a9db0172df
chore(deps): bump hono from 4.12.12 to 4.12.14 ( #2321 )
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.12 to 4.12.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases ">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.14</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Improper handling of JSX attribute names in hono/jsx SSR</h3>
<p>Affects: hono/jsx. Fixes missing validation of JSX attribute names
during server-side rendering, which could allow malformed attribute keys
to corrupt the generated HTML output and inject unintended attributes or
elements. GHSA-458j-xx4x-4375</p>
<h2>Other changes</h2>
<ul>
<li>fix(aws-lambda): handle invalid header names in request processing
(<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)
fa2c74fe</li>
</ul>
<h2>v4.12.13</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(types): infer response type from last handler in app.on
9-/10-handler overloads by <a
href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
<li>feat(trailing-slash): add <code>skip</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4862 ">honojs/hono#4862</a></li>
<li>feat(cache): add <code>onCacheNotAvailable</code> option by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4876 ">honojs/hono#4876</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/T4ko0522 "><code>@T4ko0522</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4865 ">honojs/hono#4865</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 ">https://github.com/honojs/hono/compare/v4.12.12...v4.12.13 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/cf2d2b7edcf07adef2db7614557f4d7f9e2be7ba "><code>cf2d2b7</code></a>
4.12.14</li>
<li><a
href="https://github.com/honojs/hono/commit/66daa2edef8965544c04fcad82c596ab2acdb5ee "><code>66daa2e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa2c74fe5c3ce996d025d9d97bf5670c207bb82e "><code>fa2c74f</code></a>
fix(aws-lambda): handle invalid header names in request processing (<a
href="https://redirect.github.com/honojs/hono/issues/4883 ">#4883</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/3779927c17201dc6bfd20697f0e1ec65407da779 "><code>3779927</code></a>
4.12.13</li>
<li><a
href="https://github.com/honojs/hono/commit/faa6c46a1aa3a8b792b29e20fc93bcd6d2a4d720 "><code>faa6c46</code></a>
feat(cache): add <code>onCacheNotAvailable</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4876 ">#4876</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/f23e97b7f300bcb8571ae864010b8f7cdb5d0d5d "><code>f23e97b</code></a>
feat(trailing-slash): add <code>skip</code> option (<a
href="https://redirect.github.com/honojs/hono/issues/4862 ">#4862</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/1aa32fb91e7bc1366811d80ebcce61ec0d0c68cb "><code>1aa32fb</code></a>
fix(types): infer response type from last handler in app.on 9- and
10-handler...</li>
<li>See full diff in <a
href="https://github.com/honojs/hono/compare/v4.12.12...v4.12.14 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-15 19:45:00 -07:00
9102d526c8
fix(langgraph): propagate tracer metadata defaults from configurable ( #2315 )
...
## Summary
This updates Pregel callback manager initialization to pass
`tracerInheritableMetadata` defaults derived from `config.configurable`,
and narrows `ensureLangGraphConfig` metadata mirroring to the
allowlisted LangGraph identifiers used in stream/runtime metadata.
## Changes
### `@langchain/langgraph` (`libs/langgraph-core`)
- Updated Pregel callback manager setup to configure core callbacks with
`tracerInheritableMetadata` based on configurable primitive values,
excluding internal and secret-like keys.
- Hoisted tracing default logic into `_getTracingMetadataDefaults` and
`_excludeAsMetadata` for parity with the Python implementation shape.
- Restricted `ensureLangGraphConfig` configurable-to-metadata
propagation to the identifier allowlist:
- `thread_id`
- `checkpoint_id`
- `checkpoint_ns`
- `task_id`
- `run_id`
- `assistant_id`
- `graph_id`
- Updated config tests to assert the narrowed metadata propagation
behavior.
