shape any of those fields (every quickstart, tutorial, and test fixture
    uses `MemorySaver` by default) could pass `"__proto__"`,
    `"constructor"`, or `"prototype"` and have the subsequent assignment
    mutate `Object.prototype`. From that point every plain object in the
    process inherits the injected property, breaking `for...in` loops,
truthy short-circuits, and downstream serializers across unrelated code
    paths. CWE-1321.

Adds an `assertSafeStorageKey` chokepoint applied at every public entry
that touches `storage` or `writes` (`put`, `putWrites`, `deleteThread`,
    `getTuple`, `list`). The guard rejects non-string values, the empty
string (unless explicitly opted-in for `checkpoint_ns`), and the three
    prototype-pollution keys. Behaviour for valid string identifiers is
    unchanged.

## @langchain/langgraph-checkpoint-redis@1.0.6

### Patch Changes

- [#2350](https://github.com/langchain-ai/langgraphjs/pull/2350)
[`1e73c6b`](https://github.com/langchain-ai/langgraphjs/commit/1e73c6b4630bbc4aa976eea4bfc33c4f753b7ee9)
Thanks [@Nagendhra-web](https://github.com/Nagendhra-web)! -
fix(checkpoint-redis): block Redis KEYS / SCAN pattern injection via
top-level identifiers

`RedisSaver` and `ShallowRedisSaver` previously embedded `thread_id`,
`checkpoint_ns`, `checkpoint_id`, and `task_id` directly into Redis keys
and `client.keys(pattern)` calls with no validation. A caller able to
    shape any of those fields (multi-tenant SDK deployments where the
`RunnableConfig` originates from request input, or webhook payloads that
flow into a persisted thread) could promote a string identifier into a
    glob pattern (`*`, `?`, `[...]`) or escape character (`\`).

    The most severe sink is `deleteThread`: a `threadId` of `*` issues
`client.keys("checkpoint:*:*")` followed by `client.del(...)`, deleting
    every checkpoint in the database across every tenant. `getTuple`,
    `list`, and `loadPendingWrites` are exposed to the same pattern via
the fallback paths that bypass the existing `escapeRediSearchTagValue`
    defense.

    Adds a single `assertSafeKeyComponent` helper exported from
    `./utils.js` and applies it at every key-building site. The guard
    asserts the value is a non-empty string (the empty `checkpoint_ns`
    default is opt-in via `{ allowEmpty: true }`) and rejects the Redis
pattern meta-characters `* ? [ ] \`. The `:` delimiter is intentionally
    permitted because LangGraph emits it as a legitimate part of
    `checkpoint_ns` for subgraphs / nested graphs, where it only ever
appears as a literal in the key. Behavior for valid string identifiers
    is unchanged.

## @langchain/langgraph-api@1.2.3

### Patch Changes

- [#2447](https://github.com/langchain-ai/langgraphjs/pull/2447)
[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: fold forkFrom client-side and honor per-run
multitaskStrategy

    The SDK now folds the ergonomic `forkFrom` option into
`config.configurable.checkpoint_id` before sending `run.start`, so the
agent server only ever accepts the single, legacy-compliant fork field
(`forkFrom` no longer hits the wire). The protocol-v2 reference servers
    drop their top-level `forkFrom` normalization accordingly.

The protocol-v2 servers now honor the caller's `multitaskStrategy` per
run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead
of
hardcoding it, falling back to `enqueue` when omitted or unrecognized.

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)]:
    -   @langchain/langgraph-ui@1.2.3

## @langchain/langgraph-cli@1.2.3

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-api@1.2.3

## @langchain/langgraph-ui@1.2.3

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

## @langchain/langgraph-sdk@1.9.10

### Patch Changes

- [#2447](https://github.com/langchain-ai/langgraphjs/pull/2447)
[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: fold forkFrom client-side and honor per-run
multitaskStrategy

    The SDK now folds the ergonomic `forkFrom` option into
`config.configurable.checkpoint_id` before sending `run.start`, so the
agent server only ever accepts the single, legacy-compliant fork field
(`forkFrom` no longer hits the wire). The protocol-v2 reference servers
    drop their top-level `forkFrom` normalization accordingly.

The protocol-v2 servers now honor the caller's `multitaskStrategy` per
run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead
of
hardcoding it, falling back to `enqueue` when omitted or unrecognized.

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

## @langchain/angular@1.0.10

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10

## @langchain/react@1.0.10

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10

## @langchain/svelte@1.0.10

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10

## @langchain/vue@1.0.10

### Patch Changes

- [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443)
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom

    Remove the misleading submit({ command }) surface from protocol-v2
StreamController; HITL resume is respond() only. Accept forkFrom as a
    plain checkpoint id string and align protocol-v2 servers and docs.

- [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448)
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
protocol-v2: add `respondAll()` and run config/metadata on interrupt
resume

The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a
`respondAll(responsesById, options)` method to resume several interrupts
pending at the same checkpoint in a single command — required for runs
that
pause on multiple interrupts at once (e.g. parallel tool-authorization
      prompts), which sequential `respond()` calls cannot handle.

`respond()` now takes an options object (`{ interruptId?, namespace?,
config?, metadata? }`) so a resumed run can carry the same run-level
config
(model, user context, …) and metadata (trigger source, test flags, …) a
fresh `submit()` would. The protocol-v2 reference servers read the new
`responses` batch and `config` / `metadata` fields leniently and fold
them
      onto the run that services the `input.respond` command.

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10

## @example/ai-elements@0.1.25

### Patch Changes

- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/react@1.0.10

## @examples/assistant-ui-claude@0.1.25

### Patch Changes

- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/react@1.0.10

## @examples/ui-angular@0.0.35

### Patch Changes

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10
    -   @langchain/angular@1.0.10

## @examples/ui-multimodal@0.0.11

### Patch Changes

- Updated dependencies
\[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/react@1.0.10

## @examples/ui-react@0.0.11

### Patch Changes

- Updated dependencies
\[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9),
[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532),
[`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]:
    -   @langchain/langgraph-sdk@1.9.10
    -   @langchain/react@1.0.10

