mirror of
https://github.com/langchain-ai/langgraphjs.git
synced 2026-07-21 16:45:24 -04:00
@langchain/langgraph-ui@1.2.3
2889 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 github-actions[bot]
|
381a9f64d0 |
chore: version packages (#2445)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint@1.0.3 ### Patch Changes - [#2352](https://github.com/langchain-ai/langgraphjs/pull/2352) [`14f2a79`](https://github.com/langchain-ai/langgraphjs/commit/14f2a796912e81d7f52f0a4f16747f6d0a269209) Thanks [@Nagendhra-web](https://github.com/Nagendhra-web)! - fix(langgraph-checkpoint): block prototype pollution in MemorySaver via reserved storage keys `MemorySaver` previously embedded `thread_id`, `checkpoint_ns`, `checkpoint_id`, and `task_id` directly into property accesses on the nested plain objects `this.storage` and `this.writes`. A caller able to shape any of those fields (every quickstart, tutorial, and test fixture uses `MemorySaver` by default) could pass `"__proto__"`, `"constructor"`, or `"prototype"` and have the subsequent assignment mutate `Object.prototype`. From that point every plain object in the process inherits the injected property, breaking `for...in` loops, truthy short-circuits, and downstream serializers across unrelated code paths. CWE-1321. Adds an `assertSafeStorageKey` chokepoint applied at every public entry that touches `storage` or `writes` (`put`, `putWrites`, `deleteThread`, `getTuple`, `list`). The guard rejects non-string values, the empty string (unless explicitly opted-in for `checkpoint_ns`), and the three prototype-pollution keys. Behaviour for valid string identifiers is unchanged. ## @langchain/langgraph-checkpoint-redis@1.0.6 ### Patch Changes - [#2350](https://github.com/langchain-ai/langgraphjs/pull/2350) [`1e73c6b`](https://github.com/langchain-ai/langgraphjs/commit/1e73c6b4630bbc4aa976eea4bfc33c4f753b7ee9) Thanks [@Nagendhra-web](https://github.com/Nagendhra-web)! - fix(checkpoint-redis): block Redis KEYS / SCAN pattern injection via top-level identifiers `RedisSaver` and `ShallowRedisSaver` previously embedded `thread_id`, `checkpoint_ns`, `checkpoint_id`, and `task_id` directly into Redis keys and `client.keys(pattern)` calls with no validation. A caller able to shape any of those fields (multi-tenant SDK deployments where the `RunnableConfig` originates from request input, or webhook payloads that flow into a persisted thread) could promote a string identifier into a glob pattern (`*`, `?`, `[...]`) or escape character (`\`). The most severe sink is `deleteThread`: a `threadId` of `*` issues `client.keys("checkpoint:*:*")` followed by `client.del(...)`, deleting every checkpoint in the database across every tenant. `getTuple`, `list`, and `loadPendingWrites` are exposed to the same pattern via the fallback paths that bypass the existing `escapeRediSearchTagValue` defense. Adds a single `assertSafeKeyComponent` helper exported from `./utils.js` and applies it at every key-building site. The guard asserts the value is a non-empty string (the empty `checkpoint_ns` default is opt-in via `{ allowEmpty: true }`) and rejects the Redis pattern meta-characters `* ? [ ] \`. The `:` delimiter is intentionally permitted because LangGraph emits it as a legitimate part of `checkpoint_ns` for subgraphs / nested graphs, where it only ever appears as a literal in the key. Behavior for valid string identifiers is unchanged. ## @langchain/langgraph-api@1.2.3 ### Patch Changes - [#2447](https://github.com/langchain-ai/langgraphjs/pull/2447) [`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: fold forkFrom client-side and honor per-run multitaskStrategy The SDK now folds the ergonomic `forkFrom` option into `config.configurable.checkpoint_id` before sending `run.start`, so the agent server only ever accepts the single, legacy-compliant fork field (`forkFrom` no longer hits the wire). The protocol-v2 reference servers drop their top-level `forkFrom` normalization accordingly. The protocol-v2 servers now honor the caller's `multitaskStrategy` per run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead of hardcoding it, falling back to `enqueue` when omitted or unrecognized. - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. - Updated dependencies \[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532)]: - @langchain/langgraph-ui@1.2.3 ## @langchain/langgraph-cli@1.2.3 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-api@1.2.3 ## @langchain/langgraph-ui@1.2.3 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. ## @langchain/langgraph-sdk@1.9.10 ### Patch Changes - [#2447](https://github.com/langchain-ai/langgraphjs/pull/2447) [`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: fold forkFrom client-side and honor per-run multitaskStrategy The SDK now folds the ergonomic `forkFrom` option into `config.configurable.checkpoint_id` before sending `run.start`, so the agent server only ever accepts the single, legacy-compliant fork field (`forkFrom` no longer hits the wire). The protocol-v2 reference servers drop their top-level `forkFrom` normalization accordingly. The protocol-v2 servers now honor the caller's `multitaskStrategy` per run (one of `reject` \| `rollback` \| `interrupt` \| `enqueue`) instead of hardcoding it, falling back to `enqueue` when omitted or unrecognized. - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. ## @langchain/angular@1.0.10 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 ## @langchain/react@1.0.10 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 ## @langchain/svelte@1.0.10 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 ## @langchain/vue@1.0.10 ### Patch Changes - [#2443](https://github.com/langchain-ai/langgraphjs/pull/2443) [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532) Thanks [@christian-bromann](https://github.com/christian-bromann)! - refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom Remove the misleading submit({ command }) surface from protocol-v2 StreamController; HITL resume is respond() only. Accept forkFrom as a plain checkpoint id string and align protocol-v2 servers and docs. - [#2448](https://github.com/langchain-ai/langgraphjs/pull/2448) [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d) Thanks [@christian-bromann](https://github.com/christian-bromann)! - protocol-v2: add `respondAll()` and run config/metadata on interrupt resume The stream controller (and the React/Angular/Svelte/Vue wrappers) gain a `respondAll(responsesById, options)` method to resume several interrupts pending at the same checkpoint in a single command — required for runs that pause on multiple interrupts at once (e.g. parallel tool-authorization prompts), which sequential `respond()` calls cannot handle. `respond()` now takes an options object (`{ interruptId?, namespace?, config?, metadata? }`) so a resumed run can carry the same run-level config (model, user context, …) and metadata (trigger source, test flags, …) a fresh `submit()` would. The protocol-v2 reference servers read the new `responses` batch and `config` / `metadata` fields leniently and fold them onto the run that services the `input.respond` command. - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 ## @example/ai-elements@0.1.25 ### Patch Changes - Updated dependencies \[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/react@1.0.10 ## @examples/assistant-ui-claude@0.1.25 ### Patch Changes - Updated dependencies \[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/react@1.0.10 ## @examples/ui-angular@0.0.35 ### Patch Changes - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 - @langchain/angular@1.0.10 ## @examples/ui-multimodal@0.0.11 ### Patch Changes - Updated dependencies \[[`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/react@1.0.10 ## @examples/ui-react@0.0.11 ### Patch Changes - Updated dependencies \[[`80c2806`](https://github.com/langchain-ai/langgraphjs/commit/80c2806cb2da93745a640664bd0cf603c2361da9), [`80a8c12`](https://github.com/langchain-ai/langgraphjs/commit/80a8c1200a240fd984edc4deb26a7787d08c7532), [`2c14b12`](https://github.com/langchain-ai/langgraphjs/commit/2c14b12a80c306578563e77595943037c7c4844d)]: - @langchain/langgraph-sdk@1.9.10 - @langchain/react@1.0.10 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.10 @langchain/langgraph-api@1.2.3 @langchain/langgraph-checkpoint-redis@1.0.6 @langchain/langgraph-checkpoint@1.0.3 @langchain/langgraph-cli@1.2.3 @langchain/langgraph-sdk@1.9.10 @langchain/langgraph-ui@1.2.3 @langchain/react@1.0.10 @langchain/svelte@1.0.10 @langchain/vue@1.0.10 |
||
|
Christian Bromann
|
4d12fe0233 | docs: more readme cleanups | ||
|
Christian Bromann
|
517500356d | docs: update readme further | ||
|
Christian Bromann
|
4c5fea793d | fix(docs): update links in readme | ||
|
Christian Bromann
|
313f060654 | fix(sdk): fix type issue in tests | ||
|
Christian Bromann
|
737b4ade89 | fix(sdk): fix lint issues | ||
|
Christian Bromann
|
ac66625c30 | fix(sdk): add browser tests for multi interrupt use case | ||
|
Christian Bromann
|
2c14b12a80 |
fix(sdk): add back respondAll and respond config/metadata (#2448)
## Summary
- Add `respondAll(responsesById, options)` to the stream controller and
the React/Angular/Svelte/Vue wrappers, resuming multiple interrupts
pending at the same checkpoint in a single `Command({ resume })`. This
is required for runs that pause on several interrupts at once (e.g.
parallel tool-authorization prompts), which sequential `respond()` calls
cannot service.
- Change `respond()` to take an options object (`{ interruptId?,
namespace?, config?, metadata? }`), folding run-level
`config`/`metadata` onto the resumed run so it applies the same
configurable values and metadata a fresh `submit()` would.
- Extend `ThreadStream.respondInput()` to accept a `responses` batch
(mutually exclusive with the single `interrupt_id`/`response`) and clear
all responded interrupts from local state.
- Update the protocol-v2 reference servers (`embed/protocol.mts`,
`protocol/service.mts`) to read the `responses` batch plus
`config`/`metadata` leniently and fold them onto the run servicing
`input.respond`.
- Update docs (interrupts/use-stream) across all framework packages and
add controller tests for batched resume.
