mirror of
https://github.com/langchain-ai/langgraphjs.git
synced 2026-08-24 21:51:39 -04:00
@langchain/langgraph-sdk@1.9.31
93 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 John Kennedy
|
841466e060 |
chore: patch vulnerable transitive dependencies (#2682)
## Summary Patch the currently open Dependabot alerts in `pnpm-lock.yaml` by tightening the existing root pnpm overrides and regenerating the lockfile: - `js-yaml` 4.x → 4.3.1 - `dompurify` → 3.4.13 - `mermaid` → 11.16.1 (covers five advisories) - `undici` 6.x → 6.28.0 and 7.x → 7.29.0 (covers seven advisory/major-version alert instances) - `postcss` → 8.5.25 The remaining `@hono/node-server` alert is already stale on `main`: the lockfile resolves 1.19.17 and 2.1.0, both outside the advisory's vulnerable `<2.0.5` range (the 1.x line is not affected by that range). ## Validation - `pnpm install --frozen-lockfile` - `pnpm run format:check` - Verified every affected package resolution in `pnpm-lock.yaml` is outside the corresponding vulnerable range ## Scope Dependency overrides and generated `pnpm-lock.yaml` only; no runtime code changes. Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cac6d31065 |
chore(deps): bump the vite-vitest group across 1 directory with 6 updates (#2644)
Bumps the vite-vitest group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.10.8` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.2.0` | | [rollup](https://github.com/rollup/rollup) | `4.59.0` | `4.62.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` | | [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright) | `4.1.9` | `4.1.10` | | [@vitest/browser-webdriverio](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-webdriverio) | `4.1.9` | `4.1.10` | Updates `turbo` from 2.9.14 to 2.10.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.8</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>fix: Scroll TUI task list with mouse wheel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13479">vercel/turborepo#13479</a></li> <li>fix: Make releases resumable by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13486">vercel/turborepo#13486</a></li> <li>refactor: Expose knowledge-backed package scope views by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13456">vercel/turborepo#13456</a></li> <li>chore: Release Turborepo 2.10.7 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13489">vercel/turborepo#13489</a></li> <li>refactor: Use package knowledge for configuration scopes by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13457">vercel/turborepo#13457</a></li> <li>refactor: Use package knowledge for run scope enumeration by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13458">vercel/turborepo#13458</a></li> <li>release(turborepo): 2.10.8-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13490">vercel/turborepo#13490</a></li> <li>refactor: Use package knowledge in repository views by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13459">vercel/turborepo#13459</a></li> <li>refactor: Use package knowledge in package integrations by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13460">vercel/turborepo#13460</a></li> <li>ci: Parallelize environment setup steps by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13491">vercel/turborepo#13491</a></li> <li>release(turborepo): 2.10.8-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13492">vercel/turborepo#13492</a></li> <li>refactor: Use package knowledge for task hashing paths by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13461">vercel/turborepo#13461</a></li> <li>refactor: Use package knowledge for run-cache paths by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13462">vercel/turborepo#13462</a></li> <li>refactor: Bind toolchain callbacks to package knowledge by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13463">vercel/turborepo#13463</a></li> <li>refactor: Use package knowledge for microfrontend commands by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13464">vercel/turborepo#13464</a></li> <li>refactor: Use package knowledge for run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13465">vercel/turborepo#13465</a></li> <li>refactor: Use package knowledge for watcher paths by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13466">vercel/turborepo#13466</a></li> <li>ci: Enable remote cache for types codegen by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13495">vercel/turborepo#13495</a></li> <li>docs: Fix llms.txt links to page markdown routes by <a href="https://github.com/molebox"><code>@molebox</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13497">vercel/turborepo#13497</a></li> <li>refactor: Use package knowledge for prune paths by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13467">vercel/turborepo#13467</a></li> <li>refactor: Use package knowledge in the LSP by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13468">vercel/turborepo#13468</a></li> <li>refactor: Use consistent repository construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13469">vercel/turborepo#13469</a></li> <li>refactor: Delete legacy package and scope authority by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13470">vercel/turborepo#13470</a></li> <li>perf: Cache telemetry salt instead of re-reading config on every hash by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13498">vercel/turborepo#13498</a></li> <li>feat: Support Android (Termux) by <a href="https://github.com/gtbuchanan"><code>@gtbuchanan</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12735">vercel/turborepo#12735</a></li> <li>ci: Restore Cargo targets on all test platforms by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13505">vercel/turborepo#13505</a></li> <li>fix: Resolve gitdir for linked worktrees in repo index by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13503">vercel/turborepo#13503</a></li> <li>test: Characterize relationship projections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13499">vercel/turborepo#13499</a></li> <li>refactor: Produce native relationship observations by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13500">vercel/turborepo#13500</a></li> <li>feat: Resolve GitHub Actions remote base refs behind future flag by <a href="https://github.com/louis-bompart"><code>@louis-bompart</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/10732">vercel/turborepo#10732</a></li> <li>refactor: Add core relationship projections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13502">vercel/turborepo#13502</a></li> <li>refactor: Define external resolution contracts by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13507">vercel/turborepo#13507</a></li> <li>refactor: Move repository tasks into Turbo configuration by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13504">vercel/turborepo#13504</a></li> <li>refactor: Build JavaScript external resolution generations by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13508">vercel/turborepo#13508</a></li> <li>refactor: Contribute Cargo external resolutions by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13509">vercel/turborepo#13509</a></li> <li>refactor: Migrate external declaration consumers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13511">vercel/turborepo#13511</a></li> <li>ci: Auto-merge release PRs by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13510">vercel/turborepo#13510</a></li> <li>chore: Release Turborepo 2.10.8-canary.3 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13512">vercel/turborepo#13512</a></li> <li>fix: Use