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-29 00:08:20 -07:00
Christian Bromann 2c14b12a80 fix(sdk): add back respondAll and respond config/metadata (#2448) 
## Summary
- Add `respondAll(responsesById, options)` to the stream controller and
the React/Angular/Svelte/Vue wrappers, resuming multiple interrupts
pending at the same checkpoint in a single `Command({ resume })`. This
is required for runs that pause on several interrupts at once (e.g.
parallel tool-authorization prompts), which sequential `respond()` calls
cannot service.
- Change `respond()` to take an options object (`{ interruptId?,
namespace?, config?, metadata? }`), folding run-level
`config`/`metadata` onto the resumed run so it applies the same
configurable values and metadata a fresh `submit()` would.
- Extend `ThreadStream.respondInput()` to accept a `responses` batch
(mutually exclusive with the single `interrupt_id`/`response`) and clear
all responded interrupts from local state.
- Update the protocol-v2 reference servers (`embed/protocol.mts`,
`protocol/service.mts`) to read the `responses` batch plus
`config`/`metadata` leniently and fold them onto the run servicing
`input.respond`.
- Update docs (interrupts/use-stream) across all framework packages and
add controller tests for batched resume.
 2026-05-28 16:53:09 -07:00
Christian Bromann 80c2806cb2 fix(sdk): fold forkFrom client-side and honor multitaskStrategy (#2447) 
## Summary
- Fold the SDK's top-level `forkFrom` into
`config.configurable.checkpoint_id` client-side before sending
`run.start`, so `forkFrom` never reaches the server and the fork target
travels via the single legacy-compliant field used by the existing run
endpoints.
- Drop the server-side `forkFrom` normalization/promotion in both
protocol-v2 reference servers (`ProtocolService.createOrResumeRun` and
the embed protocol routes), reading the fork target solely from
`config.configurable.checkpoint_id`.
- Honor the caller's per-run `multitaskStrategy` (`reject` | `rollback`
| `interrupt` | `enqueue`) instead of hardcoding `interrupt`, falling
back to `enqueue` (the legacy stream-endpoint default, matching the
Python protocol-v2 server) when omitted or unrecognized.
 2026-05-28 12:59:49 -07:00
Christian Bromann 80a8c1200a refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom (#2443) 
## Summary
- Remove `command` from `StreamSubmitOptions` and the
`submit-coordinator` resume-via-`submit` path so HITL resume goes
through `stream.respond()` only.
- Simplify `forkFrom` from `{ checkpointId: string }` to a plain
checkpoint id string across the SDK, protocol-v2 services, and docs.
- Update interrupt tests, examples (`HumanInTheLoopView`, branching
views), and React/Vue/Svelte/Angular JSDoc and migration/interrupt docs
to match.
 2026-05-28 09:52:05 -07:00
Christian Bromann f99941f5fe fix(sdk): clear subgraph and subagent discovery on thread swap (#2430) 
## Summary
- Add `reset()` to `SubgraphDiscovery` and `SubagentDiscovery` to clear
internal maps and committed store snapshots.
- Call both resets from `StreamController.#teardownThread()` alongside
existing per-thread resets (messages, tools, metadata).
- Add unit tests for discovery `reset()` and a controller test that
`hydrate(null)` clears subgraphs after lifecycle events.
 2026-05-25 00:50:31 -07:00
Christian Bromann 3529e3831a fix(sdk): align AssembledToolCall typing with pre-v1 expectations (#2421) 
## Summary
- Split tool-call handles by consumer:
- **Client SDK** (`ThreadStream.toolCalls`, subgraph/subagent
projections): `ClientAssembledToolCall` with a promise-only `output`
(resolves on success, rejects on error). Still exported as
`AssembledToolCall` from `@langchain/langgraph-sdk/client` for script
usage.
- **Framework SDKs** (`stream.toolCalls`, `useToolCalls`,
`injectToolCalls`): `AssembledToolCall` with plain reactive fields —
`output: T | null`, `status`, and `error` — updated in place as events
arrive so React/Vue/Svelte/Angular can render from snapshots without
`await`, effects, or Suspense around promises.
- Add generic `AssembledToolCall<TName, TInput, TOutput>` plus
`id`/`args` aliases; point `InferToolCalls` at assembled streaming
handles and add `AssembledToolCallFromTool` (exported as
`ToolCallFromTool` from `@langchain/react`, `@langchain/vue`,
`@langchain/svelte`, and `@langchain/angular`).
- Rework `ToolCallAssembler` around a mutable internal handle and
`toClientAssembledToolCall()` for client projections; framework stores
the reactive handle directly.
- Remove redundant `InferAssembledToolCalls` and deprecated `StateOf`;
wire typed `toolCalls` / selector generics across all four framework
packages.
- Expand and align `createAgent`, `createDeepAgent`, and `langgraph`
type tests across React, Vue, Svelte, and Angular; update examples,
protocol-v2 integration tests, and Vue migration docs.
 2026-05-22 06:38:06 -07:00
github-actions[bot] 1b5ce0fca0 chore: version packages (#2405) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint-mongodb@1.3.1

### Patch Changes

- [#2397](https://github.com/langchain-ai/langgraphjs/pull/2397)
[`284226c`](https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c)
Thanks [@hntrl](https://github.com/hntrl)! - fix(checkpoint-mongodb):
validate configurable checkpoint identifiers before queries

Add runtime validation for `thread_id`, `checkpoint_ns`, and
`checkpoint_id` in
`MongoDBSaver` methods that read and write checkpoints. This prevents
object-based
operator payloads from being passed into MongoDB query filters and
ensures invalid
    configurable values fail fast with explicit errors.

## @langchain/langgraph-api@1.2.2

### Patch Changes

- [#2396](https://github.com/langchain-ai/langgraphjs/pull/2396)
[`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8)
Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph-cli): accept
hyphenated prerelease tags in `api_version` values.

-   Updated dependencies \[]:
    -   @langchain/langgraph-ui@1.2.2

## @langchain/langgraph-cli@1.2.2

### Patch Changes

- [#2389](https://github.com/langchain-ai/langgraphjs/pull/2389)
[`40bcdab`](https://github.com/langchain-ai/langgraphjs/commit/40bcdab38fa495028d8eba68062e48079dbe9208)
Thanks [@jdrogers940](https://github.com/jdrogers940)! - Adding support
for pre-release versions in api_version.

- [#2396](https://github.com/langchain-ai/langgraphjs/pull/2396)
[`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8)
Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph-cli): accept
hyphenated prerelease tags in `api_version` values.

- Updated dependencies
\[[`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8)]:
    -   @langchain/langgraph-api@1.2.2

## @langchain/langgraph@1.3.1

### Patch Changes

- [#2339](https://github.com/langchain-ai/langgraphjs/pull/2339)
[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f)
Thanks [@vigneshpatel14](https://github.com/vigneshpatel14)! -
fix(langgraph): surface structuredResponse parse failures in
createReactAgent

- [#2406](https://github.com/langchain-ai/langgraphjs/pull/2406)
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-core): keep tool results out of v3 message streams

- [#2376](https://github.com/langchain-ai/langgraphjs/pull/2376)
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)
Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph): prefer
configurable assistant and graph IDs for runtime server info

Update runtime `serverInfo` construction to read `assistant_id` and
`graph_id` from
`config.configurable` first, with fallback to `config.metadata` for
compatibility.
Also expands `execution_info` tests to cover configurable sourcing,
precedence,
    and metadata fallback behavior.

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3

## @langchain/langgraph-sdk@1.9.3

### Patch Changes

- [#2387](https://github.com/langchain-ai/langgraphjs/pull/2387)
[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Coalesce
`RootMessageProjection` store writes through a single `setTimeout(0)`
flush so long `messages`-channel replays (on refresh, mid-run join, or
rapid subagent streaming) no longer drain as a per-event microtask chain
that trips React's `Maximum update depth exceeded` guard. Replaces the
previous `MessageChannel`-based batching, which deferred initial-submit
events past the first render and left the UI looking frozen until
refresh.

- [#2372](https://github.com/langchain-ai/langgraphjs/pull/2372)
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7)
Thanks [@ahmed-z0](https://github.com/ahmed-z0)! - Fix subagent message
routing to prefer the stream event namespace over checkpoint metadata
when filtering subagent messages.

- [#2384](https://github.com/langchain-ai/langgraphjs/pull/2384)
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - batch
RootMessageProjection store writes through a macrotask

- [#2388](https://github.com/langchain-ai/langgraphjs/pull/2388)
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c)
Thanks [@hntrl](https://github.com/hntrl)! - fix(sdk): retry connection
failures before throwing ConnectionError

- [#2381](https://github.com/langchain-ai/langgraphjs/pull/2381)
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - fix(sdk):
forward config + metadata on respondInput for resume submits

- [#2379](https://github.com/langchain-ai/langgraphjs/pull/2379)
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - filter
SSE-replayed input.requested events through a hydrated interrupt
allowlist

- [#2390](https://github.com/langchain-ai/langgraphjs/pull/2390)
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Bind
deepagents subagent discovery to the execution namespace via taskInput
so `useMessages(stream, subagent)` resolves the streaming scope instead
of the trigger tool-call namespace.

