aba243a403
chore: version packages ( #2313 )
...
This PR was opened by the [Changesets
release](https://github.com/changesets/action ) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @langchain/langgraph@1.2.9
### Patch Changes
- [#2315 ](https://github.com/langchain-ai/langgraphjs/pull/2315 )
[`9102d52`](https://github.com/langchain-ai/langgraphjs/commit/9102d526c858a4cdbe9b47dcdd062b93da93e49f )
Thanks [@hntrl](https://github.com/hntrl )! - propagate tracer metadata
defaults from configurable
- [#2311 ](https://github.com/langchain-ai/langgraphjs/pull/2311 )
[`b7c196b`](https://github.com/langchain-ai/langgraphjs/commit/b7c196b2142fb888dfcd9ceb1dfb4365d803c8b6 )
Thanks [@open-swe](https://github.com/apps/open-swe )! - fix: export
missing types for typescript 6.0 declaration file compatibility
- Updated dependencies
\[[`458d66b`](https://github.com/langchain-ai/langgraphjs/commit/458d66bf665468854abb8133594d4d4f966054ed )]:
- @langchain/langgraph-sdk@1.8.9
## @langchain/langgraph-sdk@1.8.9
### Patch Changes
- [#2302 ](https://github.com/langchain-ai/langgraphjs/pull/2302 )
[`458d66b`](https://github.com/langchain-ai/langgraphjs/commit/458d66bf665468854abb8133594d4d4f966054ed )
Thanks [@AdrianSajjan](https://github.com/AdrianSajjan )! - fix(sdk):
preserve messages on interrupt values events
Add a regression test for interrupt-only `values` payloads to ensure
previously streamed messages are not overwritten when `__interrupt__` is
emitted.
## @example/ai-elements@0.1.12
### Patch Changes
- Updated dependencies
\[[`9102d52`](https://github.com/langchain-ai/langgraphjs/commit/9102d526c858a4cdbe9b47dcdd062b93da93e49f ),
[`b7c196b`](https://github.com/langchain-ai/langgraphjs/commit/b7c196b2142fb888dfcd9ceb1dfb4365d803c8b6 )]:
- @langchain/langgraph@1.2.9
## @examples/assistant-ui-claude@0.1.12
### Patch Changes
- Updated dependencies
\[[`9102d52`](https://github.com/langchain-ai/langgraphjs/commit/9102d526c858a4cdbe9b47dcdd062b93da93e49f ),
[`b7c196b`](https://github.com/langchain-ai/langgraphjs/commit/b7c196b2142fb888dfcd9ceb1dfb4365d803c8b6 )]:
- @langchain/langgraph@1.2.9
## @examples/ui-angular@0.0.22
### Patch Changes
- Updated dependencies
\[[`458d66b`](https://github.com/langchain-ai/langgraphjs/commit/458d66bf665468854abb8133594d4d4f966054ed ),
[`9102d52`](https://github.com/langchain-ai/langgraphjs/commit/9102d526c858a4cdbe9b47dcdd062b93da93e49f ),
[`b7c196b`](https://github.com/langchain-ai/langgraphjs/commit/b7c196b2142fb888dfcd9ceb1dfb4365d803c8b6 )]:
- @langchain/langgraph-sdk@1.8.9
- @langchain/langgraph@1.2.9
## langgraph@1.0.31
### Patch Changes
- Updated dependencies
\[[`9102d52`](https://github.com/langchain-ai/langgraphjs/commit/9102d526c858a4cdbe9b47dcdd062b93da93e49f ),
[`b7c196b`](https://github.com/langchain-ai/langgraphjs/commit/b7c196b2142fb888dfcd9ceb1dfb4365d803c8b6 )]:
- @langchain/langgraph@1.2.9
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-04-16 07:07:37 +00:00
ac9947f64d
chore(deps): bump langsmith from 0.5.19 to 0.5.20 ( #2323 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.19 to 0.5.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-16 03:45:01 +00:00
a9db0172df
chore(deps): bump hono from 4.12.12 to 4.12.14 ( #2321 )
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.12 to 4.12.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases ">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.14</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Improper handling of JSX attribute names in hono/jsx SSR</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX attribute names
during server-side rendering, which could allow malformed attribute keys
to corrupt the generated HTML output and inject unintended attributes or
elements. GHSA-458j-xx4x-4375</p>
<h2>Other changes</h2>
<ul>
<li>fix(aws-lambda): handle invalid header names in request processing
(<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)
fa2c74fe</li>
</ul>
<h2>v4.12.13</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(types): infer response type from last handler in app.on
9-/10-handler overloads by <a
href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
<li>feat(trailing-slash): add <code>skip</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4862 ">honojs/hono#4862</a></li>