tokenless release review gate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13513">vercel/turborepo#13513</a></li> <li>refactor: Use resolution fingerprints for task hashes by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13514">vercel/turborepo#13514</a></li> <li>fix: Support fork PRs in review gate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13516">vercel/turborepo#13516</a></li> <li>refactor: Migrate lockfile affectedness by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13519">vercel/turborepo#13519</a></li> <li>refactor: Migrate external resolution summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13520">vercel/turborepo#13520</a></li> <li>refactor: Migrate external package queries to resolution knowledge by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13523">vercel/turborepo#13523</a></li> <li>fix: Serialize macOS Homebrew setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13549">vercel/turborepo#13549</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/2515f8b181ad49aaf933893b1688fb08447001a3"><code>2515f8b</code></a> publish 2.10.8 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/dd87718f0036b93324df66b26fdf37056094b5d0"><code>dd87718</code></a> test: Add uv workspace integration coverage (<a href="https://redirect.github.com/vercel/turborepo/issues/13602">#13602</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/b3dc99b98a6fb7db9eabd23ae0b601100cb66162"><code>b3dc99b</code></a> fix: Fall back to polling on macOS (<a href="https://redirect.github.com/vercel/turborepo/issues/13622">#13622</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/f8f288e6b16f59a0261d9ef2c47e698b472b39b2"><code>f8f288e</code></a> feat: Prune uv workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13613">#13613</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/b2e25d4971ac18373f872a98796d13ecfc26128b"><code>b2e25d4</code></a> feat: Watch uv workspace changes (<a href="https://redirect.github.com/vercel/turborepo/issues/13612">#13612</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/00538d09752961e2e42654a26196b739b7d00e20"><code>00538d0</code></a> fix: Make Windows Cap'n Proto cache relocatable (<a href="https://redirect.github.com/vercel/turborepo/issues/13621">#13621</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e14de24864ca2e0682de9adfa275ccda1a0fb134"><code>e14de24</code></a> feat: Hash uv lockfile closures (<a href="https://redirect.github.com/vercel/turborepo/issues/13611">#13611</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/4195e4122b710b40a5012ded88fd764e728b1599"><code>4195e41</code></a> feat: Run native uv tasks (<a href="https://redirect.github.com/vercel/turborepo/issues/13610">#13610</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/87156466a1e99bedd783ed25e1f2d71f55707a90"><code>8715646</code></a> feat: Discover uv workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13609">#13609</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/5cf35ad3da3437baf1506e47f720544f887397d3"><code>5cf35ad</code></a> ci: Invalidate Cap'n Proto caches (<a href="https://redirect.github.com/vercel/turborepo/issues/13616">#13616</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.9.14...v2.10.8">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.0.16 to 8.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.1.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.1.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0-beta.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.0-beta.0...v8.2.0">8.2.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> to <code>server.fs.allow</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23035">#23035</a>) (<a href="https://github.com/vitejs/vite/commit/95a3cdab83e1125b03d2e8dd942fb6b64209e5fa">95a3cda</a>)</li> <li><strong>bundled-dev:</strong> reload once after rebuild instead of via the fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23106">#23106</a>) (<a href="https://github.com/vitejs/vite/commit/b24381d741941b9ce2b1c07db62cc5f4d7bad981">b24381d</a>)</li> <li><strong>bundled-dev:</strong> support worker file update accepted by HMR (<a href="https://redirect.github.com/vitejs/vite/issues/23068">#23068</a>) (<a href="https://github.com/vitejs/vite/commit/0d04351fdc12258c75b9f1cda5780fdb836ed0ef">0d04351</a>)</li> <li><strong>config:</strong> include column in config incompatibility location (<a href="https://redirect.github.com/vitejs/vite/issues/23064">#23064</a>) (<a href="https://github.com/vitejs/vite/commit/8a245726944ed29225920d49be77c33c6e03afc8">8a24572</a>)</li> <li><strong>dev:</strong> resolve interface name for explicit host in network URLs (<a href="https://redirect.github.com/vitejs/vite/issues/22965">#22965</a>) (<a href="https://github.com/vitejs/vite/commit/3ac77d9dd742968961af38a5a91ed6b061ceda7d">3ac77d9</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundledDev:</strong> print build errors to the terminal when an HMR update fails (<a href="https://redirect.github.com/vitejs/vite/issues/23024">#23024</a>) (<a href="https://github.com/vitejs/vite/commit/41c465896e8b11b1eb9c5fbdafbdcc528e189a2c">41c4658</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23069">#23069</a>) (<a href="https://github.com/vitejs/vite/commit/4c07b74416f859d7e8bdace13409ef2d080edf76">4c07b74</a>)</li> <li><strong>hmr:</strong> preserve environment snapshot during server restart (<a href="https://redirect.github.com/vitejs/vite/issues/22992">#22992</a>) (<a href="https://github.com/vitejs/vite/commit/b1186c36d06bb94941c58e8272fc4acb8512c93b">b1186c3</a>)</li> <li><strong>importAnalysis:</strong> interop imports injected into optimized dep files by plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23029">#23029</a>) (<a href="https://github.com/vitejs/vite/commit/8c2a87d41fb24536e59643351758084cde4d0dd7">8c2a87d</a>)</li> <li><strong>module-runner:</strong> keep stack trace interception working when <code>Object.prototype</code> is frozen (<a href="https://redirect.github.com/vitejs/vite/issues/23073">#23073</a>) (<a href="https://github.com/vitejs/vite/commit/599c5b02a8b6879b05ede988020f1331e877aaea">599c5b0</a>)</li> <li><strong>server:</strong> strip base in indexHtml module graph lookup (<a href="https://redirect.github.com/vitejs/vite/issues/22932">#22932</a>) (<a href="https://github.com/vitejs/vite/commit/fa005d19af5d847931c6dbefc63841c137383e6c">fa005d1</a>)</li> <li>support resolving top-level input option with plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23101">#23101</a>) (<a href="https://github.com/vitejs/vite/commit/41df81a6a4c3eef08f7a9a8ac9530cd136c0eafa">41df81a</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>config:</strong> correct cacheDir default fallback description (<a href="https://redirect.github.com/vitejs/vite/issues/23060">#23060</a>) (<a href="https://github.com/vitejs/vite/commit/aafa103af5d71fb59d7c3dd617d0cbef3b222f1f">aafa103</a>)</li> </ul> <h3>Tests</h3> <ul> <li>config CJS module vars in ESM case (<a href="https://redirect.github.com/vitejs/vite/issues/23010">#23010</a>) (<a href="https://github.com/vitejs/vite/commit/d8cd38830251b95fd7dddcd0eee0ce94cc61c2f4">d8cd388</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v8.1.5...v8.2.0-beta.0">8.2.0-beta.0</a> (2026-07-22)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> option (<a href="https://redirect.github.com/vitejs/vite/issues/22642">#22642</a>) (<a href="https://github.com/vitejs/vite/commit/9beae37d7221b25463a011feb40b0303ca328d87">9beae37</a>)</li> <li><strong>config:</strong> warn features