## @langchain/angular@1.0.3

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3

## @langchain/react@1.0.3

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3

## @langchain/svelte@1.0.3

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3

## @langchain/vue@1.0.3

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3

## @langchain/langgraph-cua@1.0.2



## @langchain/langgraph-supervisor@1.0.2



## @langchain/langgraph-swarm@1.0.2



## @langchain/langgraph-ui@1.2.2



## @example/ai-elements@0.1.18

### Patch Changes

- Updated dependencies
\[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1
    -   @langchain/react@1.0.3

## @examples/assistant-ui-claude@0.1.18

### Patch Changes

- Updated dependencies
\[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1
    -   @langchain/react@1.0.3

## @examples/ui-angular@0.0.28

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3
    -   @langchain/langgraph@1.3.1
    -   @langchain/angular@1.0.3

## @examples/ui-multimodal@0.0.4

### Patch Changes

- Updated dependencies
\[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1
    -   @langchain/react@1.0.3

## @examples/ui-react@0.0.4

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3
    -   @langchain/langgraph@1.3.1
    -   @langchain/react@1.0.3

## langgraph@1.0.33

### Patch Changes

- Updated dependencies
\[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f),
[`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1

## docs@null

# docs

## null

## null

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-18 22:47:09 +00:00
github-actions[bot] 22c4541b53 chore: version packages (rc) (#2385) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

`main` is currently in **pre mode** so this branch has prereleases
rather than normal releases. If you want to exit prereleases, run
`changeset pre exit` on `main`.

⚠️⚠️⚠️⚠️⚠️⚠️

# Releases
## @langchain/langgraph-api@1.2.2-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/langgraph-ui@1.2.2-rc.0

## @langchain/langgraph-cli@1.2.2-rc.0

### Patch Changes

- [#2389](https://github.com/langchain-ai/langgraphjs/pull/2389)
[`40bcdab`](https://github.com/langchain-ai/langgraphjs/commit/40bcdab38fa495028d8eba68062e48079dbe9208)
Thanks [@jdrogers940](https://github.com/jdrogers940)! - Adding support
for pre-release versions in api_version.

-   Updated dependencies \[]:
    -   @langchain/langgraph-api@1.2.2-rc.0

## @langchain/langgraph@1.3.1-rc.0

### Patch Changes

- [#2376](https://github.com/langchain-ai/langgraphjs/pull/2376)
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)
Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph): prefer
configurable assistant and graph IDs for runtime server info

Update runtime `serverInfo` construction to read `assistant_id` and
`graph_id` from
`config.configurable` first, with fallback to `config.metadata` for
compatibility.
Also expands `execution_info` tests to cover configurable sourcing,
precedence,
    and metadata fallback behavior.

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0

## @langchain/langgraph-cua@1.0.2-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0

## @langchain/langgraph-supervisor@1.0.2-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0

## @langchain/langgraph-swarm@1.0.2-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0

## @langchain/langgraph-sdk@1.9.3-rc.0

### Patch Changes

- [#2387](https://github.com/langchain-ai/langgraphjs/pull/2387)
[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Coalesce
`RootMessageProjection` store writes through a single `setTimeout(0)`
flush so long `messages`-channel replays (on refresh, mid-run join, or
rapid subagent streaming) no longer drain as a per-event microtask chain
that trips React's `Maximum update depth exceeded` guard. Replaces the
previous `MessageChannel`-based batching, which deferred initial-submit
events past the first render and left the UI looking frozen until
refresh.

- [#2372](https://github.com/langchain-ai/langgraphjs/pull/2372)
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7)
Thanks [@ahmed-z0](https://github.com/ahmed-z0)! - Fix subagent message
routing to prefer the stream event namespace over checkpoint metadata
when filtering subagent messages.

- [#2384](https://github.com/langchain-ai/langgraphjs/pull/2384)
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - batch
RootMessageProjection store writes through a macrotask

- [#2381](https://github.com/langchain-ai/langgraphjs/pull/2381)
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - fix(sdk):
forward config + metadata on respondInput for resume submits

- [#2379](https://github.com/langchain-ai/langgraphjs/pull/2379)
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - filter
SSE-replayed input.requested events through a hydrated interrupt
allowlist

- [#2390](https://github.com/langchain-ai/langgraphjs/pull/2390)
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)
Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Bind
deepagents subagent discovery to the execution namespace via taskInput
so `useMessages(stream, subagent)` resolves the streaming scope instead
of the trigger tool-call namespace.

## @langchain/angular@1.0.3-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0

## @langchain/react@1.0.3-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0

## @langchain/svelte@1.0.3-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0

## @langchain/vue@1.0.3-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0

## @langchain/langgraph-ui@1.2.2-rc.0



## @example/ai-elements@0.1.18-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/react@1.0.3-rc.0

## @examples/assistant-ui-claude@0.1.18-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/react@1.0.3-rc.0

## @examples/ui-angular@0.0.28-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/angular@1.0.3-rc.0

## @examples/ui-multimodal@0.0.4-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/react@1.0.3-rc.0

## @examples/ui-react@0.0.4-rc.0

### Patch Changes

- Updated dependencies
\[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113),
[`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7),
[`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad),
[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280),
[`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15),
[`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe),
[`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]:
    -   @langchain/langgraph-sdk@1.9.3-rc.0
    -   @langchain/langgraph@1.3.1-rc.0
    -   @langchain/react@1.0.3-rc.0

## langgraph@1.0.33-rc.0

### Patch Changes

- Updated dependencies
\[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]:
    -   @langchain/langgraph@1.3.1-rc.0