|
||
|
Nagendhra Madishetti
|
14f2a79691 |
fix(langgraph-checkpoint): block prototype pollution in MemorySaver via reserved storage keys (#2352)
## Summary Closes a prototype-pollution sink (CWE-1321) in `MemorySaver`. A caller able to shape `thread_id`, `checkpoint_ns`, `checkpoint_id`, or `task_id` (every quickstart, tutorial, and test fixture uses `MemorySaver` by default) can pass `\"__proto__\"`, `\"constructor\"`, or `\"prototype\"` and have the subsequent property assignment mutate `Object.prototype`. The audit posted in #2346 (cc @etairl) listed *`__proto__` prototype pollution in `MemorySaver`* among the unfiled findings from the same security-review pass that produced #2337. This PR confirms the finding and closes it across all five entry points. ## Vulnerable sinks `libs/checkpoint/src/memory.ts`: | Method | Sink | |---|---| | `put` | `this.storage[threadId][checkpointNamespace][checkpoint.id] = ...` | | `putWrites` | `this.writes[outerKey][innerKeyStr] = ...` (with caller-controlled `taskId` flowing into `innerKeyStr`) | | `deleteThread` | `delete this.storage[threadId]` | | `getTuple` | `this.storage[thread_id]?.[checkpoint_ns]?.[checkpoint_id]` | | `list` | `this.storage[threadId]?.[checkpointNamespace]` plus `Object.keys(this.storage[threadId] ?? {})` | ## Proof of concept \`\`\`ts import { MemorySaver } from \"@langchain/langgraph-checkpoint\"; const saver = new MemorySaver(); await saver.put( { configurable: { thread_id: \"__proto__\", checkpoint_ns: \"\" } }, /* checkpoint */ { id: \"cp-1\", v: 4, ts: new Date().toISOString(), channel_values: {}, channel_versions: {}, versions_seen: {} } as any, /* metadata */ { source: \"input\", step: 0, parents: {} } as any, {} ); // Object.prototype is now polluted; every plain object in the process // inherits the injected key. const probe: Record<string, unknown> = {}; console.log(\"polluted\" in probe); // true console.log(probe[\"\"]); // the (formerly per-tenant) saved checkpoint \`\`\` Same shape works for `\"constructor\"` and `\"prototype\"`. Non-string identifiers (`{ \$ne: null }`, arrays, numbers, booleans) reach the same sinks unchecked. ## Severity Proposed CVSS 3.1: **High**. `MemorySaver` is the default in every quickstart and tutorial, and prototype pollution in Node.js is a documented stepping stone to RCE through gadget chains in downstream serializers, template engines, and dependency-resolution helpers. Network-reachable, low-complexity, only the privilege the SDK already grants to a caller. ## Fix A single private `assertSafeStorageKey` helper in `memory.ts`, applied at every public entry that touches `storage` or `writes` (15 call sites across 5 methods). The guard: * Asserts the value is a non-empty string (the documented empty `checkpoint_ns` default is opt-in via `{ allowEmpty: true }`). * Rejects the three prototype-pollution keys `__proto__`, `constructor`, `prototype`. * The `getTuple` and `list` read paths intentionally allow an empty or undefined `checkpoint_id` so the documented \"fetch latest\" behaviour continues to work; both paths still reject the magic keys. \`\`\`ts const POLLUTION_KEYS = new Set([\"__proto__\", \"constructor\", \"prototype\"]); function assertSafeStorageKey( field: string, value: unknown, options: { allowEmpty?: boolean } = {} ): asserts value is string { /* type check, empty check, pollution check, all with precise diagnostics */ } \`\`\` The guard is a TypeScript `asserts` predicate so call-sites get type narrowing for free and the compiler enforces that no later code path uses an unvalidated identifier. ## Why this design * Mirrors the chokepoint pattern used in PR #2349 (`MongoDBSaver`) and PR #2350 (`RedisSaver` / `ShallowRedisSaver`). All three savers now share the same defensive posture at their boundary. * Single private function: it is impossible for a future call-site to forget validation, and the `asserts` annotation surfaces missed sites at compile time. * No new dependencies, no API changes for valid inputs, no behaviour change for any documented happy path. ## Test plan * [x] 22 new tests in `libs/checkpoint/src/tests/memory-pollution.test.ts` under `describe(\"MemorySaver prototype-pollution guard\")`, parameterised across all three pollution keys plus type / empty / accept paths for every entry point. Includes a cross-test invariant (`afterEach` snapshots `Object.getOwnPropertyNames(Object.prototype)`) that asserts pollution did not actually occur even if the guard had been absent. * [x] Existing checkpoint suite green (\`pnpm --filter @langchain/langgraph-checkpoint test\`, 93 of 93 including the 22 new ones). * [x] Lint clean (\`oxlint\`, 0 warnings, 0 errors on the changed files). * [x] Format clean (\`oxfmt --check\`). * [x] No new dependencies, no public API changes, no behaviour change for valid string identifiers. ## Disclosure Original finding credited to @etairl (audit posted in #2346). This PR was prepared for coordinated public disclosure since the audit list is already public. Happy to coordinate timing with a private GHSA if the maintainers prefer. Pairs with the two earlier sibling fixes from the same audit pass: * PR #2349 / GHSA-98xf-r82g-9mhx (MongoDB NoSQL injection) * PR #2350 / GHSA-x3wm-3wx7-g6xm (Redis KEYS / SCAN injection) --------- Co-authored-by: Nagendhra <nagendhra405@gmail.com> Co-authored-by: Christian Bromann <git@bromann.dev> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Christian Bromann
|
80c2806cb2 |
fix(sdk): fold forkFrom client-side and honor multitaskStrategy (#2447)
## Summary - Fold the SDK's top-level `forkFrom` into `config.configurable.checkpoint_id` client-side before sending `run.start`, so `forkFrom` never reaches the server and the fork target travels via the single legacy-compliant field used by the existing run endpoints. - Drop the server-side `forkFrom` normalization/promotion in both protocol-v2 reference servers (`ProtocolService.createOrResumeRun` and the embed protocol routes), reading the fork target solely from `config.configurable.checkpoint_id`. - Honor the caller's per-run `multitaskStrategy` (`reject` | `rollback` | `interrupt` | `enqueue`) instead of hardcoding `interrupt`, falling back to `enqueue` (the legacy stream-endpoint default, matching the Python protocol-v2 server) when omitted or unrecognized. |
||
|
Nagendhra Madishetti
|
1e73c6b463 |
fix(langgraph-checkpoint-redis): block KEYS / SCAN pattern injection via top-level identifiers (#2350)
## Summary Closes a Redis pattern-injection sink (CWE-77, CWE-943) in `RedisSaver` and `ShallowRedisSaver`. A caller able to shape `thread_id`, `checkpoint_ns`, `checkpoint_id`, or `task_id` (multi-tenant SDK deployments where the `RunnableConfig` originates from request input, or webhook payloads that flow into a persisted thread) can promote a string identifier into a Redis glob (`*`, `?`, `[...]`) and read, overwrite, or wipe checkpoints belonging to other tenants. The audit posted in #2346 (cc @etairl) listed *Redis key/glob injection in `RedisSaver` / `ShallowRedisSaver`* among the unfiled findings from the same security-review pass. This PR confirms the finding and extends the fix to all key-building sites in both savers. ## Vulnerable sinks `RedisSaver` (`libs/checkpoint-redis/src/index.ts`): | Method | Sinks | |---|---| | `getTuple` | `keys(\"checkpoint:\${threadId}:\${checkpointNs}:*\")` plus the direct \`json.get\` key | | `list` (fallback paths) | `keys(\"checkpoint:\${threadId}:\${checkpointNs}:*\")`, `keys(\"checkpoint:*:\${checkpointNs}:*\")` | | `put` | `\`checkpoint:\${threadId}:\${checkpointNs}:\${checkpointId}\`` plus the zset key | | `putWrites` | per-write key, zset key, checkpoint key | | `deleteThread` | `keys(\"checkpoint:\${threadId}:*\")`, `keys(\"writes:\${threadId}:*\")` | | `loadPendingWrites` | `keys(\"checkpoint_write:\${threadId}:\${checkpointNs}:\${checkpointId}:*\")` | `ShallowRedisSaver` (`libs/checkpoint-redis/src/shallow.ts`) has the same five public entry points plus the equivalent helper. ## Proof of concept ```ts import { createClient } from \"redis\"; import { RedisSaver } from \"@langchain/langgraph-checkpoint-redis\"; const client = createClient({ url: process.env.REDIS_URL! }); await client.connect(); const saver = new RedisSaver(client); // Tenant A and Tenant B persist checkpoints normally. await saver.put( { configurable: { thread_id: \"tenant-a\", checkpoint_ns: \"\" } }, /* checkpoint */ { id: \"cp-a\", v: 4, ts: new Date().toISOString(), channel_values: {}, channel_versions: {}, versions_seen: {} } as any, /* metadata */ { source: \"input\", step: 0, parents: {} } as any, {} ); await saver.put( { configurable: { thread_id: \"tenant-b\", checkpoint_ns: \"\" } }, { id: \"cp-b\", v: 4, ts: new Date().toISOString(), channel_values: {}, channel_versions: {}, versions_seen: {} } as any, { source: \"input\", step: 0, parents: {} } as any, {} ); // Attacker controls only the thread_id of their own request. // Without the guard, deleteThread expands the KEYS pattern to a glob // and deletes BOTH tenants' checkpoints. await saver.deleteThread(\"*\"); // Both \`cp-a\` and \`cp-b\` are gone. ``` The same shape (`\"*\"`, `\"tenant-?\"`, `\"tenant-[ab]\"`, `\"a\\b\"`) is accepted by every Redis pattern site in the table above. ## Severity Proposed CVSS 3.1: **High**. The most severe sink is `deleteThread`, which gives full availability impact across every tenant in the database, with confidentiality (`getTuple`, `list`) and integrity (`put`, `putWrites`) impacts on the other paths. Network-reachable, low-complexity, only the privilege the SDK already grants to a caller. ## Fix A single `assertSafeKeyComponent` helper exported from `./utils.js`, applied at every key-building site (27 calls across 2 saver files plus the helper export). The guard: * Asserts the value is a non-empty string (the documented empty `checkpoint_ns` default is opt-in via `{ allowEmpty: true }`). * Rejects the Redis pattern meta-characters `* ? [ ] \`. * Rejects the `:` delimiter that would otherwise corrupt the colon-delimited key structure. \`\`\`ts export function assertSafeKeyComponent( field: string, value: unknown, options: { allowEmpty?: boolean } = {} ): asserts value is string { const { allowEmpty = false } = options; if (typeof value !== \"string\") { /* precise diagnostic */ throw ... } if (!allowEmpty && value === \"\") { throw ... } if (REDIS_KEY_FORBIDDEN.test(value)) { throw ... } } \`\`\` The guard is a TypeScript \`asserts\` predicate so call-sites get type narrowing for free and the compiler enforces that no later code path uses an unvalidated identifier. ## Why this design * Mirrors the maintainers' existing primitive-only pattern (\`escapeRediSearchTagValue\`) in the same file. * Single chokepoint: it is impossible for a future call-site to forget validation. * No new dependencies, no API changes for valid inputs, no behavior change for any documented happy path. * Pairs with PR #2349 (NoSQL injection in MongoDBSaver) so both backends now share the same defensive posture at the saver boundary. ## Test plan * [x] 11 new tests under \`describe(\"assertSafeKeyComponent\")\` in \`libs/checkpoint-redis/src/tests/utils.test.ts\` covering accept and reject paths for every input shape (normal string, empty with and without \`allowEmpty\`, every Redis meta-character, colon delimiter, every wrong type). * [x] Existing \`escapeRediSearchTagValue\` suite still green (regression). * [x] Full suite green (\`pnpm --filter @langchain/langgraph-checkpoint-redis test\`, 21 of 21). * [x] Format clean on all 4 changed files (\`oxfmt\`). * [x] No new dependencies, no public API changes, no behavior change for valid string identifiers. ## Disclosure Original finding credited to @etairl (audit posted in #2346). This PR was prepared for coordinated public disclosure since the audit list is already public. Happy to coordinate timing with a private GHSA if the maintainers prefer. --------- Co-authored-by: Nagendhra <nagendhra405@gmail.com> Co-authored-by: Christian Bromann <git@bromann.dev> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Christian Bromann
|
80a8c1200a |
refactor(sdk): drop StreamSubmitOptions.command and simplify forkFrom (#2443)
## Summary
- Remove `command` from `StreamSubmitOptions` and the
`submit-coordinator` resume-via-`submit` path so HITL resume goes
through `stream.respond()` only.
- Simplify `forkFrom` from `{ checkpointId: string }` to a plain
checkpoint id string across the SDK, protocol-v2 services, and docs.
- Update interrupt tests, examples (`HumanInTheLoopView`, branching
views), and React/Vue/Svelte/Angular JSDoc and migration/interrupt docs
to match.