incompatible with native loader in bundle loader (<a href="https://redirect.github.com/vitejs/vite/issues/22850">#22850</a>) (<a href="https://github.com/vitejs/vite/commit/05302b07267f6b4f9dbeac5b1d73fcc3dc06d730">05302b0</a>)</li> <li><strong>css:</strong> export PostCSS config type for type-safe configs (<a href="https://redirect.github.com/vitejs/vite/issues/22792">#22792</a>) (<a href="https://github.com/vitejs/vite/commit/302c755a8125b9a26214e3b413922b5513e41981">302c755</a>)</li> <li><strong>dev:</strong> label network URLs with their interface name (<a href="https://redirect.github.com/vitejs/vite/issues/22830">#22830</a>) (<a href="https://github.com/vitejs/vite/commit/78accc42a5b8887d9df624f7d4a934d3ead677d1">78accc4</a>)</li> <li><strong>optimizer:</strong> support aube lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22813">#22813</a>) (<a href="https://github.com/vitejs/vite/commit/6319827116c5be2a19c1b91c84ba3d38ad26a41c">6319827</a>)</li> <li><strong>optimizer:</strong> support nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22891">#22891</a>) (<a href="https://github.com/vitejs/vite/commit/65d3604f6fdbfcf6e86244d7fe3c1ca86acae701">65d3604</a>)</li> <li>update rolldown-related dependencies and use client-side HMR in bundled-dev (<a href="https://redirect.github.com/vitejs/vite/issues/22961">#22961</a>) (<a href="https://github.com/vitejs/vite/commit/960e9efbc1372000caac46cc2f123cef4824e2bb">960e9ef</a>)</li> <li><strong>wasm:</strong> expand test suite, unwrap WebAssembly.Global and enable js-string builtins (<a href="https://redirect.github.com/vitejs/vite/issues/22674">#22674</a>) (<a href="https://github.com/vitejs/vite/commit/9e79b51579457a9af4fa623b68a0bfabbf38010b">9e79b51</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> map CSS chunks in chunk import maps (fix <a href="https://redirect.github.com/vitejs/vite/issues/22946">#22946</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/22947">#22947</a>) (<a href="https://github.com/vitejs/vite/commit/e16ff3a1199293ac9cdfa6132c08fdea162215f3">e16ff3a</a>)</li> <li><strong>config:</strong> exclude virtual modules from native config compat check (<a href="https://redirect.github.com/vitejs/vite/issues/22979">#22979</a>) (<a href="https://github.com/vitejs/vite/commit/2ced1fe4e4e480ed78cb7aa5c78319e57bfa7783">2ced1fe</a>)</li> <li><strong>css:</strong> rewrite urls in OnceExit-injected content (<a href="https://redirect.github.com/vitejs/vite/issues/22983">#22983</a>) (<a href="https://github.com/vitejs/vite/commit/abb793e18c92592c21fbb8e1f3fc450b5839f04f">abb793e</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22985">#22985</a>) (<a href="https://github.com/vitejs/vite/commit/04f345b37064cd0bba6447eb5c32be5c22162f3d">04f345b</a>)</li> <li><strong>deps:</strong> update dependency magic-string to v1 (<a href="https://redirect.github.com/vitejs/vite/issues/22998">#22998</a>) (<a href="https://github.com/vitejs/vite/commit/c60b4d7cdb85b7d4f78671cdcfb863e5f8b66bb7">c60b4d7</a>)</li> <li><strong>hmr:</strong> remove hot data after prune (<a href="https://redirect.github.com/vitejs/vite/issues/23002">#23002</a>) (<a href="https://github.com/vitejs/vite/commit/be9631658f5191ee5c5665e780239d42a330280a">be96316</a>)</li> <li>resolve root to real path (<a href="https://redirect.github.com/vitejs/vite/issues/22832">#22832</a>) (<a href="https://github.com/vitejs/vite/commit/55bba7bbd9de40d031360e4408fe91bff5b29ec9">55bba7b</a>)</li> </ul> <h3>Performance Improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/24a611f1c83a976d32262628d42f683609746635"><code>24a611f</code></a> release: v7.2.4</li> <li><a href="https://github.com/vitejs/vite/commit/2d66b7b14aa6dfd62f3d6a59ee8382ed5ca6fd32"><code>2d66b7b</code></a> fix: revert "perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)"</li> <li><a href="https://github.com/vitejs/vite/commit/a668014dba377c2b82a32d8124f1761e9ea74f82"><code>a668014</code></a> release: v7.2.3</li> <li><a href="https://github.com/vitejs/vite/commit/acfe939e1f7c303c34b0b39b883cc302da767fa2"><code>acfe939</code></a> perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4f8171eb3046bd70c83964689897dab4c6b58bc0"><code>4f8171e</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21128">#21128</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/50297208452241061cb44d09a4bbdf77a11ac01e"><code>5029720</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21127">#21127</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5909efd8fbfd1bf1eab65427aea0613124b2797a"><code>5909efd</code></a> fix: allow multiple <code>bindCLIShortcuts</code> calls with shortcut merging (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21103">#21103</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/39a0a15fd24ed37257c48b795097a3794e54d255"><code>39a0a15</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21095">#21095</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6a34ac3422686e7cf7cc9a25d299cb8e5a8d92a0"><code>6a34ac3</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21096">#21096</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/02ceaec45e17bef19159188a28d9196fed1761be"><code>02ceaec</code></a> chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to v29 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21099">#21099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `rollup` from 4.59.0 to 4.62.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.62.3</h2> <h2>4.62.3</h2> <p><em>2026-07-26</em></p> <h3>Bug Fixes</h3> <ul> <li>Sanitize illegal characters preserved modules input base (<a href="https://redirect.github.com/rollup/rollup/issues/6439">#6439</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6421">#6421</a>: docs: update x_google_ignoreList link to canonical URL (<a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6422">#6422</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6423">#6423</a>: chore(deps): update actions/checkout action to v7 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6424">#6424</a>: chore(deps): update dependency eslint-plugin-unicorn to v68 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6425">#6425</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6426">#6426</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6432">#6432</a>: fix: make isLegal idempotent by not using a global-flag regex (<a href="https://github.com/spokodev"><code>@spokodev</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6433">#6433</a>: docs: clarify sideEffects and moduleSideEffects (<a href="https://github.com/ishaanlabs-gg"><code>@ishaanlabs-gg</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6434">#6434</a>: chore(deps): update dtolnay/rust-toolchain digest to 4be7066 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6435">#6435</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6436">#6436</a>: chore(deps): update actions/cache action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6438">#6438</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6439">#6439</a>: Sanitize input base before computing preserved module chunk names (<a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6443">#6443</a>: chore(deps): update dependency eslint-plugin-unicorn to v71 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6444">#6444</a>: fix(deps): update rust crate swc_compiler_base to v60 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6446">#6446</a>: chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6447">#6447</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6448">#6448</a>: chore(deps): update actions/setup-node action to v7 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6449">#6449</a>: chore(deps): update dependency eslint-plugin-unicorn to v72 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6450">#6450</a>: chore(deps): update dependency pinia to v4 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6451">#6451</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6455">#6455</a>: docs: fix broken commonjs namedExports link in troubleshooting (<a href="https://github.com/Hashim1999164"><code>@Hashim1999164</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6456">#6456</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6457">#6457</a>: chore(deps): update dependency magic-string to v1 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6458">#6458</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6459">#6459</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6460">#6460</a>: Fix build:docs after rollup update (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.62.2</h2> <h2>4.62.2</h2> <p><em>2026-06-19</em></p> <h3>Bug Fixes</h3> <ul> <li>Do not add spurious side-effect-free external imports to chunks when using minChunkSize (<a href="https://redirect.github.com/rollup/rollup/issues/6411">#6411</a>)</li> </ul> <h3>Pull Requests</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.62.3</h2> <p><em>2026-07-26</em></p> <h3>Bug Fixes</h3> <ul> <li>Sanitize illegal characters preserved modules input base (<a href="https://redirect.github.com/rollup/rollup/issues/6439">#6439</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6421">#6421</a>: docs: update x_google_ignoreList link to canonical URL (<a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6422">#6422</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6423">#6423</a>: chore(deps): update actions/checkout action to v7 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6424">#6424</a>: chore(deps): update dependency eslint-plugin-unicorn to v68 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6425">#6425</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6426">#6426</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6432">#6432</a>: fix: make isLegal idempotent by not using a global-flag regex (<a href="https://github.com/spokodev"><code>@spokodev</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6433">#6433</a>: docs: clarify sideEffects and moduleSideEffects (<a href="https://github.com/ishaanlabs-gg"><code>@ishaanlabs-gg</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6434">#6434</a>: chore(deps): update dtolnay/rust-toolchain digest to 4be7066 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6435">#6435</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6436">#6436</a>: chore(deps): update actions/cache action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6438">#6438</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6439">#6439</a>: Sanitize input base before computing preserved module chunk names (<a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6443">#6443</a>: chore(deps): update dependency eslint-plugin-unicorn to v71 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6444">#6444</a>: fix(deps): update rust crate swc_compiler_base to v60 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6446">#6446</a>: chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6447">#6447</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6448">#6448</a>: chore(deps): update actions/setup-node action to v7 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6449">#6449</a>: chore(deps): update dependency eslint-plugin-unicorn to v72 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6450">#6450</a>: chore(deps): update dependency pinia to v4 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6451">#6451</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6455">#6455</a>: docs: fix broken commonjs namedExports link in troubleshooting (<a href="https://github.com/Hashim1999164"><code>@Hashim1999164</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6456">#6456</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6457">#6457</a>: chore(deps): update dependency magic-string to v1 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6458">#6458</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6459">#6459</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6460">#6460</a>: Fix build:docs after rollup update (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.62.2</h2> <p><em>2026-06-19</em></p> <h3>Bug Fixes</h3> <ul> <li>Do not add spurious side-effect-free external imports to chunks when using minChunkSize (<a href="https://redirect.github.com/rollup/rollup/issues/6411">#6411</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6411">#6411</a>: Skip side-effect-free external imports when hoisting is disabled (<a href="https://github.com/morgan-coded"><code>@morgan-coded</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6416">#6416</a>: refactor(rust/parser_ast): extract property AstConverter write buffer kind logic to new method (<a href="https://github.com/fabianbernhart"><code>@fabianbernhart</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/a80a1974c584bfa8b694fb5d1a20f3fa75ebaf0a"><code>a80a197</code></a> 4.62.3</li> <li><a href="https://github.com/rollup/rollup/commit/e87e19b31e87a1dd6a749a6c11afe4cb9183cf8d"><code>e87e19b</code></a> Update audit resolve</li> <li><a href="https://github.com/rollup/rollup/commit/72f98e99228ad90a8e13d79709c009a827a4ef34"><code>72f98e9</code></a> Fix build:docs after rollup update (<a href="https://redirect.github.com/rollup/rollup/issues/6460">#6460</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/e3821cd714d4b1498b9c2d8c3070c9ff8febd7e4"><code>e3821cd</code></a> fix: make isLegal idempotent by not using a global-flag regex (<a href="https://redirect.github.com/rollup/rollup/issues/6432">#6432</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/db0c477a34a5b160c04cd52840f7ded8f57c446f"><code>db0c477</code></a> Sanitize input base before computing preserved module chunk names (<a href="https://redirect.github.com/rollup/rollup/issues/6439">#6439</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/a65f21ce941523761497810e4727ec6d1101a618"><code>a65f21c</code></a> chore(deps): update dependency magic-string to v1 (<a href="https://redirect.github.com/rollup/rollup/issues/6457">#6457</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/a43aae4c0c703dbd4e167345da6c9d41eafe48e6"><code>a43aae4</code></a> docs: fix broken commonjs namedExports link in troubleshooting (<a href="https://redirect.github.com/rollup/rollup/issues/6455">#6455</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/41c28d7db566c501c2a0a0588407aa6e86bb0ea9"><code>41c28d7</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6459">#6459</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/894136eb13ef629bc0b6324e88cfc26c65a6d88b"><code>894136e</code></a> chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (<a href="https://redirect.github.com/rollup/rollup/issues/6446">#6446</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/fad0ba38db5793b730eb6e44483e3cec7c5f2f15"><code>fad0ba3</code></a> fix(deps): update swc monorepo (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6458">#6458</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.59.0...v4.62.3">compare view</a></li> </ul> </details> <br /> Updates `vitest` from 4.1.9 to 4.1.