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-16 06:37:11 +00:00
Hunter Lovell 9b20df081a fix(langgraph-cli): allow hyphenated prerelease api_version (#2396) 2026-05-15 20:13:50 -07:00
dependabot[bot] aa6deb60c7 chore(deps): bump hono from 4.12.14 to 4.12.18 (#2374) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.14 to 4.12.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.18</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Cache Middleware ignores Vary: Authorization / Vary: Cookie leading
to cross-user cache leakage</h3>
<p>Affects: Cache Middleware. Fixes missing cache-skip handling for
<code>Vary: Authorization</code> and <code>Vary: Cookie</code>, where a
response cached for one authenticated user could be served to other
users. GHSA-p77w-8qqv-26rm</p>
<h3>CSS Declaration Injection via Style Object Values in JSX SSR</h3>
<p>Affects: hono/jsx. Fixes a missing CSS-context escape for
<code>style</code> object values and property names, where untrusted
input could inject additional CSS declarations. The impact is limited to
CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p</p>
<h3>Improper validation of NumericDate claims (exp, nbf, iat) in JWT
verify()</h3>
<p>Affects: <code>hono/utils/jwt</code>. Fixes improper validation of
<code>exp</code>, <code>nbf</code>, and <code>iat</code> claims, where
falsy, non-finite, or non-numeric values could silently bypass
time-based checks instead of being rejected per RFC 7519.
GHSA-hm8q-7f3q-5f36</p>
<hr />
<p>Users who use the JWT helper, hono/jsx, or the Cache middleware are
strongly encouraged to upgrade to this version.</p>
<h2>v4.12.17</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jsx): normalize SVG attributes on the <!-- raw HTML omitted -->
root element by <a
href="https://github.com/kfly8"><code>@​kfly8</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li>fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> by <a
href="https://github.com/yuintei"><code>@​yuintei</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4899">honojs/hono#4899</a></li>
<li>fix(cors): make origin optional in CORSOptions by <a
href="https://github.com/truffle-dev"><code>@​truffle-dev</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
<li>fix(types): propagate middleware response types to app.on overloads
by <a href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4906">honojs/hono#4906</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kfly8"><code>@​kfly8</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4893">honojs/hono#4893</a></li>
<li><a
href="https://github.com/truffle-dev"><code>@​truffle-dev</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4905">honojs/hono#4905</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.16...v4.12.17">https://github.com/honojs/hono/compare/v4.12.16...v4.12.17</a></p>
<h2>v4.12.16</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX tag names when
using <code>jsx()</code> or <code>createElement()</code>, which could
allow HTML injection if untrusted input is used as the tag name.
GHSA-69xw-7hcm-h432</p>
<h3>bodyLimit() can be bypassed for chunked / unknown-length
requests</h3>
<p>Affects: Body Limit Middleware. Fixes late enforcement for request
bodies without a reliable Content-Length (e.g. chunked requests), where
oversized requests could reach handlers and return successful responses
before being rejected. GHSA-9vqf-7f2p-gf9v</p>
<h2>v4.12.15</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(jwt): support single-line PEM keys by <a
href="https://github.com/hiendv"><code>@​hiendv</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4889">honojs/hono#4889</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/f10dee89ced5956b73c1cdc416d6bc0fd54d63b7"><code>f10dee8</code></a>
4.12.18</li>
<li><a
href="https://github.com/honojs/hono/commit/a5bd9ebead279ed9d0239ecbd854f629edfc0e57"><code>a5bd9eb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/58d3d3ad5656e007ed99da1b73865975952de5e9"><code>58d3d3a</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/568c2ecc1dd556894fad4dfa4a7ba499db6dba9c"><code>568c2ec</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/ff2b3d31df1be35f7d597a95dd3369402b6e87f2"><code>ff2b3d3</code></a>
4.12.17</li>
<li><a
href="https://github.com/honojs/hono/commit/52aaaf9714b06303ce5caa655b1d80675be687e9"><code>52aaaf9</code></a>
fix(types): propagate middleware response types to app.on overloads (<a
href="https://redirect.github.com/honojs/hono/issues/4906">#4906</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/76d5589e9b0569f4e74ec37e8dd6979455f70dfa"><code>76d5589</code></a>
fix(cors): make origin optional in CORSOptions (<a
href="https://redirect.github.com/honojs/hono/issues/4905">#4905</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/8f027e5574e91e3c7f263a728656e3888559e51a"><code>8f027e5</code></a>
fix(ssg): add <code>atom+xml</code> and <code>rss+xml</code> to
<code>defaultExtensionMap</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4899">#4899</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/bfba97ca7ea3d4541a3419f1749e5a1a3e8f1727"><code>bfba97c</code></a>
fix(jsx): normalize SVG attributes on the &lt;svg&gt; root element (<a
href="https://redirect.github.com/honojs/hono/issues/4893">#4893</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/90d4182aabd328e2ec6af3f25ec62ddc574ad8cb"><code>90d4182</code></a>
4.12.16</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.14...v4.12.18">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.14&new-version=4.12.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 14:20:47 -07:00
github-actions[bot] 69a7c01313 chore: version packages (#2367) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-api@1.2.1

### Patch Changes

- [#2366](https://github.com/langchain-ai/langgraphjs/pull/2366)
[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): update endpoints

-   Updated dependencies \[]:
    -   @langchain/langgraph-ui@1.2.1

## @langchain/langgraph-cli@1.2.1

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-api@1.2.1

## @langchain/langgraph-sdk@1.9.1

### Patch Changes

- [#2366](https://github.com/langchain-ai/langgraphjs/pull/2366)
[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): update endpoints

## @langchain/angular@1.0.1

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1

## @langchain/react@1.0.1

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1

## @langchain/svelte@1.0.1

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1

## @langchain/vue@1.0.1

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1

## @langchain/langgraph-ui@1.2.1



## @example/ai-elements@0.1.16

### Patch Changes

-   Updated dependencies \[]:
    -   @langchain/react@1.0.1

## @examples/assistant-ui-claude@0.1.16

### Patch Changes

-   Updated dependencies \[]:
    -   @langchain/react@1.0.1

## @examples/ui-angular@0.0.26

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1
    -   @langchain/angular@1.0.1

## @examples/ui-multimodal@0.0.2

### Patch Changes

-   Updated dependencies \[]:
    -   @langchain/react@1.0.1

## @examples/ui-react@0.0.2

### Patch Changes

- Updated dependencies
\[[`2bb66bf`](https://github.com/langchain-ai/langgraphjs/commit/2bb66bf816a8b18b2968ed885ef2df15f684cb4e)]:
    -   @langchain/langgraph-sdk@1.9.1
    -   @langchain/react@1.0.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-05 01:58:31 -07:00
Christian Bromann 2bb66bf816 fix(sdk): update endpoints (#2366) 
Aligning with latest Python changes updating endpoints to be:

POST /threads/{thread_id}/stream/events — SSE event stream
POST /threads/{thread_id}/commands — JSON command
WS /threads/{thread_id}/stream/events

for new streaming features.
 2026-05-05 01:54:42 -07:00
github-actions[bot] 1f11df2668 chore: version packages (#2364) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/angular@1.0.0

### Major Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the Angular event streaming integration.

Angular applications can now build on the shared event streaming runtime
with
    `useStream`, `injectStream`, `StreamService`, `provideStream`,
`provideStreamDefaults`, `injectProjection`, and selector helpers for
messages,
values, tool calls, custom channels, extensions, media, message
metadata, and
submission queues. The integration supports thread switching, run
submission,
reattachment, interrupts, WebSocket and SSE/custom transports, headless
tools,
    subgraphs, subagents, and typed event projections.

    This release also adds Angular-specific media helpers, including
`injectMediaUrl` and selectors for audio, images, video, and files. The
package
now exports the shared stream, media, transport, headless-tool, and type
    inference types needed to compose strongly typed streaming UIs.

The documentation has been refreshed with guides for dependency
injection,
`injectStream`, selectors, transports, custom transports, interrupts,
submission queues, headless tools, subagents/subgraphs, type safety,
testing,
    and migration from the previous SDK surface.

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph-sdk@1.9.0

## @langchain/react@1.0.0

### Major Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the React event streaming integration.

React applications can now use the shared event streaming runtime
through
`useStream`, `useProjection`, `useSuspenseStream`, `StreamProvider`, and
focused selector hooks for messages, values, tool calls, custom
channels,
extensions, media, message metadata, and submission queues. The new
integration
    supports thread-scoped runs, reattachment, interrupts, WebSocket and
SSE/custom transports, headless tools, subgraphs, subagents, typed
stream
    extensions, and strongly typed state/tool-call inference.

This release also adds media helpers for streaming UI experiences,
including
`useMediaURL`, `useAudioPlayer`, and `useVideoPlayer`, plus selectors
for
audio, images, video, and files. Shared transport, media, protocol
event,
message metadata, and discovery types are exported from the package so
React
components can compose richer streaming interfaces without deep imports.

    The package documentation and tests have been expanded around custom
transports, selectors, interrupts, multimodal streaming, suspense,
submission
queues, headless tools, subagents, type safety, and migration from the
previous
    streaming API.

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph-sdk@1.9.0

## @langchain/svelte@1.0.0

### Major Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the Svelte event streaming integration.

Svelte applications can now use the shared event streaming runtime
through
`useStream`, `useProjection`, context helpers, and selector runes for
messages,
values, tool calls, custom channels, extensions, media, message
metadata, and
submission queues. The integration supports thread-scoped runs,
reattachment,
interrupts, WebSocket and SSE/custom transports, headless tools,
subgraphs,
subagents, typed stream extensions, and strongly typed state/tool-call
    inference.

This release also adds Svelte media helpers, including `useMediaURL`,
`useAudioPlayer`, and `useVideoPlayer`, plus selectors for audio,
images,
video, and files. Shared transport, media, protocol event, message
metadata,
and discovery types are exported from the package so Svelte components
can
    compose streaming interfaces without deep imports.

The package now includes focused documentation and tests for context,
custom
    transports, selectors, interrupts, hydration, submission queues,
subscriptions, headless tools, subagents, type safety, and migration
from the
    previous streaming API.