<li>feat(cache): add <code>onCacheNotAvailable</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4876 ">honojs/hono#4876</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 ">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba "><code>cf2d2b7</code></a>
4.12.14</li>
<li><a
href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee "><code>66daa2e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e "><code>fa2c74f</code></a>
fix(aws-lambda): handle invalid header names in request processing (<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779 "><code>3779927</code></a>
4.12.13</li>
<li><a
href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720 "><code>faa6c46</code></a>
feat(cache): add <code>onCacheNotAvailable</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4876 ">#4876</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d "><code>f23e97b</code></a>
feat(trailing-slash): add <code>skip</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4862 ">#4862</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb "><code>1aa32fb</code></a>
fix(types): infer response type from last handler in app.on 9- and
10-handler...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-15 19:45:00 -07:00
9102d526c8
fix(langgraph): propagate tracer metadata defaults from configurable ( #2315 )
...
## Summary
This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.
## Changes
### `@langchain/langgraph` (`libs/langgraph-core`)
- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
- `thread_id`
- `checkpoint_id`
- `checkpoint_ns`
- `task_id`
- `run_id`
- `assistant_id`
- `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
2026-04-15 18:48:41 -07:00
7da383a8e6
chore(deps-dev): bump vite from 7.3.1 to 7.3.2 ( #2297 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite )
from 7.3.1 to 7.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.3.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2 ">7.3.2</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161 ">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 ">09d8c90</a>)</li>
<li>backport <a
href="https://redirect.github.com/vitejs/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22162 ">#22162</a>)
(<a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 ">19db0f2</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160 ">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 ">f8103cc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999 "><code>cc383e0</code></a>
release: v7.3.2</li>
<li><a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 "><code>09d8c90</code></a>
fix: avoid path traversal with optimize deps sourcemap handler (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161 ">#22161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 "><code>f8103cc</code></a>
fix: check <code>server.fs</code> after stripping query as well (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160 ">#22160</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 "><code>19db0f2</code></a>
fix: backport <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162 ">#22162</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-16 01:43:26 +00:00
5a0d0d0155
chore(deps): bump langsmith from 0.5.18 to 0.5.19 ( #2319 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.18 to 0.5.19.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-14 16:51:50 -07:00
e3ff7735eb
ci: add PR title lint workflow ( #2318 )
...
## Summary
Adds pull request title linting to enforce Conventional Commit style
titles in this repository.
## Changes
- Add .github/workflows/pr_lint.yml
- Reject empty scopes in PR titles (for example, fix(): ...)
- Validate title format via amannn/action-semantic-pull-request
- Allow langgraphjs package/area scopes and ignore label override
2026-04-14 14:24:40 -07:00
458d66bf66
Prevent values from getting overrwritten on interrupt event ( #2302 )
...
Issue:
In multi-agent sustem with handoffs like this example:
https://docs.langchain.com/oss/python/langchain/multi-agent/handoffs#multiple-agent-subgraphs ,
if we trigger an interrupt from an agent within a swarm workflow, the
interrupt is propagated and sent twice, the last interrupt contains
values from the main graphs state, which is always going to be behind
the state of the agent from where interrupt is triggered. So,
temporarily, the message data becomes empty, it gets refilled when
interrupt is resumed
Fixes:
Do not update values when interrupt is recieved, just update the
interrupt in the state with the latest __interrupt data.