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.10</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Check fs access in builtin commands [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (claude-opus-4-8)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a> <a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li> <li><strong>vm</strong>: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by <a href="https://github.com/SveLil"><code>@SveLil</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a> <a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a> chore: release v4.1.10 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10718">#10718</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/bae52b5112a6fd8200101b88bf8af9685d077295"><code>bae52b5</code></a> fix(vm): fix external module resolve error with deps optimizer query for enco...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest">compare view</a></li> </ul> </details> <br /> Updates `@vitest/browser-playwright` from 4.1.9 to 4.1.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/browser-playwright's releases</a>.</em></p> <blockquote> <h2>v4.1.10</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Check fs access in builtin commands [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (claude-opus-4-8)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a> <a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li> <li><strong>vm</strong>: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by <a href="https://github.com/SveLil"><code>@SveLil</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a> <a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a> chore: release v4.1.10 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10718">#10718</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f"><code>5c18dd2</code></a> fix(browser): check fs access in builtin commands [backport to v4] (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10680">#10680</a>)</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/browser-playwright">compare view</a></li> </ul> </details> <br /> Updates `@vitest/browser-webdriverio` from 4.1.9 to 4.1.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/browser-webdriverio's releases</a>.</em></p> <blockquote> <h2>v4.1.10</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Check fs access in builtin commands [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (claude-opus-4-8)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a> <a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li> <li><strong>vm</strong>: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by <a href="https://github.com/SveLil"><code>@SveLil</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a> <a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a> chore: release v4.1.10 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-webdriverio/issues/10718">#10718</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/5c18dd267ff7f47f24cab2f615a16b37d90feb7f"><code>5c18dd2</code></a> fix(browser): check fs access in builtin commands [backport to v4] (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-webdriverio/issues/10680">#10680</a>)</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/browser-webdriverio">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com> |
||
|
John Kennedy
|
a41e4185dd |
fix: resolve Dependabot alerts (#2634)
## Summary - raise security overrides for the 18 open Dependabot alerts - refresh the pnpm lockfile to patched dependency versions - also resolve the newer `brace-expansion` advisory reported by `pnpm audit` ## Verification - `pnpm install --frozen-lockfile --ignore-scripts` - `pnpm audit --prod --audit-level=low` — no known vulnerabilities - `pnpm format:check` - `git diff --check` ## Note - `pnpm build` completed 10/15 tasks, then failed in the existing `@langchain/langgraph-api` TypeScript build (`pnpm tsc --outDir dist`) without diagnostics in the wrapper output. Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
John Kennedy
|
a34543a0dd |
build: add Socket optimized pnpm overrides (#2600)
## Summary - Add Socket optimized registry overrides for supported transitive dependencies. - Regenerate the root pnpm lockfile with the Socket registry packages. - Add Socket GitHub App configuration scoped to dependency manifest and lockfile changes. ## Test plan - `sfw pnpm install --lockfile-only --no-frozen-lockfile` - `git diff --check` - JSON/YAML parsing for `package.json` and `socket.yml` The install reported existing workspace peer/deprecation warnings and a missing docs patch path. --------- Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
John Kennedy
|
041c0e81c9 |
chore: patch dependabot security alerts (#2588)
## Summary - Add pnpm overrides for patched transitive dependency versions flagged by Dependabot - Refresh pnpm lockfile to resolve vulnerable @babel/core, @grpc/grpc-js, form-data, protobufjs, esbuild, shell-quote, tmp, uuid, and ws versions - Leaves only the low-severity elliptic advisory, which currently has no patched version ## Testing - sfw pnpm install --offline --frozen-lockfile - pnpm audit --json (1 remaining low elliptic advisory, no patched version) - pnpm lint Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
John Kennedy
|
bf9fc73a49 |
chore: raise Dependabot override floors (#2586)
## Summary - raise root pnpm override floors for `qs`, `dompurify`, `undici`, `fast-xml-parser`, and 7.x `protobufjs` to patched ranges from current Dependabot alerts - refresh `pnpm-lock.yaml` with `pnpm install --lockfile-only` ## Verification - `sfw pnpm install --lockfile-only` - `git diff --check` - verified resolved versions: `undici` 6.27.0/7.28.0, `dompurify` 3.4.11, `fast-xml-parser` 5.9.3, `protobufjs` 7.6.5, `qs` 6.15.3 Note: `protobufjs@6.11.6` remains via the separate `onnx-proto` chain and is outside the 7.x root override floor. |
||
|
Christian Bromann
|
5d279df5d5 |
chore(deps): bump langchain (#2564)
Bump langchainjs to latest release. --------- Signed-off-by: Christian Bromann <git@bromann.dev> Co-authored-by: open-swe[bot] <215916821+open-swe[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
b1e856d987 |
feat(sdk): apply state update and goto alongside interrupt resume (#2557)
## Summary
- Add `update` and `goto` options to `respond()` across the SDK so
resolving an interrupt can apply a state update and/or directed jump in
the **same superstep** — mapped to LangGraph's `Command(resume, update,
goto)`. The canonical use case is a HITL flow that pushes the interrupt
card into state at the moment it answers, committed in one checkpoint
with no flicker.
- `@langchain/langgraph-sdk`: new `update`/`goto` fields on
`StreamRespondAllOptions`, forwarded by
`StreamController.respond`/`respondAll`; `@langchain/core` `BaseMessage`
instances under the `messagesKey` are serialized to dicts before
transport, exactly like `submit()`.
- `@langchain/langgraph-api`: forward `update`/`goto` from
`input.respond` into the run `Command` in both the protocol service and
the embedded server.
- `@langchain/react`, `@langchain/vue`, `@langchain/svelte`,
`@langchain/angular`: document the new `respond({ update, goto })`
capability (incl. `BaseMessage` examples).
- Fix: the protocol-v2 state normalizer stripped `response_metadata`,
which HITL cards ride on (`AIMessage.response_metadata`); non-empty
`response_metadata` is now preserved.
- Add React browser tests (`interrupt_card_graph` fixture via
`createAgent`) covering the approve and reject paths: the FE-pushed card
lands in committed state exactly once and persists through a slow tool
execution.