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph-sdk@1.9.0

## @langchain/vue@1.0.0

### Major Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the Vue event streaming integration.

Vue applications can now use the shared event streaming runtime through
`useStream`, `useProjection`, `provideStream`, `useStreamContext`, and
selector composables for messages, values, tool calls, custom channels,
extensions, media, message metadata, and submission queues. The
integration
    supports thread-scoped runs, reattachment, interrupts, WebSocket and
SSE/custom transports, headless tools, subgraphs, subagents, typed
stream
    extensions, and strongly typed state/tool-call inference.

    This release also adds Vue media helpers, including `useMediaURL`,
`useAudioPlayer`, and `useVideoPlayer`, plus selectors for audio,
images,
video, and files. Shared transport, media, protocol event, message
metadata,
and discovery types are exported from the package so Vue components can
build
    rich streaming UIs without deep imports.

The package documentation and tests now cover API usage, custom
transports,
forking, interrupts, multimodal streaming, selectors, shared streams,
subagents, suspense, submission queues, transports, type safety, and
migration
    from the previous streaming API.

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph-sdk@1.9.0

## @langchain/langgraph-api@1.2.0

### Minor Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the thread-scoped event streaming protocol used by the new SDK streaming
    clients.

This release adds protocol routes for WebSocket and SSE/HTTP streaming,
including thread-local command handling, filtered subscriptions, event
replay,
state inspection, checkpoint listing/forking, interrupt input, agent
tree
queries, and run start/resume commands. Stream events are normalized
into the
canonical protocol shape with ordered sequence IDs so clients can safely
dedupe, resume subscriptions, and coordinate multiple projections from
the same
    run.

The experimental embed server now supports the same protocol flow, so
embedded
graphs can serve the new SDK transports without standing up a separate
LangGraph API deployment. The server also gains protocol session tests
and
fixture graphs covering deep agents, interrupts, subgraphs, and SDK
transport
    behavior.

### Patch Changes

-   Updated dependencies \[]:
    -   @langchain/langgraph-ui@1.2.0

## @langchain/langgraph@1.3.0

### Minor Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the in-process event streaming runtime behind `streamEvents`.

LangGraph now exposes the core primitives for event-based streaming,
including
`StreamChannel`, `StreamMux`, `GraphRunStream`, `SubgraphRunStream`,
native
stream transformers, and protocol event conversion utilities. These APIs
let
graphs emit ordered protocol events, derive additional projections,
expose
custom stream channels, and bridge in-process runs to remote SDK
clients.

The runtime includes built-in transformers for messages, values,
lifecycle
    events, and subgraph discovery. It also adds support for transformer
registration during graph execution, forwarding remote `StreamChannel`
output,
subgraph-aware event routing, event log multiplexing, and
checkpoint-aware
    values streams.

This release also expands test coverage across Pregel streaming, event
    conversion, stream muxing, stream channels, run streams, lifecycle
transformers, subgraph transformers, and type-level streaming behavior.

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph-checkpoint@1.0.2
    -   @langchain/langgraph-sdk@1.9.0

## @langchain/langgraph-sdk@1.9.0

### Minor Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
the framework-agnostic event streaming SDK.

    The SDK now includes a thread-focused streaming client built around
`ThreadStream`, `SubscriptionHandle`, message assembly, media assembly,
typed
stream extensions, and pluggable protocol transports. Applications can
stream
over SSE or WebSocket, provide custom agent-server adapters, subscribe
to
values/messages/tools/custom/lifecycle/checkpoint channels, inspect and
fork
state, respond to interrupts, and replay or dedupe ordered event
streams.

This release also adds the reusable stream runtime used by the React,
Vue,
    Svelte, and Angular packages: `StreamController`, `StreamStore`,
`ChannelRegistry`, projection factories, subagent/subgraph discovery,
submission queue coordination, message metadata tracking, root message
projection, media projections, and helper types for agent/deep-agent
state and
    tool-call inference.

The client package has been reorganized into focused modules for
assistants,
threads, runs, store, protocol streaming, transports, media, messages,
and UI
helpers. New SDK documentation covers configuration, assistants,
threads, runs,
store, streaming, transports, extensions, interrupts, messages, media,
    subagents, and subgraphs.

### Patch Changes

- [#2363](https://github.com/langchain-ai/langgraphjs/pull/2363)
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)
Thanks [@cwlbraa](https://github.com/cwlbraa)! - Add a `returnMinimal`
option to `threads.update`.

## @langchain/langgraph-checkpoint@1.0.2

### Patch Changes

- [#2314](https://github.com/langchain-ai/langgraphjs/pull/2314)
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
Improve `MemorySaver` diagnostics when checkpoint writes are missing a
      `thread_id`.

The in-memory checkpointer now explains why `configurable.thread_id` is
required and includes a concrete `graph.stream(..., { configurable: {
    thread_id } })` example in the error message. This makes the new
thread-oriented event streaming flows easier to debug when an
application
      forgets to provide durable thread configuration.

## @langchain/langgraph-cli@1.2.0

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)]:
    -   @langchain/langgraph-api@1.2.0

## @langchain/langgraph-ui@1.2.0



## @example/ai-elements@0.1.15

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)]:
    -   @langchain/langgraph@1.3.0
    -   @langchain/react@1.0.0

## @examples/assistant-ui-claude@0.1.15

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)]:
    -   @langchain/langgraph@1.3.0
    -   @langchain/react@1.0.0

## @examples/ui-angular@0.0.25

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph@1.3.0
    -   @langchain/langgraph-sdk@1.9.0
    -   @langchain/angular@1.0.0

## @examples/ui-multimodal@0.0.1

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)]:
    -   @langchain/langgraph@1.3.0
    -   @langchain/react@1.0.0

## @examples/ui-react@0.0.1

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb),
[`d1e2fda`](https://github.com/langchain-ai/langgraphjs/commit/d1e2fda1b1165e122362780a62ab8d2ebff9f9b9)]:
    -   @langchain/langgraph@1.3.0
    -   @langchain/langgraph-sdk@1.9.0
    -   @langchain/react@1.0.0

## langgraph@1.0.32

### Patch Changes

- Updated dependencies
\[[`085a07f`](https://github.com/langchain-ai/langgraphjs/commit/085a07f569b6d7d79728eb7eb6eb3a0c67fcdefb)]:
    -   @langchain/langgraph@1.3.0

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-05 00:41:45 -07:00
Christian Bromann 085a07f569 feat(core): event based streaming (#2314) 
All stream v2 changes consolidated.

---------

Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-05-05 00:13:12 -07:00
dependabot[bot] fe09385cb1 chore(deps): bump the langchain group across 1 directory with 9 updates (#2358) 
Bumps the langchain group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) |
`1.3.26` | `1.3.28` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.1.40` | `1.1.43` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.3.0` |
`1.3.5` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) |
`1.4.1` | `1.4.5` |
| [@langchain/groq](https://github.com/langchain-ai/langchainjs) |
`1.1.5` | `1.2.0` |
| [@langchain/mistralai](https://github.com/langchain-ai/langchainjs) |
`1.0.7` | `1.0.8` |
| [@langchain/ollama](https://github.com/langchain-ai/langchainjs) |
`1.2.6` | `1.2.7` |
| [@langchain/classic](https://github.com/langchain-ai/langchainjs) |
`1.0.27` | `1.0.32` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.5.20`
| `0.6.0` |