2026-04-15 18:48:41 -07:00
7da383a8e6
chore(deps-dev): bump vite from 7.3.1 to 7.3.2 ( #2297 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite )
from 7.3.1 to 7.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases ">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.3.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md ">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2 ">7.3.2</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161 ">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 ">09d8c90</a>)</li>
<li>backport <a
href="https://redirect.github.com/vitejs/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22162 ">#22162</a>)
(<a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 ">19db0f2</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160 ">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 ">f8103cc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/cc383e07b66d4c5a9768fcb570e0af812cb8d999 "><code>cc383e0</code></a>
release: v7.3.2</li>
<li><a
href="https://github.com/vitejs/vite/commit/09d8c903bde12fee2710314d3b42bc789c686df7 "><code>09d8c90</code></a>
fix: avoid path traversal with optimize deps sourcemap handler (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161 ">#22161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f8103cc946f137a54e395fe3f5d08e8209231ed6 "><code>f8103cc</code></a>
fix: check <code>server.fs</code> after stripping query as well (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160 ">#22160</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/19db0f29c3a3ac4e64cc95c270716c77fd223ad1 "><code>19db0f2</code></a>
fix: backport <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159 ">#22159</a>,
apply server.fs check to env transport (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162 ">#22162</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-16 01:43:26 +00:00
9c1e3278fe
chore(deps): bump @hono/node-server from 1.19.11 to 1.19.13 ( #2300 )
...
Bumps [@hono/node-server](https://github.com/honojs/node-server ) from
1.19.11 to 1.19.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases "><code>@hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.13</h2>
<h2>Security Fix</h2>
<p>Fixed an issue in Serve Static Middleware where inconsistent handling
of repeated slashes (<code>//</code>) between the router and static file
resolution could allow middleware to be bypassed. Users of Serve Static
Middleware are encouraged to upgrade to this version.</p>
<p>See GHSA-92pp-h63x-v22m for details.</p>
<h2>v1.19.12</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: ignore claude setting by <a
href="https://github.com/yusukebe "><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/314 ">honojs/node-server#314</a></li>
<li>fix: request draining for early 413 responses by <a
href="https://github.com/usualoma "><code>@usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/329 ">honojs/node-server#329</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 ">https://github.com/honojs/node-server/compare/v1.19.11...v1.19.12 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/fd64e659a34ec661fd9ccda00d1b9dff88dfaf90 "><code>fd64e65</code></a>
1.19.13</li>
<li><a
href="https://github.com/honojs/node-server/commit/025c30f55d589ddbe6048b151d77e904f67a8cc2 "><code>025c30f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/6cdb5a724952f3df5748e435637792068ebea6d9 "><code>6cdb5a7</code></a>
1.19.12</li>
<li><a
href="https://github.com/honojs/node-server/commit/70250f780ec99d2ddc0dd8275a42f8e091e06e94 "><code>70250f7</code></a>
fix: request draining for early 413 responses (<a
href="https://redirect.github.com/honojs/node-server/issues/329 ">#329</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/cfc08b330a1f2e0a2d8cc7797cde389465b5f4fb "><code>cfc08b3</code></a>
chore: ignore claude setting (<a
href="https://redirect.github.com/honojs/node-server/issues/314 ">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.11...v1.19.13 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 17:27:00 -07:00
96a92c01a6
chore(deps): bump hono from 4.12.7 to 4.12.12 ( #2301 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 14:34:47 -07:00
2a5b85bf55
chore: version packages ( #2293 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 18:28:15 -07:00
d74ef958ba
chore(sdk): strengthen framework browser stream tests ( #2289 )
2026-04-05 18:22:58 -07:00
89fed91da2
chore: version packages ( #2291 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 17:41:29 -07:00
4cddca61ce
fix(vue): actually make it reactive ( #2290 )
2026-04-05 17:36:19 -07:00
3a81396657
chore: version packages ( #2288 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-05 16:29:22 -07:00
591d2dc70e
fix(sdk): subagent stream reactivity ( #2287 )
2026-04-05 16:25:53 -07:00
29f071d826
chore: version packages ( #2286 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 23:09:53 -07:00