|
||
|
Christian Bromann
|
9e114e55d3 |
chore(deps): remove uuid dependency in favor of embedded uuid in core (#2527)
## Summary - Remove the direct `uuid` npm dependency from `@langchain/langgraph`, `@langchain/langgraph-checkpoint`, `@langchain/langgraph-checkpoint-redis`, `@langchain/langgraph-api`, `@langchain/langgraph-supervisor`, and `@langchain/langgraph-sdk`. - Switch all UUID generation and validation to `@langchain/core/utils/uuid` (v4, v5, v6, v7, and `validate`). - Drop unused `@types/uuid` devDependencies from checkpoint backend packages that no longer reference `uuid` directly. fixes #2481 |
||
|
Christian Bromann
|
b1d307ab84 |
ci(infra): run framework browser tests only when paths change (#2425)
## Summary - Add a `detect-changes` job to the browser test workflow using `dorny/paths-filter@v3.0.2`. - Run all four framework browser jobs when `libs/sdk/**` changes or when this workflow file changes. - Run only the matching job when `libs/sdk-react`, `libs/sdk-angular`, `libs/sdk-vue`, or `libs/sdk-svelte` changes. - Keep the full matrix on `workflow_dispatch` (manual runs and CI dispatched via workflow_dispatch). |
||
|
dependabot[bot]
|
674173b8ac |
chore(deps-dev): bump turbo from 2.8.15 to 2.9.14 (#2428)
Bumps [turbo](https://github.com/vercel/turborepo) from 2.8.15 to 2.9.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.9.14</h2> <blockquote> <p>[!NOTE] This release contains important security fixes.</p> </blockquote> <h3>High:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm">GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection</a></li> </ul> <h3>Low:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r">GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation</a></li> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726">GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection</a></li> </ul> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> <li>chore: Release 2.9.13 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12803">vercel/turborepo#12803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dancrumb"><code>@dancrumb</code></a> made their first contribution in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14">https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14</a></p> <h2>Turborepo v2.9.13-canary.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.11-canary.7 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12768">vercel/turborepo#12768</a></li> <li>fix: Allow <code>$TURBO_EXTENDS$</code> in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12770">vercel/turborepo#12770</a></li> <li>release(turborepo): 2.9.11 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12771">vercel/turborepo#12771</a></li> <li>fix: Allow transit nodes in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12773">vercel/turborepo#12773</a></li> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/fc62fe0d9c347d1d24f0ed8946284856593ddb93"><code>fc62fe0</code></a> publish 2.9.14 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/fb8c9aec0f9e83f95783659a5ce9c4478cf62cb9"><code>fb8c9ae</code></a> chore: Release 2.9.13 (<a href="https://redirect.github.com/vercel/turborepo/issues/12803">#12803</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e8e629da4e1fb75231089e91b19be9d327a3e649"><code>e8e629d</code></a> fix: Avoid project-local Yarn during detection (<a href="https://redirect.github.com/vercel/turborepo/issues/12801">#12801</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/91c90cbf12f524c5c29b713d6472dd5fcdecb309"><code>91c90cb</code></a> fix: Harden VS Code extension command execution (<a href="https://redirect.github.com/vercel/turborepo/issues/12800">#12800</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/84f450894e87da1eed864d51f6f637f26980d560"><code>84f4508</code></a> fix: Validate auth callback state (<a href="https://redirect.github.com/vercel/turborepo/issues/12802">#12802</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/1779ad7901384f106236a6e196059e4929745514"><code>1779ad7</code></a> Removed unneeded import form hash creation script in docs (<a href="https://redirect.github.com/vercel/turborepo/issues/12799">#12799</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/71f8c90a807ffb9b9876ea8a04f523f473bf5c8d"><code>71f8c90</code></a> test: Validate lockfiles without dependency downloads (<a href="https://redirect.github.com/vercel/turborepo/issues/12789">#12789</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/5fcb96024d503127bb0ed760ebe159b7716c52b3"><code>5fcb960</code></a> ci: Scope GitHub Actions caches by branch (<a href="https://redirect.github.com/vercel/turborepo/issues/12788">#12788</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/4cf9fabc9a6f6c99fe4e2f2da9f35be631be062a"><code>4cf9fab</code></a> ci: Use <code>pull_request</code> for PR title linting (<a href="https://redirect.github.com/vercel/turborepo/issues/12787">#12787</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/859c629bc401f239ac7980a132746ca90478e17c"><code>859c629</code></a> fix: Restore docs mobile menu (<a href="https://redirect.github.com/vercel/turborepo/issues/12782">#12782</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.8.15...v2.9.14">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Christian Bromann
|
085a07f569 |
feat(core): event based streaming (#2314)
All stream v2 changes consolidated. --------- Co-authored-by: Hunter Lovell <hunter@hntrl.io> |
||
|
John Kennedy
|
7f3320cda8 |
fix: patch 6 medium-severity security alerts (#2333)
## Security Alert Patch (medium-tier follow-up) Follow-up to #2329, which patched the critical+high tier. This PR resolves the remaining **6 medium-severity Dependabot alerts** via `pnpm.overrides` plus one published-path constraint bump. All fixes are patch/minor bumps within the current major — no breaking changes. ### Packages Updated | Package | Old Constraint | New Constraint | Strategy | Scope | CVEs Resolved | |---------|---------------|----------------|----------|-------|---------------| | `axios` | `>=1.13.5` (override) | `>=1.15.0` (override); resolved 1.13.6 → **1.15.1** | C (override) | dev-only (via `@langchain/scripts` devDep) | CVE-2025-62718 (SSRF via NO_PROXY bypass), CVE-2026-40175 (cloud metadata exfiltration) | | `dompurify` | (transitive, resolved 3.3.3) | `>=3.4.0` (new override); resolved **3.4.0** | C (override) | dev-only (private `@example/ai-elements` via mermaid) | GHSA-39q2-94rc-95cp (ADD_TAGS bypasses FORBID_TAGS) | | `follow-redirects` | (transitive, resolved 1.15.11) | `>=1.16.0` (new override); resolved **1.16.0** | C (override) | dev-only (via `@langchain/scripts` devDep) | GHSA-r4q5-vmmm-2653 (auth header leak on cross-domain redirect) | | `langsmith` (published path) | `langsmith: >=0.3.33 <1.0.0` in `libs/langgraph-api/package.json` | `>=0.5.19 <1.0.0` | **A (manifest bump)** | **published** — direct dep of `@langchain/langgraph-api` | CVE-2026-40190 (prototype pollution), GHSA-rr7j-v2q5-chgv (streaming redaction bypass) | | `langsmith` (dev chains) | (transitive 0.4.12, 0.5.16 resolved via `@langchain/classic`, `langchain@1.3.0`) | `langsmith@<0.5.19: >=0.5.19 <1` (new override) | C (override) | dev-only | same as above (flushes vulnerable transitive copies) | *Strategy C overrides follow the existing repo pattern — axios, qs, undici, minimatch, brace-expansion, protobufjs, basic-ftp, vite, and defu are already overridden the same way.* ### Published-path rationale `@langchain/langgraph-api` exercises `langsmith` at runtime for tracing and streaming, which touches the affected internal code paths (lodash `set()` prototype-pollution guard, token-event redaction). Therefore the fix is Strategy A (raise the published lower bound) rather than A-lockfile — this protects end users who pin `@langchain/langgraph-api`. The lockfile already resolved `langsmith@0.5.20` before this change, so installs are unchanged at HEAD; the bump is a downstream-safety constraint tightening. ### Deferred (not fixed in this PR) - **`protobufjs@6.11.5`** (CRITICAL, CVE-2026-41242) — reached via `@xenova/transformers@2.17.2` in `libs/langgraph-core` devDeps + examples. `@xenova/transformers` is abandoned; the successor is `@huggingface/transformers@3`. Forcing a 6.x → 7.x override would cross a breaking API boundary. **Upstream issue — requires a manual migration, tracked separately.** (See #2329 body for full context.) - **`elliptic@6.6.1`** (LOW, GHSA-848j-6mx2-7j84) — `first_patched_version` is `null`; upstream has not released a fix. Defer until a patched version ships. ### CVE Details - **CVE-2025-62718** / GHSA-3p68-rc4w-qgx5 — Axios NO_PROXY Hostname Normalization Bypass Leads to SSRF — https://github.com/advisories/GHSA-3p68-rc4w-qgx5 - **CVE-2026-40175** / GHSA-fvcv-3m26-pcqx — Axios Unrestricted Cloud Metadata Exfiltration via Header Injection Chain — https://github.com/advisories/GHSA-fvcv-3m26-pcqx - **GHSA-39q2-94rc-95cp** — DOMPurify `ADD_TAGS` bypasses `FORBID_TAGS` via short-circuit evaluation — https://github.com/advisories/GHSA-39q2-94rc-95cp - **GHSA-r4q5-vmmm-2653** — follow-redirects leaks custom authentication headers to cross-domain redirect targets — https://github.com/advisories/GHSA-r4q5-vmmm-2653 - **CVE-2026-40190** / GHSA-fw9q-39r9-c252 — LangSmith prototype pollution via incomplete `__proto__` guard in internal lodash `set()` — https://github.com/advisories/GHSA-fw9q-39r9-c252 - **GHSA-rr7j-v2q5-chgv** — LangSmith streaming token events bypass output redaction — https://github.com/advisories/GHSA-rr7j-v2q5-chgv ### Linear Tickets Linear ticket lookup returned no matches for the resolved CVEs/GHSAs. No ticket IDs included in the title. ### Verification - [x] Lockfile regenerated via `pnpm install --lockfile-only` - [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors - [x] `pnpm format:check` (oxfmt) — clean - [x] `pnpm audit --prod` — **No known vulnerabilities found** - [x] `pnpm typecheck` on `libs/langgraph-api` — clean - [x] No staged secrets (`gitleaks git --staged`) 🤖 Submitted by langster-patch Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
John Kennedy
|
076f7f81f0 |
fix: patch 7 security alerts (critical + high severity) (#2329)
## Security Alert Patch Resolves **7 Dependabot security alerts** in the critical + high severity tier via `pnpm.overrides` in the root `package.json`. All fixes are patch/minor bumps within the current major — no breaking changes. ### Packages Updated | Package | Old Constraint | New Constraint | Strategy | Scope | CVEs Resolved | |---------|---------------|----------------|----------|-------|---------------| | `protobufjs` | (transitive, resolved 7.5.4) | `>=7.5.5 <8` | C (override) | dev-only (testcontainers chain + `@xenova/transformers` devDeps) | CVE-2026-41242 | | `basic-ftp` | (transitive, resolved 5.2.0) | `>=5.3.0 <6` | C (override) | effectively dev-only (reached only via `@vitest/browser` — an optional peerDep of vitest — through webdriverio→proxy-agent) | GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg, CVE-2026-39983 | | `vite` (7.x only) | (transitive via vitest peer, resolved 7.3.1) | `>=7.3.2` | C (override, scoped to vite@7) | effectively dev-only (vite is a peerDependency of vitest — end users supply their own vite) | CVE-2026-39363, CVE-2026-39364 | | `defu` | (transitive, resolved 6.1.4) | `>=6.1.5 <7` | C (override) | dev-only (`internal/build` via tsdown) | CVE-2026-35209 | *Strategy C (pnpm.overrides) follows the existing pattern in this repo — axios, qs, undici, minimatch, brace-expansion, etc. are already overridden the same way.* ### Side-effect Fixes Bumping `vite@7` to 7.3.2 also resolves one **medium** alert that wasn't in the primary batch: - CVE-2026-39365 / GHSA-4w7w-66w2-5vf9 — vite Path Traversal in Optimized Deps `.map` Handling ### Upstream / Design Issues (NOT fixed in this PR) - **`protobufjs@6.11.x`** persists in the dependency graph via `@xenova/transformers@2.17.2` (`libs/langgraph-core` devDep + 9 example apps). `@xenova/transformers` is abandoned and rebranded as `@huggingface/transformers@3`; a migration would be a separate manual dev-only upgrade. The 6.x line is in devDependencies only and does not ship to published package consumers. Dependabot may continue to flag the 6.x range because the advisory's `vulnerable_range` is `< 7.5.5`. - **Published-path caveat for `basic-ftp` and `vite`:** Both transit through `@langchain/langgraph-checkpoint-validation`'s `dependencies.vitest`. However, `vite` is declared as a **peerDependency** of vitest (end users supply their own), and `basic-ftp` reaches end users only through `@vitest/browser` — an **optional peerDependency** that users must explicitly opt into. Overrides in this PR protect local dev and CI; end users of `@langchain/langgraph-checkpoint-validation` are not exposed unless they independently install and configure the browser-testing chain. ### Deferred (medium + low tier) Per security-alert-patch policy, only the highest active severity tier was patched in this PR. The following remain open and would be addressed in a follow-up batch: - 6 medium: axios ×2 (SSRF + cloud-metadata exfil — existing `axios: >=1.13.5` override doesn't cover 1.15.0), dompurify, langsmith ×2, follow-redirects - 1 low: elliptic (no `first_patched_version` published — upstream has not released a fix) ### Verification - [x] Lockfile regenerated via `pnpm install --lockfile-only` - [x] `pnpm lint` (oxlint) — 0 warnings, 0 errors - [x] `pnpm format:check` (oxfmt) — clean - [x] `pnpm audit --prod` — 0 critical, 0 high remaining (3 moderates = the deferred medium alerts) - [x] No staged secrets (gitleaks) ### Linear Tickets Linear ticket lookup skipped — CLI not authenticated in this environment. No ticket IDs included in title. 🤖 Submitted by langster-patch Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
Hunter Lovell
|
9102d526c8 |
fix(langgraph): propagate tracer metadata defaults from configurable (#2315)
## Summary This updates Pregel callback manager initialization to pass `tracerInheritableMetadata` defaults derived from `config.configurable`, and narrows `ensureLangGraphConfig` metadata mirroring to the allowlisted LangGraph identifiers used in stream/runtime metadata. ## Changes ### `@langchain/langgraph` (`libs/langgraph-core`) - Updated Pregel callback manager setup to configure core callbacks with `tracerInheritableMetadata` based on configurable primitive values, excluding internal and secret-like keys. - Hoisted tracing default logic into `_getTracingMetadataDefaults` and `_excludeAsMetadata` for parity with the Python implementation shape. - Restricted `ensureLangGraphConfig` configurable-to-metadata propagation to the identifier allowlist: - `thread_id` - `checkpoint_id` - `checkpoint_ns` - `task_id` - `run_id` - `assistant_id` - `graph_id` - Updated config tests to assert the narrowed metadata propagation behavior. |
||
|
Christian Bromann
|
2b62610710 | feat(sdk): support for headless tools (#2281) | ||
|
John Kennedy
|
90631859ba |
fix: patch 7 security alerts (high+medium severity) (#2282)
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
dependabot[bot]
|
2bb2ed4565 |
chore(deps): bump the vue group across 1 directory with 4 updates (#2273)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hunter Lovell <hunter@hntrl.io> |
||
|
John Kennedy
|
4d2963c313 |
fix: patch 11 security alerts (critical+high severity) (#2258)
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> |
||
|
Christian Bromann
|
d88f29ba25 |
chore(repo): migrate linting and formatting from ESLint/Prettier to oxlint/oxfmt (#2256)
Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Christian Bromann <christian-bromann@users.noreply.github.com> Co-authored-by: Hunter Lovell <40191806+hntrl@users.noreply.github.com> |
||
|
dependabot[bot]
|
5eb2a04b72 |
chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (#2160)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
e051ef6aa8 |
feat(sdk): add vue, svelte, angular implementation of useStream hook (#2001)
Co-authored-by: Tat Dat Duong <david@duong.cz> |
||
|
John Kennedy
|
bbbfaf64ce |
fix: bump minimatch and rollup to resolve Dependabot CVEs (#2007)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
John Kennedy
|
d1af84d42c |
fix: bump minimatch to resolve CVE-2026-27904 (#2011)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Colin Francis
|
aa8e878e5b | feat: add tools stream mode for tool lifecycle events (#1984) | ||
|
John Kennedy
|
dd25073bff |
fix: bump qs to >=6.14.2 to resolve CVE-2026-2391 (#1985)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
John Kennedy
|
3e570a6c9f |
fix: bump axios to >=1.13.5 to resolve CVE-2026-25639 (#1981)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Hunter Lovell
|
7ddf85468f |
feat(langgraph): introduce StateSchema, ReducedValue, and UntrackedValue (#1842)
Co-authored-by: Tat Dat Duong <david@duong.cz> |
||
|
David Duong
|
6d5cdcbb10 | fix(chore): replace turbo:command with plain turbo (#1869) | ||
|
David Duong
|
e7aeffeb72 |
chore: replace yarn with pnpm (#1862)
Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Christian Bromann
|
a84c1ff182 | fix(ci): another attempt fixing pipeline (#1853) | ||
|
Christian Bromann
|
e9f7e8e9e6 | fix(ci): fix release pipeline take 2 (#1850) | ||
|
Christian Bromann
|
3ec85a43df | fix(ci): fix broken release pipeline (#1848) | ||
|
David Duong
|
0452de20a2 |
fix(ci): do not release under next tag anymore (#1765)
|
||
|
Hunter Lovell
|
4b7933cd0a |
feat: langgraph canonical package (#1742)
|
||
|
Hunter Lovell
|
1e1ecbbcf8 |
feat: merge v1 (#1733)
Co-authored-by: Tat Dat Duong <david@duong.cz> Co-authored-by: Christian Bromann <git@bromann.dev> Co-authored-by: Nuno Campos <nuno@langchain.dev> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
David Duong
|
03ae1089ea | chore: remove release-it, fix dependabot for tmp (#1638) | ||
|
David Duong
|
7c81629c8e | chore: switch to yarn publish (#1362) | ||
|
David Duong
|
9546477a55 | chore: add changesets CLI (#1347) | ||
|
David Duong
|
ddd5722e6f | chore(deps): bump turbo@2.5.4 (#1311) | ||
|
David Duong
|
dcf9627d7e |
chore(deps): migrate to Yarn v4 (#1310)
Co-authored-by: Logan Rosen <loganrosen@gmail.com> |
||
|
Tat Dat Duong
|
4bf750557f |
deps(langgraph): upgrade to TypeScript 5.8.x
Turns out that `moduleResolution: node10` will achieve the same result as setting `src/package.json` to `{}` (verified via git worktrees).
Also switching `moduleResolution: bundler` for ESM build, after which I've compared the build output of `libs/checkpoint` via `diff -r -q`.
|
||
|
Tat Dat Duong
|
90295e6118 | security: remove esm-hook | ||
|
Tat Dat Duong
|
fa01615cc4 | security: ensure we're using the same tsx version | ||
|
Tat Dat Duong
|
b640f50596 |
security: dedupe @octokit
Solved by deduping @langchain/scripts and bumping release-it to ^19 |
||
|
Ben Burns
|
a9f3236907 | fix(langgraph,docs): revert previous changes that broke builds (#891) | ||
|
Ben Burns
|
ed6f79e97d | chore(docs): improve API reference docs for Pregel and associated types (#874) | ||
|
Lucas Hänke de Cansino
|
ff0a79123e |
feat(checkpoint-postgres): Postgres checkpointer (#471)
Co-authored-by: jacoblee93 <jacoblee93@gmail.com> |
||
|
Jacob Lee
|
547b4a88e8 |
langgraph[minor]: 0.2, make @langchain/core a peer dependency to avoid conflicts (#431)
Co-authored-by: Isaac Francisco <78627776+isahers1@users.noreply.github.com> |
||
|
Jacob Lee
|
dc33895b84 |
Split checkpointers into libraries (#341)
* Split checkpointers into libraries * Update readme * Fix CI * Update release scripts * Update README * Update rc * Preserve peer deps for now |