Updates `@langchain/anthropic` from 1.3.26 to 1.3.28
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/anthropic's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/anthropic</code><a
href="https://github.com/1"><code>@​1</code></a>.3.27</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10726">#10726</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ad153c185b6cf813d4b7695740d9a4453d2cb63f"><code>ad153c1</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
feat(anthropic): add Claude Opus 4.7 compatibility updates</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.1.40 to 1.1.43
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10733">#10733</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
fix(core): Update inheritance behavior for tracer metadata for special
keys</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10711">#10711</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
feat(core): Add chat model and llm invocation params to traced
metadata</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `langchain` from 1.3.0 to 1.3.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">langchain's
releases</a>.</em></p>
<blockquote>
<h2>langchain@1.3.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10713">#10713</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/49ac9e7404e5a9269b9ac047711ee96dd928b231"><code>49ac9e7</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
feat(langchain): Adds ls_agent_type to create agent runs as tracing
metadata</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/589f29ce844eb252c2d5e6b0f8d26de37763a0d7"><code>589f29c</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/2e9e6969e248a53ede0659a41d0ac8dbaf291ab4"><code>2e9e696</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.41</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle"><code>@​Josh-Engle</code></a>! -
Prevent local file corruption when using <code>LocalFileStore</code></p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
</ul>
</li>
</ul>
<h2>langchain@1.3.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10693">#10693</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(agents): derive middleware hook state from invocation state</p>
<p>Prevents middleware state from leaking across threads by deriving
middleware hook input state from the current invocation state instead of
cross-node cached state.</p>
</li>
</ul>
<h2>langchain@1.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10673">#10673</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f0693657b7e5bdbf888a46d04e68431e446c7bc0"><code>f069365</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
bump langgraph dependency to 1.2.8</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6845a1ef129450cd6e75bb8a8e7390a416ab3d9c"><code>6845a1e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10690">#10690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5a6e0ab6617587f3aed19d07bf3ed91994dcdac8"><code>5a6e0ab</code></a>
fix(agents): derive middleware hook state from invocation state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10693">#10693</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/607696e8143ad30faeebb800028e244a11d46638"><code>607696e</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10696">#10696</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/1f8b2c0b863645da45114d8756dc5b66fcb43c98"><code>1f8b2c0</code></a>
chore(ci): add label-gated publish-preview workflow (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10695">#10695</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2ff51cf0688e45d5d237b2b435334b5fd987afa9"><code>2ff51cf</code></a>
fix(aws): normalize Bedrock Converse object errors for tracing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10688">#10688</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4a91db32a80a1b9da3bea4f6333eff63980b28b4"><code>4a91db3</code></a>
chore(deps): bump langsmith from 0.5.9 to 0.5.18 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10687">#10687</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/312d60536da66827791e9b0f4a9d5d9091439183"><code>312d605</code></a>
chore(deps): bump axios from 1.13.6 to 1.15.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10686">#10686</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3e071bb44ec9c80a0eb964eff089434f4edd78b2"><code>3e071bb</code></a>
chore: remove suppressed CodeQL query filter and deduplicate
paths-ignore (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/1">#1</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e5b6e1c8568115cdda53eccafbdcd23537f554c5"><code>e5b6e1c</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10682">#10682</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>
fix(openai): add index to streaming reasoning content blocks for proper
chunk...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/langchain@1.3.0...@langchain/aws@1.3.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/openai` from 1.4.1 to 1.4.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/openai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.4</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10681">#10681</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(openai): add index to streaming reasoning content blocks for proper
chunk merging</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10670">#10670</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(openai): preserve plain string responses content</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10614">#10614</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>
Thanks <a
href="https://github.com/colifran"><code>@​colifran</code></a>! -
feat(openai): imput placeholder filenames for openai file inputs</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:</p>
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/groq` from 1.1.5 to 1.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/groq's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/groq</code><a
href="https://github.com/1"><code>@​1</code></a>.2.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10603">#10603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/66effb028baf5c923501801c989c7377efb8b77a"><code>66effb0</code></a>
Thanks <a
href="https://github.com/apps/dependabot"><code>@​dependabot</code></a>!
- chore(deps): bump groq-sdk from 0.37.0 to 1.1.2</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/daece6df71e0095c7a354270667a0b851a8cee4d"><code>daece6d</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10560">#10560</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9781bff525bffdd3b6a75adfa8a30fdb4bfc505e"><code>9781bff</code></a>
fix(google): align ChatGoogle mediaResolution with Gemini scalar type
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10550">#10550</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3bd85c17869e95d5d1a67c5fccc0c4cab2646616"><code>3bd85c1</code></a>
feat(langchain): add ChatGoogle support to initChatModel (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10654">#10654</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>
feat(core): support for headless tools (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10430">#10430</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/793bc69a8af8198de9d157c21070871660e6bb13"><code>793bc69</code></a>
feat(aws): impute file name for document content blocks#963 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10658">#10658</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>
feat(openai): impute placeholder filenames for openai file inputs (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10614">#10614</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0a7a7298b719f579854e41adddb04f17dc82640b"><code>0a7a729</code></a>
fix(examples): update dependencies (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10651">#10651</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/6f8dafcb9deee169473eadaae6416ad255277a5b"><code>6f8dafc</code></a>
Bump vitest (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10649">#10649</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e89cfd29f36e0b2fee20a7443e6c30c88039d735"><code>e89cfd2</code></a>
chore(deps): bump <code>@​cloudflare/workers-types</code> from
4.20260207.0 to 4.20260402.1...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0de2c14d38716d9c66c546e18a490c5bfda75134"><code>0de2c14</code></a>
chore(deps): bump <code>@​aws-sdk/client-bedrock-agent-runtime</code>
from 3.1006.0 to 3.10...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/groq@1.1.5...@langchain/groq@1.2.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/mistralai` from 1.0.7 to 1.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/mistralai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]:
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: scaffold <code>@​langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</li>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7ea8874715f76c17d3ec3d2ff0503dd12abbc5e9"><code>7ea8874</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9716">#9716</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5707c3edc6a4d43934da0d3e7b9666b2fc144440"><code>5707c3e</code></a>
docs(internal): add AGENTS.md file (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9742">#9742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8ef152555a945c95322f28209957b69605c04c91"><code>8ef1525</code></a>
feat(google-common): support thinkingLevel parameter for Gemini models
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9738">#9738</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c28d24a8770f6d0e543cde116b0e38b3baf21301"><code>c28d24a</code></a>
fix(core): use getBufferString for message summarization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9739">#9739</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6974516b041ed12befd26e1a4cbe457865a2780"><code>f697451</code></a>
fix(langchain): keep tool call / AIMessage pairings when summarizing (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9740">#9740</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/536c7ddacd6c7f80d2edf18ab9caeeab71827ccd"><code>536c7dd</code></a>
fix(langchain): default strict to true in providerStrategy for OpenAI
compati...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/75b3b90c5fa62cbbfa678dfb01f031caed4488ef"><code>75b3b90</code></a>
fix(openai): pass runManager to _streamResponseChunks in responses API
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9737">#9737</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/13c9d5bfa3acac7ffb37642e9a50d84dc9004e88"><code>13c9d5b</code></a>
fix(openai): pass through provider-native content in ToolMessage without
stri...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5cfbedf064ffdc960cb2e5a97e37d7a5900560de"><code>5cfbedf</code></a>
fix(langchain): support callbacks property in stream (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9728">#9728</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9ac29de3d3f70c75933913d94ad9a47c6ce39c1d"><code>9ac29de</code></a>
fix(langchain-aws): add support for Amazon Nova embedding models (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9701">#9701</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/mistralai@1.0.7...@langchain/classic@1.0.8">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/ollama` from 1.2.6 to 1.2.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/ollama's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e080995bb267bf3797067ab53c96bc2a6c8e3f"><code>d3e0809</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>]:
<ul>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.40</li>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/neo4j</code><a
href="https://github.com/0"><code>@​0</code></a>.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10590">#10590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ed8cda659c893219d853a402f0fcd46e06cf7c28"><code>ed8cda6</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: scaffold <code>@​langchain/neo4j</code> provider package</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>,
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3d0922c24afcd3006fb94dcadd3ebe08fbf2383"><code>d3d0922</code></a>]:
<ul>
<li><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</li>
<li><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.1.39</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/bd72d8eb8bde1b2282c9ec88f2ebadd0747dc7b7"><code>bd72d8e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9762">#9762</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/578574906bdbd9cfce95e34030c1a3d97e63d1c1"><code>5785749</code></a>
fix(internal): fix changeset config (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9768">#9768</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/ddd72b8122e9dc68242b8467292bbee62e1dda2e"><code>ddd72b8</code></a>
chore(standard-tests): move standard-tests into ./internal (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9755">#9755</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/739d4e88cc78b8f578ab019b526c97d63d9c2144"><code>739d4e8</code></a>
Feat/xai responses implementation (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9718">#9718</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e0360d9bdc0e7725d59625902bcfc98c39931e2a"><code>e0360d9</code></a>
fix(langchain): ensure models only make on write_todo call at a time (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9761">#9761</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8619adb81f16977b3ab8d4607ad5c30f79c41e3d"><code>8619adb</code></a>
fix: add properties to check valid props (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9757">#9757</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/23be5afd59b5f4806edef11937ce5e2ba300f7ee"><code>23be5af</code></a>
feat(langchain): consolidate type generics in bags (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9517">#9517</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/85820be04995b4047a798ec44da6077cd1908d7a"><code>85820be</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9754">#9754</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a46a24983fd0fea649d950725a2673b3c435275f"><code>a46a249</code></a>
fix(core): allow shared object references in serialization (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9753">#9753</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3c8ba0d97f1c08e8f8c67ffddff5d57daba46f85"><code>3c8ba0d</code></a>
chore(internal): Turborepo improvements (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/9744">#9744</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/ollama@1.2.6...langchain@1.2.7">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/classic` from 1.0.27 to 1.0.32
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/classic's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.31</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/9386">#9386</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/71e53f1c07bc60e2c2304b10f0edd3c85c62b192"><code>71e53f1</code></a>
Thanks <a
href="https://github.com/Josh-Engle"><code>@​Josh-Engle</code></a>! -
Prevent local file corruption when using
<code>LocalFileStore</code></li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.30</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/2301260ae90ead5c5f725c8dae1487b6722607e2"><code>2301260</code></a>]:
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.4</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/6b8ef6c95e061af47af206926598c983d878f72a"><code>6b8ef6c</code></a>]:
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.3</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/classic</code><a
href="https://github.com/1"><code>@​1</code></a>.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10591">#10591</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d7a98cda1a5d9bf9b93b503fc54374f1aaf1a37e"><code>d7a98cd</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat: add <code>@​langchain/perplexity</code> standalone provider
package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10594">#10594</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/884c2d3d1b2c49225d73ddec2235ad174db36f86"><code>884c2d3</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat(fireworks): extract standalone provider package</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10593">#10593</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/0fb6fa40dcd3a09a4fb91f36c9f2ca869552961e"><code>0fb6fa4</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- feat(together-ai): migrate Together AI into provider package</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langchainjs/commit/d6bf4fc91b2c2eb931bf3bc7606b1817632bc8c1"><code>d6bf4fc</code></a>]:</p>
<ul>
<li><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langchainjs/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `langsmith` from 0.5.20 to 0.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(js): bump JS to 0.4.3 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2253">langchain-ai/langsmith-sdk#2253</a></li>
<li>Revert &quot;feat: add js prompt caching&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2258">langchain-ai/langsmith-sdk#2258</a></li>
<li>Revert &quot;feat: Replace UUID5 with deterministic UUID7 for
replicas&quot; by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2257">langchain-ai/langsmith-sdk#2257</a></li>
<li>release(js): bump to 0.4.4 by <a
href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2259">langchain-ai/langsmith-sdk#2259</a></li>
<li>feat: add prompt cache back and setup environment tests by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2260">langchain-ai/langsmith-sdk#2260</a></li>
<li>feat(python): Bump pydantic to v2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2248">langchain-ai/langsmith-sdk#2248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.2...v0.6.0</a></p>
<h2>v0.6.0rc0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(js): Add support for tracing AI SDK 6 by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2237">langchain-ai/langsmith-sdk#2237</a></li>
<li>fix(js): Remove default Jestlike timeout by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2243">langchain-ai/langsmith-sdk#2243</a></li>
<li>feat(js): Add support for tracing tool loop agent by <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2244">langchain-ai/langsmith-sdk#2244</a></li>
<li>feat: Replace UUID5 with deterministic UUID7 for replicas by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2249">langchain-ai/langsmith-sdk#2249</a></li>
<li>feat: add prompt caching to python sdk by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2246">langchain-ai/langsmith-sdk#2246</a></li>
<li>feat: add js prompt caching by <a
href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2251">langchain-ai/langsmith-sdk#2251</a></li>
<li>fix(claude): correctly parse llm and tool inputs in claude agent sdk
by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2255">langchain-ai/langsmith-sdk#2255</a></li>
<li>bump(python): 0.5.2 by <a
href="https://github.com/angus-langchain"><code>@​angus-langchain</code></a>
in <a
href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2256">langchain-ai/langsmith-sdk#2256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.5.1...v0.6.0rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.6.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-04 22:42:09 -07:00
John Kennedy 7f3320cda8 fix: patch 6 medium-severity security alerts (#2333) 
## Security Alert Patch (medium-tier follow-up)