|
||
|
github-actions[bot]
|
2f0010e3a5 |
chore: version packages (#2442)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-sdk@1.9.9 ### Patch Changes - [#2441](https://github.com/langchain-ai/langgraphjs/pull/2441) [`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): preserve apiUrl path prefix in stream transport URLs Use BaseClient-style URL concatenation in `toAbsoluteUrl` so SSE and WebSocket subscriptions work when the SDK is pointed at a proxied apiUrl with a path prefix (e.g. `/api/chat-langchain`). ## @langchain/angular@1.0.9 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 ## @langchain/react@1.0.9 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 ## @langchain/svelte@1.0.9 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 ## @langchain/vue@1.0.9 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 ## @example/ai-elements@0.1.24 ### Patch Changes - Updated dependencies \[]: - @langchain/react@1.0.9 ## @examples/assistant-ui-claude@0.1.24 ### Patch Changes - Updated dependencies \[]: - @langchain/react@1.0.9 ## @examples/ui-angular@0.0.34 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 - @langchain/angular@1.0.9 ## @examples/ui-multimodal@0.0.10 ### Patch Changes - Updated dependencies \[]: - @langchain/react@1.0.9 ## @examples/ui-react@0.0.10 ### Patch Changes - Updated dependencies \[[`dbbcb63`](https://github.com/langchain-ai/langgraphjs/commit/dbbcb636e742c38e89854a8ae7ef4e1566d44343)]: - @langchain/langgraph-sdk@1.9.9 - @langchain/react@1.0.9 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.9 @langchain/langgraph-sdk@1.9.9 @langchain/react@1.0.9 @langchain/svelte@1.0.9 @langchain/vue@1.0.9 |
||
|
Christian Bromann
|
dbbcb636e7 |
fix(sdk): preserve apiUrl path prefix in stream transport URLs (#2441)
## Summary - Fix `toAbsoluteUrl` to concatenate `apiUrl` and path instead of using `new URL(path, base)`, which dropped path prefixes on proxied deployments. - Route WebSocket stream URL construction through `toAbsoluteUrl` for consistency with SSE transport. - Add unit and integration tests for proxied apiUrl paths, plus shared transport test helpers. |
||
|
github-actions[bot]
|
4e71ace65a |
chore: version packages (#2439)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-sdk@1.9.8 ### Patch Changes - [#2438](https://github.com/langchain-ai/langgraphjs/pull/2438) [`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): cancel runs on stop by default and add disconnect() `stream.stop()` now calls `client.runs.cancel` for the active run before disconnecting the client (default `{ cancel: true }`). Join/rejoin UIs can call `stream.disconnect()` or `stop({ cancel: false })` to leave the agent running server-side. This fills a missing gap we found when migrating to v1. ## @langchain/angular@1.0.8 ### Patch Changes - [#2438](https://github.com/langchain-ai/langgraphjs/pull/2438) [`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): cancel runs on stop by default and add disconnect() `stream.stop()` now calls `client.runs.cancel` for the active run before disconnecting the client (default `{ cancel: true }`). Join/rejoin UIs can call `stream.disconnect()` or `stop({ cancel: false })` to leave the agent running server-side. This fills a missing gap we found when migrating to v1. - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 ## @langchain/react@1.0.8 ### Patch Changes - [#2438](https://github.com/langchain-ai/langgraphjs/pull/2438) [`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): cancel runs on stop by default and add disconnect() `stream.stop()` now calls `client.runs.cancel` for the active run before disconnecting the client (default `{ cancel: true }`). Join/rejoin UIs can call `stream.disconnect()` or `stop({ cancel: false })` to leave the agent running server-side. This fills a missing gap we found when migrating to v1. - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 ## @langchain/svelte@1.0.8 ### Patch Changes - [#2438](https://github.com/langchain-ai/langgraphjs/pull/2438) [`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): cancel runs on stop by default and add disconnect() `stream.stop()` now calls `client.runs.cancel` for the active run before disconnecting the client (default `{ cancel: true }`). Join/rejoin UIs can call `stream.disconnect()` or `stop({ cancel: false })` to leave the agent running server-side. This fills a missing gap we found when migrating to v1. - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 ## @langchain/vue@1.0.8 ### Patch Changes - [#2438](https://github.com/langchain-ai/langgraphjs/pull/2438) [`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): cancel runs on stop by default and add disconnect() `stream.stop()` now calls `client.runs.cancel` for the active run before disconnecting the client (default `{ cancel: true }`). Join/rejoin UIs can call `stream.disconnect()` or `stop({ cancel: false })` to leave the agent running server-side. This fills a missing gap we found when migrating to v1. - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 ## @example/ai-elements@0.1.23 ### Patch Changes - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/react@1.0.8 ## @examples/assistant-ui-claude@0.1.23 ### Patch Changes - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/react@1.0.8 ## @examples/ui-angular@0.0.33 ### Patch Changes - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 - @langchain/angular@1.0.8 ## @examples/ui-multimodal@0.0.9 ### Patch Changes - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/react@1.0.8 ## @examples/ui-react@0.0.9 ### Patch Changes - Updated dependencies \[[`29d2bde`](https://github.com/langchain-ai/langgraphjs/commit/29d2bde235bf85e8a5e1dd59a997266ff894484b)]: - @langchain/langgraph-sdk@1.9.8 - @langchain/react@1.0.8 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.8 @langchain/langgraph-sdk@1.9.8 @langchain/react@1.0.8 @langchain/svelte@1.0.8 @langchain/vue@1.0.8 |
||
|
Christian Bromann
|
29d2bde235 |
fix(sdk): cancel runs on stop by default and add disconnect() (#2438)
## Summary
- `stream.stop()` now cancels the active run server-side by default
(`client.runs.cancel`) before disconnecting the client transport.
- Added `stream.disconnect()` as an alias for `stop({ cancel: false })`
for join/rejoin UIs.
- Introduced `StreamStopOptions` (`{ cancel?: boolean }`) on
`StreamController` and all v1 framework bindings (React, Vue, Svelte,
Angular).
- Updated `use-stream.md` and added controller unit tests for
cancel-on-stop and no-cancel-on-disconnect.
|
||
|
github-actions[bot]
|
39ce52f248 |
chore: version packages (#2436)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-sdk@1.9.7 ### Patch Changes - [#2435](https://github.com/langchain-ai/langgraphjs/pull/2435) [`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): unwrap Command tool outputs and hide scoped task tools Filter wrapper `task` dispatch events from subagent-scoped tool-call projections and parse embedded ToolMessage results from LangGraph `Command` payloads on `tool-finished`. - [#2434](https://github.com/langchain-ai/langgraphjs/pull/2434) [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671) Thanks [@hntrl](https://github.com/hntrl)! - fix(react): avoid eager stream getter evaluation during object spread Mark optional `useStream` accessors as non-enumerable so object spread/rest destructuring does not accidentally read guarded fields like `history` or opt into additional stream modes. ## @langchain/angular@1.0.7 ### Patch Changes - [#2435](https://github.com/langchain-ai/langgraphjs/pull/2435) [`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): unwrap Command tool outputs and hide scoped task tools Filter wrapper `task` dispatch events from subagent-scoped tool-call projections and parse embedded ToolMessage results from LangGraph `Command` payloads on `tool-finished`. - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 ## @langchain/react@1.0.7 ### Patch Changes - [#2435](https://github.com/langchain-ai/langgraphjs/pull/2435) [`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): unwrap Command tool outputs and hide scoped task tools Filter wrapper `task` dispatch events from subagent-scoped tool-call projections and parse embedded ToolMessage results from LangGraph `Command` payloads on `tool-finished`. - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 ## @langchain/svelte@1.0.7 ### Patch Changes - [#2435](https://github.com/langchain-ai/langgraphjs/pull/2435) [`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): unwrap Command tool outputs and hide scoped task tools Filter wrapper `task` dispatch events from subagent-scoped tool-call projections and parse embedded ToolMessage results from LangGraph `Command` payloads on `tool-finished`. - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 ## @langchain/vue@1.0.7 ### Patch Changes - [#2435](https://github.com/langchain-ai/langgraphjs/pull/2435) [`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): unwrap Command tool outputs and hide scoped task tools Filter wrapper `task` dispatch events from subagent-scoped tool-call projections and parse embedded ToolMessage results from LangGraph `Command` payloads on `tool-finished`. - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 ## @example/ai-elements@0.1.22 ### Patch Changes - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e)]: - @langchain/react@1.0.7 ## @examples/assistant-ui-claude@0.1.22 ### Patch Changes - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e)]: - @langchain/react@1.0.7 ## @examples/ui-angular@0.0.32 ### Patch Changes - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 - @langchain/angular@1.0.7 ## @examples/ui-multimodal@0.0.8 ### Patch Changes - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e)]: - @langchain/react@1.0.7 ## @examples/ui-react@0.0.8 ### Patch Changes - Updated dependencies \[[`cfc8d27`](https://github.com/langchain-ai/langgraphjs/commit/cfc8d274e4dc99cb73ebd9abc4f971622105f08e), [`6b188e8`](https://github.com/langchain-ai/langgraphjs/commit/6b188e80ab989fc8396e1926f729d93b786ca671)]: - @langchain/langgraph-sdk@1.9.7 - @langchain/react@1.0.7 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.7 @langchain/langgraph-sdk@1.9.7 @langchain/react@1.0.7 @langchain/svelte@1.0.7 @langchain/vue@1.0.7 |
||
|
Hunter Lovell
|
6b188e80ab |
fix(sdk): avoid eager stream getter evaluation (#2434)
## Summary fix(sdk): avoid eager stream getter evaluation during spread This fixes a React `useStream` development-mode failure where passing the stream handle through components that clone or rest-spread props could accidentally read lazy getters. The guarded `history` getter still throws when explicitly accessed with `fetchStateHistory: false`, but object spread no longer trips that path or widens `streamMode` by touching optional accessors. ## Changes `@langchain/langgraph-sdk` - Marks optional `useStream` accessors (`history`, `experimental_branchTree`, `toolProgress`, `subagents`, `activeSubagents`) as non-enumerable on the returned stream handle. - Preserves explicit access behavior for those accessors, including the existing `history` guard and stream mode opt-in for `toolProgress`/`subagents`. - Adds React hook regression coverage for object spread, explicit getter access, and stream mode inference. |
||
|
Christian Bromann
|
cfc8d274e4 |
fix(sdk): unwrap Command tool outputs and hide scoped task tools (#2435)
## Summary - Filter scoped deep-agent `task` dispatch events out of `sub.toolCalls` so subagent tool streams only show real worker tools. - Unwrap LangGraph `Command` payloads in `parseToolOutput` when they carry an embedded `ToolMessage`, so `tc.output` resolves to the actual tool result instead of raw graph state. - Share the scoped-task filter between client subagent handles and framework tool-call projections. |
||
|
github-actions[bot]
|
9c9da48ae2 |
chore: version packages (#2433)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-sdk@1.9.6 ### Patch Changes - [#2430](https://github.com/langchain-ai/langgraphjs/pull/2430) [`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): clear subgraph and subagent discovery on thread swap Reset discovery stores in `StreamController.#teardownThread()` so starting a new thread does not leave stale subgraph cards or subagent entries from the previous run. ## @langchain/angular@1.0.6 ### Patch Changes - [#2430](https://github.com/langchain-ai/langgraphjs/pull/2430) [`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): clear subgraph and subagent discovery on thread swap Reset discovery stores in `StreamController.#teardownThread()` so starting a new thread does not leave stale subgraph cards or subagent entries from the previous run. - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 ## @langchain/react@1.0.6 ### Patch Changes - [#2430](https://github.com/langchain-ai/langgraphjs/pull/2430) [`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): clear subgraph and subagent discovery on thread swap Reset discovery stores in `StreamController.#teardownThread()` so starting a new thread does not leave stale subgraph cards or subagent entries from the previous run. - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 ## @langchain/svelte@1.0.6 ### Patch Changes - [#2430](https://github.com/langchain-ai/langgraphjs/pull/2430) [`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): clear subgraph and subagent discovery on thread swap Reset discovery stores in `StreamController.#teardownThread()` so starting a new thread does not leave stale subgraph cards or subagent entries from the previous run. - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 ## @langchain/vue@1.0.6 ### Patch Changes - [#2430](https://github.com/langchain-ai/langgraphjs/pull/2430) [`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): clear subgraph and subagent discovery on thread swap Reset discovery stores in `StreamController.#teardownThread()` so starting a new thread does not leave stale subgraph cards or subagent entries from the previous run. - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 ## @example/ai-elements@0.1.21 ### Patch Changes - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/react@1.0.6 ## @examples/assistant-ui-claude@0.1.21 ### Patch Changes - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/react@1.0.6 ## @examples/ui-angular@0.0.31 ### Patch Changes - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 - @langchain/angular@1.0.6 ## @examples/ui-multimodal@0.0.7 ### Patch Changes - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/react@1.0.6 ## @examples/ui-react@0.0.7 ### Patch Changes - Updated dependencies \[[`f99941f`](https://github.com/langchain-ai/langgraphjs/commit/f99941f5fe8671ddcb6a78e93e5e05f4028d4af4)]: - @langchain/langgraph-sdk@1.9.6 - @langchain/react@1.0.6 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.6 @langchain/langgraph-sdk@1.9.6 @langchain/react@1.0.6 @langchain/svelte@1.0.6 @langchain/vue@1.0.6 |