---------
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-04-14 12:54:08 -07:00
b7c196b214
fix: export missing types for typescript 6.0 declaration file compatibility ( #2311 )
...
## Description
TypeScript 6.0 requires that any type emitted to a declaration file is
reachable via the package's `exports` field. Several types used in
`StateGraph`'s public API (class extends clause, constructor overloads,
method signatures) were not exported from the package entrypoints,
causing TS6 consumers to fail when exporting `StateGraph` instances from
their own packages.
Adds exports for: `ToStateDefinition`, `StateGraphNodeSpec`, `NodeSpec`,
`AddNodeOptions`, `StateGraphAddNodeOptions`,
`StateGraphArgsWithStateSchema`, `StateGraphArgsWithInputOutputSchemas`,
`CachePolicy`, `AnyStateSchema`, `StateSchemaFieldToChannel`,
`StateSchemaFieldsToStateDefinition`.
## Test Plan
- [ ] Verify a TS6 project can export a `StateGraph` instance without
declaration file errors
- [ ] Build passes with `pnpm build`
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-04-13 10:28:29 -07:00
aa2cfc8bf7
chore(deps): bump langsmith from 0.5.16 to 0.5.18 ( #2307 )
...
Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk ) from
0.5.16 to 0.5.18.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/langchain-ai/langsmith-sdk/commits ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-10 13:58:27 -07:00
af76eb76f4
chore(deps): bump vite from 7.3.1 to 7.3.2 in /internal/environment_tests/test-exports-vite in the npm_and_yarn group across 1 directory ( #2299 )
...
Bumps the npm_and_yarn group with 1 update in the
/internal/environment_tests/test-exports-vite directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ).
Updates `vite` from 7.3.1 to 7.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.3.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2 ">7.3.2</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161 ">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 ">09d8c90</a>)</li>
<li>backport <a
href="https://redirect.github.com/vitejs/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22162 ">#22162</a>)
(<a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 ">19db0f2</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160 ">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 ">f8103cc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999 "><code>cc383e0</code></a>
release: v7.3.2</li>
<li><a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 "><code>09d8c90</code></a>
fix: avoid path traversal with optimize deps sourcemap handler (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161 ">#22161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 "><code>f8103cc</code></a>
fix: check <code>server.fs</code> after stripping query as well (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160 ">#22160</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 "><code>19db0f2</code></a>
fix: backport <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162 ">#22162</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 23:06:51 -07:00
9c1e3278fe
chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 ( #2300 )
...
Bumps [@hono/node-server](https://github.com/honojs/node-server ) from
1.19.11 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases "><code>@hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
<h2>v1.19.12</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: ignore claude setting by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/314 ">honojs/node-server#314</a></li>
<li>fix: request draining for early 413 responses by <a
href="https://github.com/usualoma "><code>@usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/329 ">honojs/node-server#329</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 ">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90 "><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2 "><code>025c30f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9 "><code>6cdb5a7</code></a>
1.19.12</li>
<li><a
href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94 "><code>70250f7</code></a>
fix: request draining for early 413 responses (<a
href="https://redirect.github.com/honojs/node-server/issues/329 ">#329</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb "><code>cfc08b3</code></a>
chore: ignore claude setting (<a
href="https://redirect.github.com/honojs/node-server/issues/314 ">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 17:27:00 -07:00
96a92c01a6
chore(deps): bump hono from 4.12.7 to 4.12.12 ( #2301 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 14:34:47 -07:00
9e9807523f
chore: version packages ( #2294 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-04-07 08:14:22 -07:00
e42c2c8836
feat: enhance runtime with executionInfo and serverInfo ( #2275 )
...