Follow-up to #2329, which patched the critical+high tier. This PR
resolves the remaining **6 medium-severity Dependabot alerts** via
`pnpm.overrides` plus one published-path constraint bump. All fixes are
patch/minor bumps within the current major — no breaking changes.

### Packages Updated

| Package | Old Constraint | New Constraint | Strategy | Scope | CVEs
Resolved |

|---------|---------------|----------------|----------|-------|---------------|
| `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved
1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts`
devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175
(cloud metadata exfiltration) |
| `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override);
resolved **3.4.0** | C (override) | dev-only (private
`@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS
bypasses FORBID_TAGS) |
| `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new
override); resolved **1.16.0** | C (override) | dev-only (via
`@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on
cross-domain redirect) |
| `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in
`libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest
bump)** | **published** — direct dep of `@langchain/langgraph-api` |
CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming
redaction bypass) |
| `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via
`@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19
<1` (new override) | C (override) | dev-only | same as above (flushes
vulnerable transitive copies) |

*Strategy C overrides follow the existing repo pattern — axios, qs,
undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and
defu are already overridden the same way.*

### Published-path rationale

`@langchain/langgraph-api` exercises `langsmith` at runtime for tracing
and streaming, which touches the affected internal code paths (lodash
`set()` prototype-pollution guard, token-event redaction). Therefore the
fix is Strategy A (raise the published lower bound) rather than
A-lockfile — this protects end users who pin `@langchain/langgraph-api`.
The lockfile already resolved `langsmith@0.5.20` before this change, so
installs are unchanged at HEAD; the bump is a downstream-safety
constraint tightening.

### Deferred (not fixed in this PR)

- **`protobufjs@6.11.5`** (CRITICAL, CVE-2026-41242) — reached via
`@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps +
examples. `@xenova/transformers` is abandoned; the successor is
`@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross
a breaking API boundary. **Upstream issue — requires a manual migration,
tracked separately.** (See #2329 body for full context.)
- **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) —
`first_patched_version` is `null`; upstream has not released a fix.
Defer until a patched version ships.