||
|
Christian Bromann
|
f99941f5fe |
fix(sdk): clear subgraph and subagent discovery on thread swap (#2430)
## Summary - Add `reset()` to `SubgraphDiscovery` and `SubagentDiscovery` to clear internal maps and committed store snapshots. - Call both resets from `StreamController.#teardownThread()` alongside existing per-thread resets (messages, tools, metadata). - Add unit tests for discovery `reset()` and a controller test that `hydrate(null)` clears subgraphs after lifecycle events. |
||
|
github-actions[bot]
|
7788dceb85 |
chore: version packages (#2424)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint-redis@1.0.5 ### Patch Changes - [#2208](https://github.com/langchain-ai/langgraphjs/pull/2208) [`ebeb145`](https://github.com/langchain-ai/langgraphjs/commit/ebeb1452d27fcca100cd63bdfd4a7f020949412c) Thanks [@jackjin1997](https://github.com/jackjin1997)! - Fix `deleteThread()` using wrong key pattern (`writes:` instead of `checkpoint_write:`) and add missing cleanup of `write_keys_zset:` entries. ## @langchain/langgraph-supervisor@1.0.3 ### Patch Changes - [#2317](https://github.com/langchain-ai/langgraphjs/pull/2317) [`c088c76`](https://github.com/langchain-ai/langgraphjs/commit/c088c7659c18edf26091813ff384f48f5335bef6) Thanks [@fish895623](https://github.com/fish895623)! - feat(supervisor): widen agents type to accept createAgent graphs ## @langchain/langgraph-sdk@1.9.5 ### Patch Changes - [#2421](https://github.com/langchain-ai/langgraphjs/pull/2421) [`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(stream): align AssembledToolCall typing with pre-v1 expectations Make `InferToolCalls` resolve to generic `AssembledToolCall` unions, expose sync `status`/`error` for reactive bindings, and align type tests across React, Vue, Svelte, and Angular SDK packages. ## @langchain/angular@1.0.5 ### Patch Changes - [#2421](https://github.com/langchain-ai/langgraphjs/pull/2421) [`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(stream): align AssembledToolCall typing with pre-v1 expectations Make `InferToolCalls` resolve to generic `AssembledToolCall` unions, expose sync `status`/`error` for reactive bindings, and align type tests across React, Vue, Svelte, and Angular SDK packages. - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 ## @langchain/react@1.0.5 ### Patch Changes - [#2421](https://github.com/langchain-ai/langgraphjs/pull/2421) [`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(stream): align AssembledToolCall typing with pre-v1 expectations Make `InferToolCalls` resolve to generic `AssembledToolCall` unions, expose sync `status`/`error` for reactive bindings, and align type tests across React, Vue, Svelte, and Angular SDK packages. - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 ## @langchain/svelte@1.0.5 ### Patch Changes - [#2421](https://github.com/langchain-ai/langgraphjs/pull/2421) [`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(stream): align AssembledToolCall typing with pre-v1 expectations Make `InferToolCalls` resolve to generic `AssembledToolCall` unions, expose sync `status`/`error` for reactive bindings, and align type tests across React, Vue, Svelte, and Angular SDK packages. - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 ## @langchain/vue@1.0.5 ### Patch Changes - [#2421](https://github.com/langchain-ai/langgraphjs/pull/2421) [`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(stream): align AssembledToolCall typing with pre-v1 expectations Make `InferToolCalls` resolve to generic `AssembledToolCall` unions, expose sync `status`/`error` for reactive bindings, and align type tests across React, Vue, Svelte, and Angular SDK packages. - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 ## @example/ai-elements@0.1.20 ### Patch Changes - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/react@1.0.5 ## @examples/assistant-ui-claude@0.1.20 ### Patch Changes - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/react@1.0.5 ## @examples/ui-angular@0.0.30 ### Patch Changes - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 - @langchain/angular@1.0.5 ## @examples/ui-multimodal@0.0.6 ### Patch Changes - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/react@1.0.5 ## @examples/ui-react@0.0.6 ### Patch Changes - Updated dependencies \[[`3529e38`](https://github.com/langchain-ai/langgraphjs/commit/3529e3831a488134e7dfaefa4ed7fb1140cf8bb6)]: - @langchain/langgraph-sdk@1.9.5 - @langchain/react@1.0.5 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.5 @langchain/langgraph-checkpoint-redis@1.0.5 @langchain/langgraph-sdk@1.9.5 @langchain/langgraph-supervisor@1.0.3 @langchain/react@1.0.5 @langchain/svelte@1.0.5 @langchain/vue@1.0.5 |
||
|
Christian Bromann
|
b1d307ab84 |
ci(infra): run framework browser tests only when paths change (#2425)
## Summary - Add a `detect-changes` job to the browser test workflow using `dorny/paths-filter@v3.0.2`. - Run all four framework browser jobs when `libs/sdk/**` changes or when this workflow file changes. - Run only the matching job when `libs/sdk-react`, `libs/sdk-angular`, `libs/sdk-vue`, or `libs/sdk-svelte` changes. - Keep the full matrix on `workflow_dispatch` (manual runs and CI dispatched via workflow_dispatch). |
||
|
dependabot[bot]
|
674173b8ac |
chore(deps-dev): bump turbo from 2.8.15 to 2.9.14 (#2428)
Bumps [turbo](https://github.com/vercel/turborepo) from 2.8.15 to 2.9.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.9.14</h2> <blockquote> <p>[!NOTE] This release contains important security fixes.</p> </blockquote> <h3>High:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm">GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection</a></li> </ul> <h3>Low:</h3> <ul> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r">GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation</a></li> <li><a href="https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726">GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection</a></li> </ul> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> <li>chore: Release 2.9.13 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12803">vercel/turborepo#12803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dancrumb"><code>@dancrumb</code></a> made their first contribution in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14">https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14</a></p> <h2>Turborepo v2.9.13-canary.1</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.9.11-canary.7 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12768">vercel/turborepo#12768</a></li> <li>fix: Allow <code>$TURBO_EXTENDS$</code> in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12770">vercel/turborepo#12770</a></li> <li>release(turborepo): 2.9.11 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12771">vercel/turborepo#12771</a></li> <li>fix: Allow transit nodes in LSP diagnostics by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12773">vercel/turborepo#12773</a></li> <li>release(turborepo): 2.9.12 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/12774">vercel/turborepo#12774</a></li> <li>fix: Restore docs mobile menu by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12782">vercel/turborepo#12782</a></li> <li>ci: Use <code>pull_request</code> for PR title linting by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12787">vercel/turborepo#12787</a></li> <li>ci: Scope GitHub Actions caches by branch by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12788">vercel/turborepo#12788</a></li> <li>test: Validate lockfiles without dependency downloads by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12789">vercel/turborepo#12789</a></li> <li>Removed unneeded import form hash creation script in docs by <a href="https://github.com/dancrumb"><code>@dancrumb</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12799">vercel/turborepo#12799</a></li> <li>fix: Validate auth callback state by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12802">vercel/turborepo#12802</a></li> <li>fix: Harden VS Code extension command execution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12800">vercel/turborepo#12800</a></li> <li>fix: Avoid project-local Yarn during detection by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/12801">vercel/turborepo#12801</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/fc62fe0d9c347d1d24f0ed8946284856593ddb93"><code>fc62fe0</code></a> publish 2.9.14 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/fb8c9aec0f9e83f95783659a5ce9c4478cf62cb9"><code>fb8c9ae</code></a> chore: Release 2.9.13 (<a href="https://redirect.github.com/vercel/turborepo/issues/12803">#12803</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e8e629da4e1fb75231089e91b19be9d327a3e649"><code>e8e629d</code></a> fix: Avoid project-local Yarn during detection (<a href="https://redirect.github.com/vercel/turborepo/issues/12801">#12801</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/91c90cbf12f524c5c29b713d6472dd5fcdecb309"><code>91c90cb</code></a> fix: Harden VS Code extension command execution (<a href="https://redirect.github.com/vercel/turborepo/issues/12800">#12800</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/84f450894e87da1eed864d51f6f637f26980d560"><code>84f4508</code></a> fix: Validate auth callback state (<a href="https://redirect.github.com/vercel/turborepo/issues/12802">#12802</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/1779ad7901384f106236a6e196059e4929745514"><code>1779ad7</code></a> Removed unneeded import form hash creation script in docs (<a href="https://redirect.github.com/vercel/turborepo/issues/12799">#12799</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/71f8c90a807ffb9b9876ea8a04f523f473bf5c8d"><code>71f8c90</code></a> test: Validate lockfiles without dependency downloads (<a href="https://redirect.github.com/vercel/turborepo/issues/12789">#12789</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/5fcb96024d503127bb0ed760ebe159b7716c52b3"><code>5fcb960</code></a> ci: Scope GitHub Actions caches by branch (<a href="https://redirect.github.com/vercel/turborepo/issues/12788">#12788</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/4cf9fabc9a6f6c99fe4e2f2da9f35be631be062a"><code>4cf9fab</code></a> ci: Use <code>pull_request</code> for PR title linting (<a href="https://redirect.github.com/vercel/turborepo/issues/12787">#12787</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/859c629bc401f239ac7980a132746ca90478e17c"><code>859c629</code></a> fix: Restore docs mobile menu (<a href="https://redirect.github.com/vercel/turborepo/issues/12782">#12782</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.8.15...v2.9.14">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
배성훈
|
c088c7659c |
feat(supervisor): widen agents type to accept createAgent graphs (#2317)
## Summary - Add a broader `CompiledStateGraph<any, any, string, any, any>` to the `agents` union in `CreateSupervisorParams` - Graphs produced by `createAgent` from `langchain` (via `.graph`) are now accepted alongside existing `createReactAgent` graphs and `RemoteGraph` - The original `AnnotationRootT`-parameterized `CompiledStateGraph` type is preserved for backward compatibility ## Motivation The new `createAgent` API in the `langchain` package returns a `ReactAgent` whose `.graph` property is a `CompiledStateGraph` with a different state schema (`BuiltInState`) than the `MessagesAnnotation`-based state from `createReactAgent`. Since `createReactAgent` is deprecated in favor of `createAgent`, `createSupervisor` needs to accept both graph types. At runtime this already works — `makeCallAgent` types its `agent` parameter as `any` and only accesses `.name`, `.invoke()`, and optionally `.description`. The type constraint on the `agents` parameter was simply too narrow for the new API. ## Changes ### `@langchain/langgraph-supervisor` (`libs/langgraph-supervisor`) - Updated `CreateSupervisorParams.agents` type to include `CompiledStateGraph<any, any, string, any, any>` in the union alongside the existing strictly-typed `CompiledStateGraph` and `RemoteGraph` ## Test plan - [x] `pnpm build` passes for `@langchain/langgraph-supervisor` - [x] Consuming project using `createAgent` + `createSupervisor` compiles without errors - [x] Existing supervisor tests still pass --------- Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Jackjin
|
ebeb1452d2 |
fix(langgraph-checkpoint-redis): fix deleteThread using wrong key pattern for writes (#2208)
## Summary Fixes #2207 - Fix `deleteThread()` using incorrect `writes:` prefix instead of `checkpoint_write:` for write key deletion - Add missing cleanup of `write_keys_zset:` entries, matching the correct implementation in `ShallowRedisSaver` The bug was found by comparing `RedisSaver.deleteThread()` with `ShallowRedisSaver.deleteThread()` in `shallow.ts`, which correctly uses `checkpoint_write:` prefix and also cleans up zset keys. ## AI Disclosure This bug was identified through code review with AI assistance. The fix aligns the standard `RedisSaver` implementation with the existing correct `ShallowRedisSaver` implementation. --------- Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Christian Bromann
|
f32a37384c | fix ci | ||
|
Christian Bromann
|
3529e3831a |
fix(sdk): align AssembledToolCall typing with pre-v1 expectations (#2421)
## Summary - Split tool-call handles by consumer: - **Client SDK** (`ThreadStream.toolCalls`, subgraph/subagent projections): `ClientAssembledToolCall` with a promise-only `output` (resolves on success, rejects on error). Still exported as `AssembledToolCall` from `@langchain/langgraph-sdk/client` for script usage. - **Framework SDKs** (`stream.toolCalls`, `useToolCalls`, `injectToolCalls`): `AssembledToolCall` with plain reactive fields — `output: T | null`, `status`, and `error` — updated in place as events arrive so React/Vue/Svelte/Angular can render from snapshots without `await`, effects, or Suspense around promises. - Add generic `AssembledToolCall<TName, TInput, TOutput>` plus `id`/`args` aliases; point `InferToolCalls` at assembled streaming handles and add `AssembledToolCallFromTool` (exported as `ToolCallFromTool` from `@langchain/react`, `@langchain/vue`, `@langchain/svelte`, and `@langchain/angular`). - Rework `ToolCallAssembler` around a mutable internal handle and `toClientAssembledToolCall()` for client projections; framework stores the reactive handle directly. - Remove redundant `InferAssembledToolCalls` and deprecated `StateOf`; wire typed `toolCalls` / selector generics across all four framework packages. - Expand and align `createAgent`, `createDeepAgent`, and `langgraph` type tests across React, Vue, Svelte, and Angular; update examples, protocol-v2 integration tests, and Vue migration docs. |
||