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
Co-authored-by: Sydney Runkle <54324534+sydney-runkle@users.noreply.github.com >
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com >
2026-04-05 21:15:56 -07:00
2a5b85bf55
chore: version packages ( #2293 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 18:28:15 -07:00
d74ef958ba
chore(sdk): strengthen framework browser stream tests ( #2289 )
2026-04-05 18:22:58 -07:00
33293c7f3f
fix(sdk): buffer subagent messages instead of dropping them ( #2292 )
2026-04-05 18:22:36 -07:00
89fed91da2
chore: version packages ( #2291 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 17:41:29 -07:00
4cddca61ce
fix(vue): actually make it reactive ( #2290 )
2026-04-05 17:36:19 -07:00
3a81396657
chore: version packages ( #2288 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 16:29:22 -07:00
591d2dc70e
fix(sdk): subagent stream reactivity ( #2287 )
2026-04-05 16:25:53 -07:00
29f071d826
chore: version packages ( #2286 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 23:09:53 -07:00
a5dfdb61c7
fix(sdk): detect interrupt for Python agents ( #2285 )
2026-04-03 23:06:34 -07:00
7176861f72
chore: version packages ( #2284 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 22:29:39 -07:00
b4a841c4b3
fix(sdk): bump all packages
2026-04-03 22:26:13 -07:00
ed1107df54
chore: version packages ( #2283 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 22:14:06 -07:00
2b62610710
feat(sdk): support for headless tools ( #2281 )
2026-04-03 22:07:54 -07:00
90631859ba
fix: patch 7 security alerts (high+medium severity) ( #2282 )
...
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-04-04 03:43:41 +00:00
37e10413af
chore: version packages ( #2280 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 14:01:42 -07:00
264220cff8
fix: include vue in release
2026-04-03 13:58:15 -07:00
3bbb3ff65a
fix(sdk): better type inferrence ( #2279 )
2026-04-03 13:53:35 -07:00
0d04099958
fix(vue): Make subagents accessible once they are spun up ( #2278 )
2026-04-03 13:53:16 -07:00
b9bd6aec1d
chore: version packages ( #2277 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 10:06:16 -07:00
e72c8e769e
chore(deps-dev): bump the svelte group across 1 directory with 3 updates ( #2272 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-04-03 09:59:39 -07:00
05810fe087
Fix Vue subagent grouping during streaming ( #2274 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-04-03 09:43:26 -07:00
2bb2ed4565
chore(deps): bump the vue group across 1 directory with 4 updates ( #2273 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hunter Lovell <hunter@hntrl.io >
2026-04-02 00:37:15 -07:00
271f9750f0
chore(deps): bump the langchain group across 1 directory with 7 updates ( #2270 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 23:59:19 -07:00
981853c019
chore: version packages ( #2264 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-01 21:31:17 -07:00
73ae630253
chore(deps): bump the angular group with 13 updates ( #2271 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 21:30:32 -07:00
950ab9a12c
chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 in the minor-and-patch group ( #2265 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 20:03:11 -07:00
842c54e06d
chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 ( #2266 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 20:02:36 -07:00
7dadddb170
chore(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 ( #2267 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 20:02:27 -07:00
aea45cd8fb
chore(deps): bump pnpm/action-setup from 4.2.0 to 5.0.0 ( #2268 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 20:02:19 -07:00
936b48b280
fix(sdk): restore snake_case interrupt aliases ( #2263 )
2026-04-01 14:57:37 -07:00
0b51ec611f
chore: version packages ( #2254 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-31 13:22:13 -07:00
4d2963c313
fix: patch 11 security alerts (critical+high severity) ( #2258 )
...
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
2026-03-31 13:09:10 -07:00
d9d807ebb0
fix(sdk): accumulate parallel interrupts in StreamManager ( #2204 )
...
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-03-31 13:08:33 -07:00
ea19bd95ec
ci: tighten top-level release permissions to contents: read ( #2259 )
2026-03-31 14:36:07 -04:00
d88f29ba25
chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt ( #2256 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com >
2026-03-30 18:08:00 -07:00
github-actions[bot]