### CVE Details

- **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname
Normalization Bypass Leads to SSRF —
https://github.com/advisories/GHSA-3p68-rc4w-qgx5
- **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud
Metadata Exfiltration via Header Injection Chain —
https://github.com/advisories/GHSA-fvcv-3m26-pcqx
- **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS`
via short-circuit evaluation —
https://github.com/advisories/GHSA-39q2-94rc-95cp
- **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication
headers to cross-domain redirect targets —
https://github.com/advisories/GHSA-r4q5-vmmm-2653
- **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype
pollution via incomplete `__proto__` guard in internal lodash `set()` —
https://github.com/advisories/GHSA-fw9q-39r9-c252
- **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass
output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv

### Linear Tickets

Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No
ticket IDs included in the title.

### Verification

- [x] Lockfile regenerated via `pnpm install --lockfile-only`
- [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors
- [x] `pnpm format:check` (oxfmt) — clean
- [x] `pnpm audit --prod` — **No known vulnerabilities found**
- [x] `pnpm typecheck` on `libs/langgraph-api` — clean
- [x] No staged secrets (`gitleaks git --staged`)

🤖 Submitted by langster-patch

Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
 2026-04-22 09:26:44 -07:00
dependabot[bot] a9db0172df chore(deps): bump hono from 4.12.12 to 4.12.14 (#2321) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.14</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Improper handling of JSX attribute names in hono/jsx SSR</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX attribute names
during server-side rendering, which could allow malformed attribute keys
to corrupt the generated HTML output and inject unintended attributes or
elements. GHSA-458j-xx4x-4375</p>
<h2>Other changes</h2>
<ul>
<li>fix(aws-lambda): handle invalid header names in request processing
(<a
href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>)
fa2c74fe</li>
</ul>
<h2>v4.12.13</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(types): infer response type from last handler in app.on
9-/10-handler overloads by <a
href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li>
<li>feat(trailing-slash): add <code>skip</code> option by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4862">honojs/hono#4862</a></li>
<li>feat(cache): add <code>onCacheNotAvailable</code> option by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4876">honojs/hono#4876</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/T4ko0522"><code>@​T4ko0522</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4865">honojs/hono#4865</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba"><code>cf2d2b7</code></a>
4.12.14</li>
<li><a
href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee"><code>66daa2e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e"><code>fa2c74f</code></a>
fix(aws-lambda): handle invalid header names in request processing (<a
href="https://redirect.github.com/honojs/hono/issues/4883">#4883</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779"><code>3779927</code></a>
4.12.13</li>
<li><a
href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720"><code>faa6c46</code></a>
feat(cache): add <code>onCacheNotAvailable</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4876">#4876</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d"><code>f23e97b</code></a>
feat(trailing-slash): add <code>skip</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4862">#4862</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb"><code>1aa32fb</code></a>
fix(types): infer response type from last handler in app.on 9- and
10-handler...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.12&new-version=4.12.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-15 19:45:00 -07:00
Hunter Lovell 9102d526c8 fix(langgraph): propagate tracer metadata defaults from configurable (#2315) 
## Summary

This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.

## Changes

### `@langchain/langgraph` (`libs/langgraph-core`)

- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
  - `thread_id`
  - `checkpoint_id`
  - `checkpoint_ns`
  - `task_id`
  - `run_id`
  - `assistant_id`
  - `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
 2026-04-15 18:48:41 -07:00
dependabot[bot] 9c1e3278fe chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 (#2300) 
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.11 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@​hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
<h2>v1.19.12</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: ignore claude setting by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/314">honojs/node-server#314</a></li>
<li>fix: request draining for early 413 responses by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/329">honojs/node-server#329</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90"><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2"><code>025c30f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9"><code>6cdb5a7</code></a>
1.19.12</li>
<li><a
href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94"><code>70250f7</code></a>
fix: request draining for early 413 responses (<a
href="https://redirect.github.com/honojs/node-server/issues/329">#329</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb"><code>cfc08b3</code></a>
chore: ignore claude setting (<a
href="https://redirect.github.com/honojs/node-server/issues/314">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-09 17:27:00 -07:00
dependabot[bot] 96a92c01a6 chore(deps): bump hono from 4.12.7 to 4.12.12 (#2301) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-08 14:34:47 -07:00
Christian Bromann 2b62610710 feat(sdk): support for headless tools (#2281) 2026-04-03 22:07:54 -07:00
dependabot[bot] 271f9750f0 chore(deps): bump the langchain group across 1 directory with 7 updates (#2270) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-01 23:59:19 -07:00
Christian Bromann d88f29ba25 chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt (#2256) 
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com>
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com>
 2026-03-30 18:08:00 -07:00
github-actions[bot] 189279529b chore: version packages (#2249) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Josh Rogers <josh@langchain.dev>
 2026-03-27 13:54:31 -04:00
github-actions[bot] a1e2abff1e chore: version packages (#2174) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-03-17 18:10:42 +00:00
Christian Bromann 92c6108f47 fix(api): adjust peer dep of @langchain/langgraph-sdk 2026-03-10 12:54:10 -07:00
Christian Bromann e051ef6aa8 feat(sdk): add vue, svelte, angular implementation of useStream hook (#2001) 
Co-authored-by: Tat Dat Duong <david@duong.cz>
 2026-03-10 10:48:46 -07:00
github-actions[bot] dc37d3cd62 chore: version packages (#2025) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-03-06 14:11:51 -08:00
Brendan Whiting cb3aa29f86 fix(langgraph-api): use UUID v7 for run IDs to fix dotted_order mismatch (#2036) 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:38:11 -08:00
Hunter Lovell 730b82d230 fix(langgraph-api): use UUIDv7 instead of UUIDv4 in embed server (#2032) 2026-03-05 20:28:04 +00:00
github-actions[bot] 6b576f08b6 chore: version packages (#1995) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-02-26 11:34:15 -08:00
Hunter Lovell 2b59ed81a3 chore: fix deps (#2005) 2026-02-26 11:01:44 -08:00
Hunter Lovell fce9d38267 feat(langgraph): add Overwrite class for bypassing channel reducers (#2002) 2026-02-25 16:28:56 -08:00
Colin Francis aa8e878e5b feat: add tools stream mode for tool lifecycle events (#1984) 2026-02-24 16:52:54 -08:00
github-actions[bot] f38b91c6ed chore: version packages (#1974) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-02-18 01:58:12 +00:00
github-actions[bot] d066129584 chore: version packages (#1961) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-02-11 13:37:13 -08:00
Hunter Lovell 4ebe31ec6e chore(api): relax langsmith dep (#1960) 2026-02-11 12:33:53 -08:00
Christian Bromann 8d5c2d688d feat(sdk): add multi-subagent tracking to useStream (#1903) 2026-02-05 17:14:50 -08:00
github-actions[bot] 289cc95bea chore: version packages (#1941) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io>
 2026-02-04 18:07:19 -08:00
Hunter Lovell ad39dcfddf fix(langgraph-api): enhance cli JSON schema extraction (#1939) 2026-02-04 15:53:41 -08:00
Christian Bromann b470748990 fix(ci): make pipeline for effective and secure (#1870) 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
 2026-01-10 19:13:31 -08:00
github-actions[bot] 658496f67a chore: version packages (#1872) 2026-01-10 13:32:54 -07:00
Andrew Nguonly 2b9f3ee83d feat: Add option to delete threads if assistant is deleted (#1873) 2026-01-10 03:44:38 +01:00
David Duong 6d5cdcbb10 fix(chore): replace turbo:command with plain turbo (#1869) 2026-01-09 19:16:10 +00:00
github-actions[bot] 1f36303245 chore: version packages (#1868) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-01-09 11:03:26 -08:00
David Duong e7aeffeb72 chore: replace yarn with pnpm (#1862) 
Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-01-09 19:52:29 +01:00
github-actions[bot] b949b85ebd chore: version packages (#1857) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-01-08 23:52:48 -08:00
github-actions[bot] 5b98e5c257 chore: version packages (#1854) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-01-08 18:41:30 -08:00