|
github-actions[bot]
|
4a7d9a7c5d |
chore: version packages (#2416)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph@1.3.2 ### Patch Changes - [#2415](https://github.com/langchain-ai/langgraphjs/pull/2415) [`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - Move `@langchain/core` from a runtime dependency back to a required peer dependency so installing the SDK alone no longer pulls in `@langchain/core` (and `js-tiktoken`, etc.). Consumers that use streaming or message coercion must install `@langchain/core` explicitly or via `@langchain/langgraph`. - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 ## @langchain/langgraph-sdk@1.9.4 ### Patch Changes - [#2415](https://github.com/langchain-ai/langgraphjs/pull/2415) [`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - Move `@langchain/core` from a runtime dependency back to a required peer dependency so installing the SDK alone no longer pulls in `@langchain/core` (and `js-tiktoken`, etc.). Consumers that use streaming or message coercion must install `@langchain/core` explicitly or via `@langchain/langgraph`. ## @langchain/angular@1.0.4 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 ## @langchain/react@1.0.4 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 ## @langchain/svelte@1.0.4 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 ## @langchain/vue@1.0.4 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 ## @example/ai-elements@0.1.19 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph@1.3.2 - @langchain/react@1.0.4 ## @examples/assistant-ui-claude@0.1.19 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph@1.3.2 - @langchain/react@1.0.4 ## @examples/ui-angular@0.0.29 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 - @langchain/langgraph@1.3.2 - @langchain/angular@1.0.4 ## @examples/ui-multimodal@0.0.5 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph@1.3.2 - @langchain/react@1.0.4 ## @examples/ui-react@0.0.5 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph-sdk@1.9.4 - @langchain/langgraph@1.3.2 - @langchain/react@1.0.4 ## langgraph@1.0.34 ### Patch Changes - Updated dependencies \[[`9d3c9dd`](https://github.com/langchain-ai/langgraphjs/commit/9d3c9dd3182059f9eca9fd9b14d8f7466b4338c4)]: - @langchain/langgraph@1.3.2 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.4 @langchain/langgraph-sdk@1.9.4 @langchain/langgraph@1.3.2 @langchain/react@1.0.4 @langchain/svelte@1.0.4 @langchain/vue@1.0.4 |
||
|
Christian Bromann
|
b893dc5468 | fix: add @langchain/langgraph to changeset | ||
|
Christian Bromann
|
9d3c9dd318 |
fix(core): move @langchain/core back into being a peer dep (#2415)
`@langchain/langgraph-sdk@1.9.0` promoted `@langchain/core` from a dev dependency to a **runtime dependency**, which caused install-size metrics for `@langchain/langgraph` to jump from ~6 MB to ~40 MB for consumers who did not already have core installed (or who use `--legacy-peer-deps`). That happened because core pulls in heavy transitive deps such as `js-tiktoken` (~21 MB) and `zod` (~6 MB), even though `@langchain/langgraph` already lists core as a peer. This PR moves `@langchain/core` back to a **required peer dependency** on the SDK, matching `@langchain/langgraph` and the pre-1.9.0 SDK layout. Runtime behavior is unchanged for typical LangGraph apps that already install core; SDK-only installs no longer force core into the tree. Also switches `LangChainTracer` in `types.ts` to a type-only import so the tracer subpath is not pulled as a value import. |
||
|
dependabot[bot]
|
ea131491b3 |
chore(deps): bump brace-expansion from 1.1.12 to 5.0.6 (#2412)
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 5.0.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <ul> <li>fmt 5a5cc17</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 0b6a978</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1">https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <ul> <li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64">#64</a>) 278132b</li> <li>fmt dd72a59</li> <li>add <code>tea.yaml</code> 70e4c1b</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p> <p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p> <h2>v3.0.1</h2> <ul> <li>pkg: publish on tag 3.x 3059c07</li> <li>fmt 8229e6f</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 15f9b3c</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p> <h2>v3.0.0</h2> <ul> <li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62">#62</a>) c0360e8</li> <li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55">#55</a>) 68c0e37</li> <li>node 16 is EOL 9e781e9</li> <li>add standard 3494c4d</li> <li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57">#57</a>) dd5a4cb</li> <li>docs 6dad209</li> <li>remove <code>test</code> e3dd8ae</li> <li>ci: update node versions d23ede9</li> <li>docs: add <a href="https://github.com/lanodan"><code>@lanodan</code></a> to contributors 1eb3fa4</li> <li>docs 1e7c9cd</li> <li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60">#60</a>) 2520537</li> <li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59">#59</a>) 61a94f1</li> <li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51">#51</a>) dc741cf</li> <li>docs: add back ci badge 8ee5626</li> <li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52">#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53">#53</a>) 5c8756a</li> <li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50">#50</a>) 05978a7</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0">https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p> <h2>v2.0.2</h2> <ul> <li>pkg: publish on tag 2.x 14f1d91</li> <li>fmt ed7780a</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 36603d5</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a> 5.0.6</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a> Bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/87939017c6cb6be56b98c6fa2059b073315cd534"><code>8793901</code></a> 5.0.5</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051"><code>9a02af5</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a"><code>daa71bc</code></a> Bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/92">#92</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/799e5f7a222b0ea29052090b80fab2125a846543"><code>799e5f7</code></a> Bump tar from 7.5.9 to 7.5.10 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/90">#90</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/012c230b7f71ca0c43febfa2dc3b710f63f129dd"><code>012c230</code></a> 5.0.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/243c491714270462decf1293b395e0aa6f6c15c4"><code>243c491</code></a> Fix handling of brackets. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/87">#87</a></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/609f8588070198ca6ff7132d2f78bbae5c991b93"><code>609f858</code></a> Correct incorrect brace-expansion import (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/89">#89</a>)</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v5.0.6">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
0e61e8cb48 |
chore(deps): bump protobufjs from 6.11.5 to 7.6.0 (#2411)
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 6.11.5 to 7.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p> <blockquote> <h2>protobufjs: v7.6.0</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2>protobufjs: v7.5.9</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2>protobufjs: v7.5.8</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2>protobufjs: v7.5.7</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2>protobufjs: v7.5.6</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2>v7.5.5</h2> <p>This release backports two reported security issues to 7.x branch.</p> <ul> <li>fix: do not allow setting <code>__proto__</code> in Message constructor (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2126">#2126</a>)</li> <li>fix: filter invalid characters from the type name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2127">#2127</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5">https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5</a></p> <h2>protobufjs: v7.5.4</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.0/CHANGELOG.md">protobufjs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.9...protobufjs-v7.6.0">7.6.0</a> (2026-05-18)</h2> <h3>Features</h3> <ul> <li>Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7">f769242</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.8...protobufjs-v7.5.9">7.5.9</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797">0853a62</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <h3>Bug Fixes</h3> <ul> <li>invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760">5a3769a</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.2...protobufjs-v7.5.3">7.5.3</a> (2025-05-28)</h2> <h3>Bug Fixes</h3> <ul> <li>descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68">6e255d4</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.1...protobufjs-v7.5.2">7.5.2</a> (2025-05-14)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e30c3341382b504a975d0d83f19170218cb461c3"><code>e30c334</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2260">#2260</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/f76924244504b159efe1bb13b154fd17be3c13e7"><code>f769242</code></a> feat: Support BigInt conversions (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2258">#2258</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/ab3862d133ab9b824f12eab5f993784333543dbf"><code>ab3862d</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2255">#2255</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/0853a625680f9247596b84ef48082b8f4e554797"><code>0853a62</code></a> fix: Backport bundler-safe optional module lookups (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2254">#2254</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/d7035f9b7f06210ea343cab1f2f1cc18ee5cc1d6"><code>d7035f9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2248">#2248</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26"><code>54b593f</code></a> fix: Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e88fcea1635f79c414e8a070e164d38ea99e104a"><code>e88fcea</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2239">#2239</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5"><code>cc7d595</code></a> fix: Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/3abc9b54d67a7102785c6dfd8bf6610f545d445b"><code>3abc9b5</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2190">#2190</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/a0bf2dfdd8a75aa62ce5a1ff47a52b9b8f1ea793"><code>a0bf2df</code></a> fix: Update CLI peer dependency (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2189">#2189</a>)</li> <li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/v6.11.5...protobufjs-v7.6.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for protobufjs since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepublish</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
github-actions[bot]
|
1b5ce0fca0 |
chore: version packages (#2405)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint-mongodb@1.3.1 ### Patch Changes - [#2397](https://github.com/langchain-ai/langgraphjs/pull/2397) [`284226c`](https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c) Thanks [@hntrl](https://github.com/hntrl)! - fix(checkpoint-mongodb): validate configurable checkpoint identifiers before queries Add runtime validation for `thread_id`, `checkpoint_ns`, and `checkpoint_id` in `MongoDBSaver` methods that read and write checkpoints. This prevents object-based operator payloads from being passed into MongoDB query filters and ensures invalid configurable values fail fast with explicit errors. ## @langchain/langgraph-api@1.2.2 ### Patch Changes - [#2396](https://github.com/langchain-ai/langgraphjs/pull/2396) [`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8) Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph-cli): accept hyphenated prerelease tags in `api_version` values. - Updated dependencies \[]: - @langchain/langgraph-ui@1.2.2 ## @langchain/langgraph-cli@1.2.2 ### Patch Changes - [#2389](https://github.com/langchain-ai/langgraphjs/pull/2389) [`40bcdab`](https://github.com/langchain-ai/langgraphjs/commit/40bcdab38fa495028d8eba68062e48079dbe9208) Thanks [@jdrogers940](https://github.com/jdrogers940)! - Adding support for pre-release versions in api_version. - [#2396](https://github.com/langchain-ai/langgraphjs/pull/2396) [`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8) Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph-cli): accept hyphenated prerelease tags in `api_version` values. - Updated dependencies \[[`9b20df0`](https://github.com/langchain-ai/langgraphjs/commit/9b20df081a82b79efca3dfd2c128243889b11eb8)]: - @langchain/langgraph-api@1.2.2 ## @langchain/langgraph@1.3.1 ### Patch Changes - [#2339](https://github.com/langchain-ai/langgraphjs/pull/2339) [`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f) Thanks [@vigneshpatel14](https://github.com/vigneshpatel14)! - fix(langgraph): surface structuredResponse parse failures in createReactAgent - [#2406](https://github.com/langchain-ai/langgraphjs/pull/2406) [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-core): keep tool results out of v3 message streams - [#2376](https://github.com/langchain-ai/langgraphjs/pull/2376) [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280) Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph): prefer configurable assistant and graph IDs for runtime server info Update runtime `serverInfo` construction to read `assistant_id` and `graph_id` from `config.configurable` first, with fallback to `config.metadata` for compatibility. Also expands `execution_info` tests to cover configurable sourcing, precedence, and metadata fallback behavior. - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 ## @langchain/langgraph-sdk@1.9.3 ### Patch Changes - [#2387](https://github.com/langchain-ai/langgraphjs/pull/2387) [`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Coalesce `RootMessageProjection` store writes through a single `setTimeout(0)` flush so long `messages`-channel replays (on refresh, mid-run join, or rapid subagent streaming) no longer drain as a per-event microtask chain that trips React's `Maximum update depth exceeded` guard. Replaces the previous `MessageChannel`-based batching, which deferred initial-submit events past the first render and left the UI looking frozen until refresh. - [#2372](https://github.com/langchain-ai/langgraphjs/pull/2372) [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7) Thanks [@ahmed-z0](https://github.com/ahmed-z0)! - Fix subagent message routing to prefer the stream event namespace over checkpoint metadata when filtering subagent messages. - [#2384](https://github.com/langchain-ai/langgraphjs/pull/2384) [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - batch RootMessageProjection store writes through a macrotask - [#2388](https://github.com/langchain-ai/langgraphjs/pull/2388) [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c) Thanks [@hntrl](https://github.com/hntrl)! - fix(sdk): retry connection failures before throwing ConnectionError - [#2381](https://github.com/langchain-ai/langgraphjs/pull/2381) [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - fix(sdk): forward config + metadata on respondInput for resume submits - [#2379](https://github.com/langchain-ai/langgraphjs/pull/2379) [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - filter SSE-replayed input.requested events through a hydrated interrupt allowlist - [#2390](https://github.com/langchain-ai/langgraphjs/pull/2390) [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Bind deepagents subagent discovery to the execution namespace via taskInput so `useMessages(stream, subagent)` resolves the streaming scope instead of the trigger tool-call namespace. ## @langchain/angular@1.0.3 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 ## @langchain/react@1.0.3 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 ## @langchain/svelte@1.0.3 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 ## @langchain/vue@1.0.3 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 ## @langchain/langgraph-cua@1.0.2 ## @langchain/langgraph-supervisor@1.0.2 ## @langchain/langgraph-swarm@1.0.2 ## @langchain/langgraph-ui@1.2.2 ## @example/ai-elements@0.1.18 ### Patch Changes - Updated dependencies \[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1 - @langchain/react@1.0.3 ## @examples/assistant-ui-claude@0.1.18 ### Patch Changes - Updated dependencies \[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1 - @langchain/react@1.0.3 ## @examples/ui-angular@0.0.28 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 - @langchain/langgraph@1.3.1 - @langchain/angular@1.0.3 ## @examples/ui-multimodal@0.0.4 ### Patch Changes - Updated dependencies \[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1 - @langchain/react@1.0.3 ## @examples/ui-react@0.0.4 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`01dd046`](https://github.com/langchain-ai/langgraphjs/commit/01dd0462ed300dee5a9a51f229e6c401315f070c), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3 - @langchain/langgraph@1.3.1 - @langchain/react@1.0.3 ## langgraph@1.0.33 ### Patch Changes - Updated dependencies \[[`2b88da4`](https://github.com/langchain-ai/langgraphjs/commit/2b88da497b2c6f8fbf8f4d901578a198824eb32f), [`e54ae90`](https://github.com/langchain-ai/langgraphjs/commit/e54ae901e119ccf81653b90d5a0db2485027a5a9), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1 ## docs@null # docs ## null ## null --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Hunter Lovell <hunter@hntrl.io>@langchain/angular@1.0.3 @langchain/langgraph-supervisor@1.0.2 @langchain/langgraph-swarm@1.0.2 @langchain/langgraph@1.3.1 @langchain/svelte@1.0.3 @langchain/vue@1.0.3 |
||
|
Hunter Lovell
|
284226c7ca |
fix(langgraph-checkpoint-mongodb): validate configurable checkpoint IDs (#2397)
## Summary Fixes #2351 This change hardens `@langchain/langgraph-checkpoint-mongodb` against object-based configurable input in checkpoint identifiers. It adds runtime validation for `thread_id`, `checkpoint_ns`, and `checkpoint_id` before any MongoDB query/write path uses these values, so operator-like payloads are rejected early with explicit errors. ## Changes ### `@langchain/langgraph-checkpoint-mongodb` - Added a shared `getStringConfigValue` runtime validator in [`libs/checkpoint-mongodb/src/checkpoint.ts`](libs/checkpoint-mongodb/src/checkpoint.ts). - Applied validation to `getTuple`, `list`, `put`, `putWrites`, and `deleteThread`. - Preserved existing behavior where `getTuple` returns `undefined` when `thread_id` is missing, while now rejecting non-string values. - Added regression tests in [`libs/checkpoint-mongodb/src/tests/checkpoints.test.ts`](libs/checkpoint-mongodb/src/tests/checkpoints.test.ts) for object/operator payloads across the affected methods. - Added a patch changeset for `@langchain/langgraph-checkpoint-mongodb`. Co-authored-by: Itay <9601971+etairl@users.noreply.github.com> |
||
|
dependabot[bot]
|
428c4e3f29 |
chore(deps): bump ws from 8.19.0 to 8.20.1 (#2413)
Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.20.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.20.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed an uninitialized memory disclosure issue in <code>websocket.close()</code> (c0327ec1).</li> </ul> <p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>) as the <code>reason</code> argument for <code>websocket.close()</code>, rather than the supported string or <code>Buffer</code> types, caused uninitialized memory to be disclosed to the remote peer.</p> <pre lang="js"><code>import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer( { port: 0, skipUTF8Validation: true }, function () { const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>, { skipUTF8Validation: true });</p> <pre><code>ws.on('close', function (code, reason) { deepStrictEqual(reason, Buffer.alloc(80)); }); </code></pre> <p>} );</p> <p>wss.on('connection', function (ws) { ws.close(1000, new Float32Array(20)); }); </code></pre></p> <p>The issue was privately reported by <a href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p> <h2>8.20.0</h2> <h1>Features</h1> <ul> <li>Added exports for the <code>PerMessageDeflate</code> class and utilities for the <code>Sec-WebSocket-Extensions</code> and <code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li><a href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a> [api] Convert the <code>isServer</code> and <code>maxPayload</code> parameters to options</li> <li><a href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a> [doc] Add missing space</li> <li><a href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a> [pkg] Update eslint to version 10.0.1</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.19.0...8.20.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Hunter Lovell
|
c6c0a58c3a | chore: exit rc (#2414) | ||
|
Christian Bromann
|
e54ae901e1 |
fix(core): keep tool results out of v3 message streams (#2406)
## Summary - Prevent v3 `run.messages` from surfacing `ToolMessage` outputs as assistant text. - Skip tool-role message lifecycles in the messages transformer while preserving tool messages in state snapshots. - Add regression coverage for tool-result message leakage. fixes https://github.com/langchain-ai/deepagentsjs/issues/534 |
||
|
dependabot[bot]
|
57a72458df |
chore(deps): bump axios from 1.15.1 to 1.16.1 (#2410)
Bumps [axios](https://github.com/axios/axios) from 1.15.1 to 1.16.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.16.1 — May 13, 2026</h2> <p>This release ships a defence-in-depth fix for prototype pollution in <code>formDataToJSON</code>, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution Defence-in-Depth:</strong> Hardened <code>formDataToJSON</code> against already-polluted <code>Object.prototype</code> by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (<strong><a href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li> <li><strong>Proxy Cleartext Leak:</strong> Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (<strong><a href="https://redirect.github.com/axios/axios/issues/10858">#10858</a></strong>)</li> <li><strong>CI Cache Removal:</strong> Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (<strong><a href="https://redirect.github.com/axios/axios/issues/10882">#10882</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Data URI Parsing:</strong> Updated the <code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing edge cases in <code>data:</code> URL handling. (<strong><a href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li> <li><strong>Unicode Headers:</strong> Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10850">#10850</a></strong>)</li> <li><strong>XHR Upload Progress:</strong> Guarded against malformed <code>ProgressEvent</code> payloads emitted by some environments during XHR upload, preventing crashes when <code>loaded</code> / <code>total</code> are missing or invalid. (<strong><a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li> <li><strong>Webpack 4 Fetch Adapter:</strong> Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (<strong><a href="https://redirect.github.com/axios/axios/issues/10864">#10864</a></strong>)</li> <li><strong>Type Definitions:</strong> Made <code>parseReviver</code> <code>context.source</code> optional in the type definitions to align with the ES2023 specification. (<strong><a href="https://redirect.github.com/axios/axios/issues/10837">#10837</a></strong>)</li> <li><strong>URL Object Support Reverted:</strong> Reverted the change that allowed passing a <code>URL</code> object as <code>config.url</code> (originally <strong><a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (<strong><a href="https://redirect.github.com/axios/axios/issues/10874">#10874</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Cycle Detection Refactor:</strong> Replaced the array-based cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>, improving performance and memory behaviour on large nested structures. (<strong><a href="https://redirect.github.com/axios/axios/issues/10832">#10832</a></strong>)</li> <li><strong>composeSignals Cleanup:</strong> Refactored <code>composeSignals</code> to use a clearer early-return structure, simplifying the cancellation/abort composition path. (<strong><a href="https://redirect.github.com/axios/axios/issues/10844">#10844</a></strong>)</li> <li><strong>AI Readiness & Repo Docs:</strong> Added <code>AGENTS.md</code> and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (<strong><a href="https://redirect.github.com/axios/axios/issues/10835">#10835</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10841">#10841</a></strong>)</li> <li><strong>Docs Improvements:</strong> Clarified the GET request example, fixed the interceptor <code>eject</code> example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (<strong><a href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li> <li><strong>Sponsorship Tooling:</strong> Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (<strong><a href="https://redirect.github.com/axios/axios/issues/10843">#10843</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10859">#10859</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10869">#10869</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>@commitlint/cli</code> from 20.5.0 to 20.5.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10846">#10846</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/hpinmetaverse"><code>@hpinmetaverse</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10836">#10836</a></strong>)</li> <li><strong><a href="https://github.com/tommyhgunz14"><code>@tommyhgunz14</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7413">#7413</a></strong>)</li> <li><strong><a href="https://github.com/abhu85"><code>@abhu85</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10829">#10829</a></strong>)</li> <li><strong><a href="https://github.com/divyanshuraj1095"><code>@divyanshuraj1095</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10853">#10853</a></strong>)</li> <li><strong><a href="https://github.com/sagodi97"><code>@sagodi97</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10856">#10856</a></strong>)</li> <li><strong><a href="https://github.com/rkdfx"><code>@rkdfx</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a></strong>)</li> <li><strong><a href="https://github.com/Liuwei1125"><code>@Liuwei1125</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.16.0...v1.16.1">Full Changelog</a></p> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/1337d6b537afb2d3f501074c8ac4ef4308221197"><code>1337d6b</code></a> chore(release): prepare release 1.16.1 (<a href="https://redirect.github.com/axios/axios/issues/10877">#10877</a>)</li> <li><a href="https://github.com/axios/axios/commit/858a790cec06054547d0d3f941916d6fb2a4d18e"><code>858a790</code></a> fix: remove all caches (<a href="https://redirect.github.com/axios/axios/issues/10882">#10882</a>)</li> <li><a href="https://github.com/axios/axios/commit/34adfd90efc9c145488399e1cf7fa96de67080fa"><code>34adfd9</code></a> revert: "fix: support URL object as config.url input (<a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)" (<a href="https://redirect.github.com/axios/axios/issues/10874">#10874</a>)</li> <li><a href="https://github.com/axios/axios/commit/847d89b43654405d9a231e0b669832c2092b621f"><code>847d89b</code></a> fix: support URL object as config.url input (<a href="https://redirect.github.com/axios/axios/issues/10866">#10866</a>)</li> <li><a href="https://github.com/axios/axios/commit/40948863677bb793bfff0293cce7e7b4f8a1b212"><code>4094886</code></a> fix(progress): guard malformed XHR upload events (<a href="https://redirect.github.com/axios/axios/issues/10868">#10868</a>)</li> <li><a href="https://github.com/axios/axios/commit/44f0c5bf73c45df6009365141faa394d73596bd7"><code>44f0c5b</code></a> chore: change sponsorship link and add Twicsy advertisement (<a href="https://redirect.github.com/axios/axios/issues/10869">#10869</a>)</li> <li><a href="https://github.com/axios/axios/commit/64e1095efedc64c9fecf5176bd9cf2e5e93140d6"><code>64e1095</code></a> chore: update PR and issue template to use h2 (<a href="https://redirect.github.com/axios/axios/issues/10865">#10865</a>)</li> <li><a href="https://github.com/axios/axios/commit/3e6b4e1f311b43aa1dc77d78150a601d9fe4b280"><code>3e6b4e1</code></a> fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...</li> <li><a href="https://github.com/axios/axios/commit/c4453bab70f53575175903aee60810c821f72129"><code>c4453ba</code></a> fix: add the ability to add additional sponsors to the process sponsors scrip...</li> <li><a href="https://github.com/axios/axios/commit/caa00a90b524bb67ed033474abcf4d8645ced793"><code>caa00a9</code></a> fix: https data in cleartext to proxy (<a href="https://redirect.github.com/axios/axios/issues/10858">#10858</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.15.1...v1.16.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Hunter Lovell