a5dfdb61c7
fix(sdk): detect interrupt for Python agents ( #2285 )
2026-04-03 23:06:34 -07:00
7176861f72
chore: version packages ( #2284 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 22:29:39 -07:00
ed1107df54
chore: version packages ( #2283 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 22:14:06 -07:00
2b62610710
feat(sdk): support for headless tools ( #2281 )
2026-04-03 22:07:54 -07:00
37e10413af
chore: version packages ( #2280 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-03 14:01:42 -07:00
0d04099958
fix(vue): Make subagents accessible once they are spun up ( #2278 )
2026-04-03 13:53:16 -07:00
271f9750f0
chore(deps): bump the langchain group across 1 directory with 7 updates ( #2270 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 23:59:19 -07:00
73ae630253
chore(deps): bump the angular group with 13 updates ( #2271 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 21:30:32 -07:00
0b51ec611f
chore: version packages ( #2254 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-31 13:22:13 -07:00
d88f29ba25
chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt ( #2256 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com >
2026-03-30 18:08:00 -07:00
76a0a94ff5
Angular event callback tests ( #2253 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-30 08:06:06 -07:00
9905dd102e
chore: version packages ( #2238 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-26 10:37:47 -07:00
88726dfe22
Extract shared WithClassMessages<T> type to @langchain/langgraph-sdk/ui ( #2237 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-22 11:34:20 -07:00
1b597f124e
fix(angular): resolve non-idiomatic patterns ( #2235 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-22 10:50:05 -07:00
c52ba278eb
fix(angular): sync isLoading signal in custom transport ( #2234 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-22 10:43:53 -07:00
d4456c06f4
chore: version packages ( #2232 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-20 15:25:27 -07:00
414a7adf90
feat: extract shared orchestrator to eliminate duplicated code across SDK packages ( #2227 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-20 14:10:14 -07:00
9aa8339ef5
angular: type StreamService._stream properly instead of any ( #2229 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-20 11:17:03 -07:00
13d117ec90
feat(angular): use injectStream/injectStreamCustom ( #2226 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-20 10:26:58 -07:00
c8185ddb4b
chore: version packages ( #2216 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-20 00:33:55 -07:00
09b9b60fe5
feat: add provider/context patterns for React, Vue, Angular, and Svelte SDKs ( #2223 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-20 00:10:50 -07:00
dbbc943ca4
feat(angular): add StreamService @Injectable() class ( #2219 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-19 23:22:22 -07:00
5460157725
Add Angular 21 to @angular/core peer dependency range ( #2217 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com >
2026-03-19 23:10:38 -07:00
fe4dd5b85d
Revert "chore: version packages ( #2203 )"
...
This reverts commit c75409d461
2026-03-19 22:45:52 -07:00
c75409d461
chore: version packages ( #2203 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-19 21:39:21 -07:00
a55b6fe3a0
Forward streamSubgraphs in custom transports ( #2215 )
...
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-03-19 21:33:51 -07:00
963db6fbc7
fix(sdk): fetch subagent history ( #2191 )
2026-03-19 21:29:17 -07:00
bd02965cdf
fix(react/vue/svelte/angular): clean up Readme and dev deps ( #2214 )
2026-03-19 21:17:12 -07:00
b07b994043
chore(deps): bump @angular/compiler from 21.2.4 to 21.2.5 ( #2212 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 13:35:19 -07:00
a7f4935ca6
chore(deps): bump @angular/core from 21.2.4 to 21.2.5 ( #2211 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 13:18:53 -07:00
2b775302b6
fix(sdk): support onFinish callback in custom transport ( #2199 )
2026-03-18 18:36:46 -07:00
6d84e2b53d
chore(deps): bump @angular/core from 21.2.2 to 21.2.4 ( #2184 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-15 21:11:45 -07:00
7da8b64394
chore(deps): bump @angular/compiler from 21.2.2 to 21.2.4 ( #2185 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-15 20:56:30 -07:00
f4ed01eb2f
chore: version packages ( #2167 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-10 17:39:14 -07:00
745112c0d7
fix: use optimistic threadId in a custom stream ( #2014 )
...
Co-authored-by: Christian Bromann <git@bromann.dev >
2026-03-10 17:29:34 -07:00
8faf05c939
feat(sdk): convert history messages to BaseMessage instances in framework SDKs ( #2165 )
2026-03-10 17:22:18 -07:00
3f01111b9c
chore: version packages ( #2164 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-10 14:34:23 -07:00
b518c474f6
fix(sdk): update deps ( #2162 )
2026-03-10 14:31:03 -07:00
dependabot[bot]