|
01dd0462ed |
fix(sdk): retry connection failures before throwing ConnectionError (#2388)
## Summary This change updates SDK retry behavior so connection-related failures are retried instead of immediately aborting inside `onFailedAttempt`. When retries are exhausted, the final surfaced error is still coalesced to a `ConnectionError` with the existing LangGraph-specific guidance. A focused unit test was added to lock in this behavior. ## Changes ### @langchain/langgraph-sdk - Updated `AsyncCaller` connection-error handling to only throw `ConnectionError` on the final failed attempt (`retriesLeft === 0`), while allowing retries on earlier attempts. - Added a regression test covering retry count plus final `ConnectionError` coalescing for connection-refused/fetch-failed style errors. - Added a patch changeset for `@langchain/langgraph-sdk` documenting the retry/coalescing fix. |
||
|
dependabot[bot]
|
bd72a897e1 |
chore(deps): bump postcss from 8.5.8 to 8.5.14 (#2399)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to 8.5.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> <h2>8.5.10</h2> <ul> <li>Fixed XSS via unescaped <code></style></code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@TharVid</code></a>).</li> </ul> <h2>8.5.9</h2> <ul> <li>Speed up source map encoding paring in case of the error.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/3ec13948ae0006e1bde2dfb545346341ac8b2dcf"><code>3ec1394</code></a> Release 8.5.14 version</li> <li><a href="https://github.com/postcss/postcss/commit/f2bb827b20b591080977412555aa3e5baf588620"><code>f2bb827</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/d75953d60854ad835fd21dde0b11081522341020"><code>d75953d</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2084">#2084</a> from 43081j/raw-raws-rawing</li> <li><a href="https://github.com/postcss/postcss/commit/68bd2139b5dcaf5a682bc2e8826d8557be2d1480"><code>68bd213</code></a> fix: always call <code>raw</code> to retrieve raw values</li> <li><a href="https://github.com/postcss/postcss/commit/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1"><code>af58cf1</code></a> Release 8.5.13 version</li> <li><a href="https://github.com/postcss/postcss/commit/f227dbd0e9443e5f33e18e633b8b4d2b55aac5ee"><code>f227dbd</code></a> Temporary ignore pnpm 11 config</li> <li><a href="https://github.com/postcss/postcss/commit/d3abd40d723cf3559e5ddb5fc738b7cb64e92bb0"><code>d3abd40</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/dd06c3e11362087bc18f9c20cee30fd82bda3de9"><code>dd06c3e</code></a> Revert stringifier changes because of the conflict with postcss-scss</li> <li><a href="https://github.com/postcss/postcss/commit/ae889c815fb88d785401a88f1a7dfc8cb11915fb"><code>ae889c8</code></a> Try to fix CI</li> <li><a href="https://github.com/postcss/postcss/commit/e0093e49bcf00347383a13e40bb1f67bc823ca15"><code>e0093e4</code></a> Move to pnpm 11</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.8...8.5.14">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
14f7cbc517 |
chore(deps): bump mermaid from 11.13.0 to 11.15.0 (#2402)
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.13.0 to 11.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mermaid-js/mermaid/releases">mermaid's releases</a>.</em></p> <blockquote> <h2>mermaid@11.15.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7174">#7174</a> <a href="https://github.com/mermaid-js/mermaid/commit/0aca21739c0d1fcaaa206e04a6cd574ebc415483"><code>0aca217</code></a> Thanks <a href="https://github.com/milesspencer35"><code>@milesspencer35</code></a>! - feat(sequence): Add support for decimal start and increment values in the <code>autonumber</code> directive</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7512">#7512</a> <a href="https://github.com/mermaid-js/mermaid/commit/8e17492f7365ba50896382feb69a23efd9d8a22d"><code>8e17492</code></a> Thanks <a href="https://github.com/aruncveli"><code>@aruncveli</code></a>! - feat(flowchart): add datastore shape</p> <p>In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with <code>A@{ shape: datastore, label: "Datastore" }</code>.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/6440">#6440</a> <a href="https://github.com/mermaid-js/mermaid/commit/9ad8dde6d049adde85d8ed2d476c09b5820f3f4b"><code>9ad8dde</code></a> Thanks <a href="https://github.com/yordis"><code>@yordis</code></a>, <a href="https://github.com/lgazo"><code>@lgazo</code></a>! - feat: add Event Modeling diagram</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7707">#7707</a> <a href="https://github.com/mermaid-js/mermaid/commit/27db774627be1cee881961dfd0d2cb21cd01b79d"><code>27db774</code></a> Thanks <a href="https://github.com/txmxthy"><code>@txmxthy</code></a>! - feat(architecture): expose four fcose layout knobs for <code>architecture-beta</code> diagrams (<code>nodeSeparation</code>, <code>idealEdgeLengthMultiplier</code>, <code>edgeElasticity</code>, <code>numIter</code>) so authors can tune layout density and spread overlapping siblings without changing diagram source</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7604">#7604</a> <a href="https://github.com/mermaid-js/mermaid/commit/bf9502fb6012a4b724679b401ac928f5ee55161c"><code>bf9502f</code></a> Thanks <a href="https://github.com/M-a-c"><code>@M-a-c</code></a>! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting</p> <p>If you have namespaces in class diagrams that use <code>.</code>s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set <code>class.hierarchicalNamespaces=false</code> in your mermaid config:</p> <pre lang="yaml"><code>config: class: hierarchicalNamespaces: false </code></pre> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7272">#7272</a> <a href="https://github.com/mermaid-js/mermaid/commit/88cdd3dc0aab9577174561b04e14760c565a232b"><code>88cdd3d</code></a> Thanks <a href="https://github.com/xinbenlv"><code>@xinbenlv</code></a>! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f"><code>e9b0f34</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: prevent unbalanced CSS styles in classDefs</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056"><code>37ff937</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: create CSS styles using the CSSOM</p> <p>This removes some invalid CSS and normalizes some CSS formatting.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7508">#7508</a> <a href="https://github.com/mermaid-js/mermaid/commit/bfe60cc67b9a6dec64f9161f58e4d24a06c42b65"><code>bfe60cc</code></a> Thanks <a href="https://github.com/biiab"><code>@biiab</code></a>! - fix(stateDiagram): <code>end note</code> now only closes a note when used on a new line</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e"><code>faafb5d</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix(gantt): add iteration limit for <code>excludes</code> field</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7737">#7737</a> <a href="https://github.com/mermaid-js/mermaid/commit/65f8be2a42faf869b811469571983cba7eeeca99"><code>65f8be2</code></a> Thanks <a href="https://github.com/ashishjain0512"><code>@ashishjain0512</code></a>! - fix: disallow some CSS at-rules in custom CSS</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7726">#7726</a> <a href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix(wardley): fix unnecessary sanitization of text</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7578">#7578</a> <a href="https://github.com/mermaid-js/mermaid/commit/1f98db8e326299ac97a2fa60abfd509d8f5f16e2"><code>1f98db8</code></a> Thanks <a href="https://github.com/Gaston202"><code>@Gaston202</code></a>! - fix(class): self-referential class multiplicity labels no longer rendered multiple times</p> <p>Fixes <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7560">#7560</a>. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7592">#7592</a> <a href="https://github.com/mermaid-js/mermaid/commit/2343e38498a3b31f8ce5e79f1f009e0b56fbe086"><code>2343e38</code></a> Thanks <a href="https://github.com/knsv-bot"><code>@knsv-bot</code></a>! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7589">#7589</a> <a href="https://github.com/mermaid-js/mermaid/commit/7fb9509b8b5cb1dc48519dc60cf6cdc6afba0462"><code>7fb9509</code></a> Thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>! - fix(block): prevent column widths from shrinking when mixing different column spans</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7632">#7632</a> <a href="https://github.com/mermaid-js/mermaid/commit/3f9e0f15bedc1e2c71ddb6b34192d1a21124cfc2"><code>3f9e0f1</code></a> Thanks <a href="https://github.com/ekiauhce"><code>@ekiauhce</code></a>! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mermaid-js/mermaid/commit/41646dfd43ac83f001b03c70605feb036afae46d"><code>41646df</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7739">#7739</a> from aloisklink/ci/fix-release</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/2671f5c44a1515960ebc41c09a365c41860f95ee"><code>2671f5c</code></a> docs: fix v11.15.0 release</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/f4bf04b5db8bed603e40ed3d5ce5228d6b07754e"><code>f4bf04b</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7738">#7738</a> from mermaid-js/changeset-release/master</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/abfb563e1dcbd46d617f44a6361bd6d926dc6289"><code>abfb563</code></a> Version Packages</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/60b289f428d0a0832ad95ed4e1fb326344e23532"><code>60b289f</code></a> Release Candidate 11.15.0 (<a href="https://redirect.github.com/mermaid-js/mermaid/issues/7737">#7737</a>)</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/d37c0db39ca2405b4473361063df2c47109dc2c9"><code>d37c0db</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7730">#7730</a> from aloisklink/fix/fix-edgeLabelRightLeft-changes</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/5ab5a2895fa8b7e90de85b43a4b99aa50b39b0f1"><code>5ab5a28</code></a> docs: improve nested namespace changeset</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/18f8b4c5bf67aface3485272b48042f2fdd6fad2"><code>18f8b4c</code></a> fix: revert endEdgeLabelLeft/endEdgeLabelRight change</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/504b2eb73d4d827baa817efd47ab6f44ae769b5a"><code>504b2eb</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/7726">#7726</a> from aloisklink/fix/correct-unnecessary-html-escapes...</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/1502f32f3c5fb944925b0c527fbbde3c4f041824"><code>1502f32</code></a> fix(wardley): fix unnecessary sanitization of text</li> <li>Additional commits viewable in <a href="https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.15.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ed630b8ce5 |
chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 (#2401)
Bumps [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) from 1.1.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dcodeIO/protobuf.js/releases">@protobufjs/utf8's releases</a>.</em></p> <blockquote> <h2>protobufjs-cli: v1.1.1</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">1.1.1</a> (2023-02-02)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>cli:</strong> fix relative path to Google pb files (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/1859">#1859</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2">e42eea4</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/644d588c0495da6a570344248e1b5af901bc3b0c"><code>644d588</code></a> chore: release master (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1865">#1865</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/e42eea4868b11f4a07934804a56683321ed191e2"><code>e42eea4</code></a> fix(cli): fix relative path to Google pb files (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1859">#1859</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/dce9a2ef92d363752e40b295b0da9bd178f82e83"><code>dce9a2e</code></a> fix: use bundled filename to fix common pb includes (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1860">#1860</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/64e8936ad9f73c68b3fa1e57857dd38323b5a745"><code>64e8936</code></a> fix: use ES5 style function syntax (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1830">#1830</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/4489fa771464bcb49b57149760e9cc4131e8077e"><code>4489fa7</code></a> Revert "fix: error should be thrown (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1817">#1817</a>)" (<a href="https://redirect.github.com/dcodeIO/protobuf.js/issues/1864">#1864</a>)</li> <li>See full diff in <a href="https://github.com/dcodeIO/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4ea95d7f70 |
chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 (#2404)
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.4 to 1.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md">fast-xml-builder's changelog</a>.</em></p> <blockquote> <p><strong>1.2.0</strong> (2026-05-08)</p> <ul> <li>Add support for <code>sanitizeName</code> option</li> <li>Support xml-naming for validating and sanitizing tag and attribute names</li> </ul> <p><strong>1.1.9</strong> (2026-05-06)</p> <ul> <li>fix: format output for preserve order when indent by is set to empty string</li> </ul> <p><strong>1.1.8</strong> (2026-05-05)</p> <ul> <li>fix: skip text property for PI tags</li> <li>improve typings</li> </ul> <p><strong>1.1.7</strong> (2026--05-04)</p> <ul> <li>fix security issues when attribute value contains quotes</li> </ul> <p><strong>1.1.6</strong> (2026--05-04)</p> <ul> <li>fix security issues related to comment</li> <li>skip comment with null value</li> </ul> <p><strong>1.1.5</strong> (2026-04-17)</p> <ul> <li>fix security issues related to comment and cdata</li> </ul> <p><strong>1.1.4</strong> (2026-03-16)</p> <ul> <li>support maxNestedTags option</li> </ul> <p><strong>1.1.3</strong> (2026-03-13)</p> <ul> <li>declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher</li> </ul> <p><strong>1.1.2</strong> (2026-03-11)</p> <ul> <li>fix typings</li> </ul> <p><strong>1.1.1</strong> (2026-03-11)</p> <ul> <li>upgrade path-expression-matcher to 1.1.3</li> </ul> <p><strong>1.1.0</strong> (2026-03-10)</p> <ul> <li>Integrate <a href="https://github.com/NaturalIntelligence/path-expression-matcher">path-expression-matcher</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/a9a905b316176ef9a97bdf5450e60efbf0341f25"><code>a9a905b</code></a> for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/42680e8d730c48082268823fd285e10127ddba21"><code>42680e8</code></a> support name sanitization</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8b00185bf6be67981ffc40e06c18acbbbe908779"><code>8b00185</code></a> release info</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8a08f173d7b9c9a82599fe7de279ca7e12c3ad6b"><code>8a08f17</code></a> allow indentation to be empty string</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/7fc5decb9613afbd5d03747b1a0f11e0916e34ef"><code>7fc5dec</code></a> update docs</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/c241b6a8ed1863e5f518490ec1fcc38b13f2c370"><code>c241b6a</code></a> improve documentation</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/15d5668b53777400c8d80b6e21029c1a70888c78"><code>15d5668</code></a> update for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/98774853a696a1aee4dca830dd3eee2759676bd2"><code>9877485</code></a> fix: skip text property for PI tags</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/311a2213a817cf31558bea7c0e0807b0d4441814"><code>311a221</code></a> fix <a href="https://redirect.github.com/NaturalIntelligence/fast-xml-builder/issues/5">#5</a> typing import issues</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/e8fc5b15d9d54b559781961f066de82a55aabcdd"><code>e8fc5b1</code></a> update for releast</li> <li>Additional commits viewable in <a href="https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.4...v1.2.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6ddc76d25d |
chore(deps): bump basic-ftp from 5.3.0 to 5.3.1 (#2398)
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.3.0 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/releases">basic-ftp's releases</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md">basic-ftp's changelog</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/980371bb6057d78d479b5cfc18683392abd2c45f"><code>980371b</code></a> Guard against unbounded control response</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/50827c73ca6c1d786c97276e47be8a33d0f2277d"><code>50827c7</code></a> Adjust changelog to match release notes</li> <li>See full diff in <a href="https://github.com/patrickjuchli/basic-ftp/compare/v5.3.0...v5.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Vignesh
|
2b88da497b |
fix(langgraph): surface structuredResponse parse failures in createReactAgent (#2339)
Closes Issue #2338 ## Problem When `createReactAgent` is called with `responseFormat`, the `generate_structured_response` node calls `model.withStructuredOutput(schema).invoke(...)`. Some parsers return `null`/`undefined` (instead of throwing) when the LLM produces JSON that is syntactically valid but does not satisfy the schema (e.g. a missing required field). The result was unconditionally assigned to the `structuredResponse` channel, so the agent silently resolved with `structuredResponse: undefined` — no error, no warning, no log. ## Fix Detect the `null`/`undefined` case in `generate_structured_response` and throw a descriptive error stating that the structured-output parser returned null/undefined and the model output did not satisfy the schema. This converts the silent failure into an explicit, debuggable error. The error does not include the raw model completion. The existing call shape (`withStructuredOutput(schema, options).invoke(...)`) returns only the parsed value. Switching to `{ includeRaw: true }` would surface the completion but (a) overrides any caller-supplied `includeRaw` in the existing options object and (b) relies on every chat-model implementation honoring `includeRaw` consistently, so it's left as a possible follow-up. ## Test Added `Throws when structured output parser returns null` in `libs/langgraph-core/src/tests/prebuilt.test.ts`. It spies on `withStructuredOutput` to return `null` (simulating the silent failure) and asserts the agent rejects with the new error message. The test runs inside the existing `describe.each([["v1"], ["v2"]])` block, so both agent versions are covered. --------- Co-authored-by: Voddam Vignesh <vignesh.voddam@gep.com> Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
github-actions[bot]
|
22c4541b53 |
chore: version packages (rc) (#2385)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. ⚠️⚠️⚠️⚠️⚠️⚠️ `main` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `main`. ⚠️⚠️⚠️⚠️⚠️⚠️ # Releases ## @langchain/langgraph-api@1.2.2-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 - @langchain/langgraph@1.3.1-rc.0 - @langchain/langgraph-ui@1.2.2-rc.0 ## @langchain/langgraph-cli@1.2.2-rc.0 ### Patch Changes - [#2389](https://github.com/langchain-ai/langgraphjs/pull/2389) [`40bcdab`](https://github.com/langchain-ai/langgraphjs/commit/40bcdab38fa495028d8eba68062e48079dbe9208) Thanks [@jdrogers940](https://github.com/jdrogers940)! - Adding support for pre-release versions in api_version. - Updated dependencies \[]: - @langchain/langgraph-api@1.2.2-rc.0 ## @langchain/langgraph@1.3.1-rc.0 ### Patch Changes - [#2376](https://github.com/langchain-ai/langgraphjs/pull/2376) [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280) Thanks [@hntrl](https://github.com/hntrl)! - fix(langgraph): prefer configurable assistant and graph IDs for runtime server info Update runtime `serverInfo` construction to read `assistant_id` and `graph_id` from `config.configurable` first, with fallback to `config.metadata` for compatibility. Also expands `execution_info` tests to cover configurable sourcing, precedence, and metadata fallback behavior. - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 ## @langchain/langgraph-cua@1.0.2-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 ## @langchain/langgraph-supervisor@1.0.2-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 ## @langchain/langgraph-swarm@1.0.2-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 ## @langchain/langgraph-sdk@1.9.3-rc.0 ### Patch Changes - [#2387](https://github.com/langchain-ai/langgraphjs/pull/2387) [`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Coalesce `RootMessageProjection` store writes through a single `setTimeout(0)` flush so long `messages`-channel replays (on refresh, mid-run join, or rapid subagent streaming) no longer drain as a per-event microtask chain that trips React's `Maximum update depth exceeded` guard. Replaces the previous `MessageChannel`-based batching, which deferred initial-submit events past the first render and left the UI looking frozen until refresh. - [#2372](https://github.com/langchain-ai/langgraphjs/pull/2372) [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7) Thanks [@ahmed-z0](https://github.com/ahmed-z0)! - Fix subagent message routing to prefer the stream event namespace over checkpoint metadata when filtering subagent messages. - [#2384](https://github.com/langchain-ai/langgraphjs/pull/2384) [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - batch RootMessageProjection store writes through a macrotask - [#2381](https://github.com/langchain-ai/langgraphjs/pull/2381) [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - fix(sdk): forward config + metadata on respondInput for resume submits - [#2379](https://github.com/langchain-ai/langgraphjs/pull/2379) [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - filter SSE-replayed input.requested events through a hydrated interrupt allowlist - [#2390](https://github.com/langchain-ai/langgraphjs/pull/2390) [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3) Thanks [@nick-hollon-lc](https://github.com/nick-hollon-lc)! - Bind deepagents subagent discovery to the execution namespace via taskInput so `useMessages(stream, subagent)` resolves the streaming scope instead of the trigger tool-call namespace. ## @langchain/angular@1.0.3-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 ## @langchain/react@1.0.3-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 ## @langchain/svelte@1.0.3-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 ## @langchain/vue@1.0.3-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 ## @langchain/langgraph-ui@1.2.2-rc.0 ## @example/ai-elements@0.1.18-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 - @langchain/react@1.0.3-rc.0 ## @examples/assistant-ui-claude@0.1.18-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 - @langchain/react@1.0.3-rc.0 ## @examples/ui-angular@0.0.28-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 - @langchain/langgraph@1.3.1-rc.0 - @langchain/angular@1.0.3-rc.0 ## @examples/ui-multimodal@0.0.4-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 - @langchain/react@1.0.3-rc.0 ## @examples/ui-react@0.0.4-rc.0 ### Patch Changes - Updated dependencies \[[`44746b1`](https://github.com/langchain-ai/langgraphjs/commit/44746b1a3b5b49737542b120b9e45d6f94181113), [`4cc6491`](https://github.com/langchain-ai/langgraphjs/commit/4cc6491844f21ed0fc737eaef8498133daa877f7), [`ae8af2d`](https://github.com/langchain-ai/langgraphjs/commit/ae8af2d75aef9a7bbd930d221d1ce03e7fbb90ad), [`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280), [`2ad1aa4`](https://github.com/langchain-ai/langgraphjs/commit/2ad1aa48c6a3f45340b4833e6de555fdc7348d15), [`75e651b`](https://github.com/langchain-ai/langgraphjs/commit/75e651b9cff1a1e39ad6513b8a5e9b565b9ad7fe), [`f1d651a`](https://github.com/langchain-ai/langgraphjs/commit/f1d651ae14ca178f4a915ac853ba9b439cd55ba3)]: - @langchain/langgraph-sdk@1.9.3-rc.0 - @langchain/langgraph@1.3.1-rc.0 - @langchain/react@1.0.3-rc.0 ## langgraph@1.0.33-rc.0 ### Patch Changes - Updated dependencies \[[`4fd1e9f`](https://github.com/langchain-ai/langgraphjs/commit/4fd1e9f5720361a86a386a286ad8fcc824643280)]: - @langchain/langgraph@1.3.1-rc.0 --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Hunter Lovell <hunter@hntrl.io> |
||
|
dependabot[bot]
|
5f6241607b |
chore(deps): bump ip-address from 10.1.0 to 10.2.0 (#2393)
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.1.0 to 10.2.0. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/beaugunderson/ip-address/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9035509567 |
chore(deps): bump protobufjs from 6.11.5 to 7.5.5 (#2392)
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 6.11.5 to 7.5.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p> <blockquote> <h2>v7.5.5</h2> <p>This release backports two reported security issues to 7.x branch.</p> <ul> <li>fix: do not allow setting <code>__proto__</code> in Message constructor (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2126">#2126</a>)</li> <li>fix: filter invalid characters from the type name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2127">#2127</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5">https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.4...protobufjs-v7.5.5</a></p> <h2>protobufjs: v7.5.4</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2> <h3>Bug Fixes</h3> <ul> <li>invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760">5a3769a</a>)</li> </ul> <h2>protobufjs: v7.5.3</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.2...protobufjs-v7.5.3">7.5.3</a> (2025-05-28)</h2> <h3>Bug Fixes</h3> <ul> <li>descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68">6e255d4</a>)</li> </ul> <h2>protobufjs: v7.5.2</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.1...protobufjs-v7.5.2">7.5.2</a> (2025-05-14)</h2> <h3>Bug Fixes</h3> <ul> <li>ensure that types are always resolved (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2068">#2068</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/4b51cb2b8450b77f9f5de1c562e7fae93b19d040">4b51cb2</a>)</li> </ul> <h2>protobufjs: v7.5.1</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.0...protobufjs-v7.5.1">7.5.1</a> (2025-05-08)</h2> <h3>Bug Fixes</h3> <ul> <li>optimize regressions from editions implementations (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2066">#2066</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6406d4c18afae309fc7b5f4a24d9674d85da180b">6406d4c</a>)</li> <li>reserved field inside group blocks fail parsing (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2058">#2058</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/56782bff0c4b5132806eb1a6bc4d08f930c4aaad">56782bf</a>)</li> </ul> <h2>protobufjs: v7.5.0</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.4.0...protobufjs-v7.5.0">7.5.0</a> (2025-04-15)</h2> <h3>Features</h3> <ul> <li>add Edition 2023 Support (<a href="https://github.com/protobufjs/protobuf.js/commit/f04ded3a03a3ddd383f0228e2fe2627a51f31aa3">f04ded3</a>)</li> <li>add Edition 2023 Support (<a href="https://github.com/protobufjs/protobuf.js/commit/ac9a3b9fe3134d48187e41b08d54ffaceddc6c1b">ac9a3b9</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/b7bdfaf91d7bf279326f2d043b633da0a2dbfe47"><code>b7bdfaf</code></a> chore: release 7.5.5</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956"><code>ff7b2af</code></a> fix: filter invalid characters from the type name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2127">#2127</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/086b19d00d1d01e801d6ccc2ae3f207bb1b06482"><code>086b19d</code></a> fix: do not allow setting <strong>proto</strong> in Message constructor (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2126">#2126</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/827ff8e48253e9041f19ac81168aa046dbdfb041"><code>827ff8e</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2093">#2093</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760"><code>5a3769a</code></a> fix: invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/f42297b29d15c8e0382744a83f5147a1aa978f42"><code>f42297b</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2076">#2076</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68"><code>6e255d4</code></a> fix: descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/9467abe5af0aa5de3e4cf26b9e1a85c97f5eebd0"><code>9467abe</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2070">#2070</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/4b51cb2b8450b77f9f5de1c562e7fae93b19d040"><code>4b51cb2</code></a> fix: ensure that types are always resolved (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2068">#2068</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/69cced8e00216f1aed69593187ac0c2e34807208"><code>69cced8</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2067">#2067</a>)</li> <li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/v6.11.5...protobufjs-v7.5.5">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepublish</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
67831afa7f |
chore(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#2394)
Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated "of" in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |