langchain-ai/langgraphjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraphjs.git synced 2026-07-21 08:35:23 -04:00
Code Issues 108 Packages Projects Releases 20 Wiki Activity
2,993 Commits 157 Branches 532 Tags
@langchain/langgraph@1.4.4
Commit Graph

2993 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot] e6082e0575 chore: version packages (#2554) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph@1.4.4

### Patch Changes

- [#2552](https://github.com/langchain-ai/langgraphjs/pull/2552)
[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): isolate concurrent singleton-agent invocations by thread

`ensureLangGraphConfig` ignores the ambient `AsyncLocalStorage`
`configurable`
on root-level invokes that supply an invoke-time `thread_id` and have no
nesting
keys (ignoring graph-bound `.withConfig()` defaults). On a fresh
top-level run
the ambient `configurable` can belong to another concurrent invocation,
so its
    keys — internal scratchpad/task-input as well as user keys like
`tenant_id`/`user_id` — must not leak in; values the caller wants arrive
through
the explicit (bound + invoke-time) configs. Ambient nesting
(`__pregel_read__`)
and bound child graphs invoked from parent tasks are unaffected. This
prevents
cross-invocation leakage between concurrent `invoke()` calls on a shared
compiled
graph (e.g. BullMQ workers with `concurrency > 1`). Complements the
config-merge
fix that stopped shared graph-bound `metadata`/`configurable` objects
from being
    mutated across invocations
    ([#2040](https://github.com/langchain-ai/langgraphjs/issues/2040)).

- [#2553](https://github.com/langchain-ai/langgraphjs/pull/2553)
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): recognize JSON-erased `Overwrite` values across runtimes

`Overwrite` already survives JSON serialization in JS because
`Overwrite.toJSON()`
emits the canonical `{ "__overwrite__": value }` sentinel.
`_getOverwriteValue`
now additionally recognizes the discriminator form `{ "type":
"__overwrite__",
value }` produced when a typed `Overwrite` from another runtime (e.g. a
Python
dataclass routed through the LangGraph API server) is serialized and its
type is
erased. This keeps `Overwrite` (and `DeltaChannel`) semantics intact
across
cross-runtime JSON boundaries. These delta-channel APIs remain Beta.

## @example/ai-elements@0.1.40

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/assistant-ui-claude@0.1.40

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-angular@0.0.50

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-multimodal@0.0.26

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-react@0.0.26

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## langgraph@1.0.44

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.24 @langchain/langgraph-checkpoint-redis@1.0.10 @langchain/langgraph-checkpoint@1.1.2 @langchain/langgraph-sdk@1.9.23 @langchain/langgraph@1.4.4 @langchain/react@1.0.24 @langchain/svelte@1.0.24 @langchain/vue@1.0.24 		2026-06-17 16:41:40 -07:00
Christian Bromann d662cbbc63 fix(langgraph): isolate concurrent singleton-agent invocations by thread (#2552) 
## Summary
- Hardens `ensureLangGraphConfig` so root-level invokes with an explicit
`thread_id` (and no nesting keys) no longer inherit langgraph-internal
`configurable` entries from `AsyncLocalStorage`, preventing
scratchpad/`currentTaskInput` leakage between concurrent `invoke()`
calls on a singleton agent.
- Adds unit tests for the new ALS-skipping behavior and an end-to-end
regression test that verifies checkpoint and tool state stay isolated
across concurrent invocations on a shared graph with `.withConfig()`.
- Complements #2531 (config merge / shared bound-config mutation fix),
which was the primary cause of cross-thread contamination reported in
#2040.

fixes #2040
 2026-06-17 16:35:38 -07:00
Christian Bromann 1c2aa5bfea fix(langgraph): recognize JSON-erased Overwrite values across runtimes (#2553) 
## Summary
- JS `Overwrite` already survives JSON serialization because
`Overwrite.toJSON()` emits the canonical `{ "__overwrite__": value }`
sentinel, which `_getOverwriteValue` recognizes.
- This adds recognition of the discriminator form `{ "type":
"__overwrite__", value }` that results when a typed `Overwrite` from
another runtime (notably a Python dataclass, post
langchain-ai/langgraph#8127) is serialized through a JSON boundary and
its type is erased.
- Brings JS to full parity with Python's three-form `_get_overwrite`
(instance, sentinel dict, discriminator dict), so `Overwrite`
round-trips both directions across the JS↔Python API boundary.
Delta-channel APIs remain Beta.
 2026-06-17 15:58:20 -07:00
github-actions[bot] 73ecaa0fb5 chore: version packages (#2536) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.2

### Patch Changes

- [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544)
[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): make concurrent DeltaChannel writes deterministic on
replay

Concurrent same-superstep writes to a `DeltaChannel` could reconstruct
from a
checkpoint differently than they were applied live, because live
execution
ordered them by task path while savers replayed them by task id. This
fixes that
    divergence in two complementary ways:

- Plain concurrent writes are now applied in the canonical `(task_id,
idx)`
order on both paths: `_applyWrites` orders them that way live, and the
`getDeltaChannelHistory` walk enforces the same order so reconstruction
matches live for every saver (Postgres, SQLite, MongoDB, Redis, and
custom).
- An `Overwrite` now wins its entire super-step: every sibling write in
the same
        step — before AND after the `Overwrite` — is discarded, matching
`BinaryOperatorAggregate`. This makes the result independent of the
(unstable)
ordering of concurrent fan-in writes; previously a plain write that
landed
        after an `Overwrite` in the same step was still folded in.

To keep reconstruction in sync with this `Overwrite` rule, any
`DeltaChannel`
that sees an `Overwrite` in a super-step is now force-snapshotted at the
next
checkpoint (and, under `"exit"` durability, in the final checkpoint).
The
post-overwrite value is materialized into `channel_values`, so a cold
read seeds
from that snapshot and never has to replay across the reset — making
live and
reconstructed state identical without changing the sparse-replay history
shape.
    These delta-channel APIs remain Beta.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): forward task metadata and name subagents via
lc_agent_name

`mapDebugTasks` now forwards filtered user-meaningful task config
metadata
(including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle
    transformer uses that metadata to set subagent `graph_name` from
`lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }`
from parent tool-dispatch tasks. Adds the shared
`EXCLUDED_METADATA_KEYS`
    constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928.

## @langchain/langgraph-checkpoint-redis@1.0.10

### Patch Changes

- [#2336](https://github.com/langchain-ai/langgraphjs/pull/2336)
[`25907eb`](https://github.com/langchain-ai/langgraphjs/commit/25907eb0be25258c26327c6c68c72bc828ee1cff)
Thanks [@MohMaherId](https://github.com/MohMaherId)! -
fix(langgraph-checkpoint-redis): persist and reconstruct full
`channel_values` across multi-node graphs.

`RedisSaver.put()` delta-filters `channel_values` to only the channels
written by the current node, but `getTuple()` had no reconstruction
logic — unlike `PostgresSaver` — so any multi-node graph whose last node
wrote a subset of channels silently lost the others. Each changed
channel is now persisted as a version-keyed `checkpoint_blob:*` entry in
`put()` and missing channels are reconstructed from those blobs on read.

`deleteThread()` now also deletes the `checkpoint_blob:*` keys. Without
this the blobs introduced above would orphan forever (memory growth) and
thread deletion would be incomplete, matching
`PostgresSaver.deleteThread()` parity.

When `ttlConfig.refreshOnRead` is enabled, reads now refresh the TTL of
the reconstructed `checkpoint_blob:*` keys alongside the checkpoint key.
Otherwise a read would keep the checkpoint alive while the blobs it
depends on expired, silently dropping reconstructed channels.

On write, `put()` now refreshes the TTL of every blob the checkpoint
references (the full `channel_versions` set), not just the channels
changed by the current node, so carried-over blobs from earlier nodes
expire in lockstep with the checkpoint doc. This write-side refresh is
independent of `refreshOnRead`. The per-channel blob writes also now run
in parallel.

Known limitation: with TTL enabled, a carried-over blob can still be
lost if it expires during an idle gap longer than `defaultTTL` (no read
or write refreshed it in time). When that happens the channel is left
cleanly absent on read rather than erroring. Fully closing this gap
(re-persisting expired blobs) is tracked as a follow-up.

## @langchain/langgraph@1.4.3

### Patch Changes

- [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544)
[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): make concurrent DeltaChannel writes deterministic on
replay

Concurrent same-superstep writes to a `DeltaChannel` could reconstruct
from a
checkpoint differently than they were applied live, because live
execution
ordered them by task path while savers replayed them by task id. This
fixes that
    divergence in two complementary ways:

- Plain concurrent writes are now applied in the canonical `(task_id,
idx)`
order on both paths: `_applyWrites` orders them that way live, and the
`getDeltaChannelHistory` walk enforces the same order so reconstruction
matches live for every saver (Postgres, SQLite, MongoDB, Redis, and
custom).
- An `Overwrite` now wins its entire super-step: every sibling write in
the same
        step — before AND after the `Overwrite` — is discarded, matching
`BinaryOperatorAggregate`. This makes the result independent of the
(unstable)
ordering of concurrent fan-in writes; previously a plain write that
landed
        after an `Overwrite` in the same step was still folded in.

To keep reconstruction in sync with this `Overwrite` rule, any
`DeltaChannel`
that sees an `Overwrite` in a super-step is now force-snapshotted at the
next
checkpoint (and, under `"exit"` durability, in the final checkpoint).
The
post-overwrite value is materialized into `channel_values`, so a cold
read seeds
from that snapshot and never has to replay across the reset — making
live and
reconstructed state identical without changing the sparse-replay history
shape.
    These delta-channel APIs remain Beta.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): merge instead of overwrite in `ensureLangGraphConfig`

`ensureLangGraphConfig` now per-key merges `callbacks`, `tags`,
`metadata`,
and `configurable` across configs instead of last-write-wins, so values
bound via `.withConfig({...})` survive when a later (e.g. invoke-time)
config supplies other keys. The merged dicts are fresh objects, fixing a
by-reference mutation of shared base configs. Also drops the
now-redundant
`combineCallbacks` workaround in `streamEvents`, which double-registered
and
    double-fired graph-bound callbacks.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): preserve namespace nesting for imperative graph invokes

When a compiled graph is invoked from inside another graph's running
task
(e.g. a tool body calling `subAgent.invoke(...)`), the surrounding task
context — including the langgraph-internal nesting keys
(`__pregel_read`,
`__pregel_stream`, `checkpoint_ns`, the checkpoint map) — is propagated
    implicitly via `AsyncLocalStorage`. The base `Runnable.stream` calls
langchain-core's `ensureConfig`, which replaces the ambient
`configurable`
wholesale whenever the caller passes its own. Because `createAgent`
always
supplies a `configurable`, every tool-invoked sub-agent lost those keys,
ran
as a fresh root run, and had its streamed events flattened to the root
    namespace instead of nesting under the triggering task.

`Pregel.stream` now merges the ambient `configurable` underneath the
caller's
    (caller keys win per-key) when the ambient marks an active task
(`__pregel_read` present) but the explicit `configurable` is missing it.
Declared subgraph nodes (which already carry their own `__pregel_read`)
and
    top-level runs are unaffected.

- [#2537](https://github.com/langchain-ai/langgraphjs/pull/2537)
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): dispatch stream messages handler inline

The v3 `messages` handler (`StreamProtocolMessagesHandler`, which powers
`run.messages`) only performs a synchronous `push()` onto the run's
stream, but
its callbacks were dispatched on LangChain's background callback queue
(the
default `awaitHandlers === false`). A model or tool call inside a nested
or
parallel task could therefore flush its `messages` chunk _after_ the
Pregel
loop returned and sealed the stream, where
`IterableReadableWritableStream.push`
silently drops chunks once closed. This surfaced as empty per-message
streams
(`sub.messages`) for subagents dispatched in parallel from a single
tools step.

The handler now sets `awaitHandlers = true` so its callbacks run inline
— every
push happens during the originating model/chain call while the stream is
still
open. This avoids the global over-wait, fake-timer deadlock, and
error-path
unhandled rejections that a blanket `awaitAllCallbacks()` drain before
close
    would have introduced.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): forward task metadata and name subagents via
lc_agent_name

`mapDebugTasks` now forwards filtered user-meaningful task config
metadata
(including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle
    transformer uses that metadata to set subagent `graph_name` from
`lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }`
from parent tool-dispatch tasks. Adds the shared
`EXCLUDED_METADATA_KEYS`
    constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928.

- [#2549](https://github.com/langchain-ai/langgraphjs/pull/2549)
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): support DeltaChannel fields in StateSchema

Add a `DeltaValue` state field (and a `MessagesDeltaValue` prebuilt) so
a
`DeltaChannel` can be declared via `StateSchema`, not just
`Annotation.Root` or
a raw channel map. `StateSchema` now maps `DeltaValue` to a
`DeltaChannel`
(forwarding `snapshotFrequency` and the value-schema default) and
validates its
    inputs/`Overwrite` updates like `ReducedValue`.

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)]:
    -   @langchain/langgraph-checkpoint@1.1.2
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/langgraph-sdk@1.9.23

### Patch Changes

- [#2545](https://github.com/langchain-ai/langgraphjs/pull/2545)
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): avoid scoped stream resubscribe churn

Defer final projection disposal by one microtask so framework bindings
that release and immediately reacquire the same scoped projection during
reactive updates keep the existing stream subscription instead of
rotating through root-only and scoped SSE filters.

## @langchain/angular@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/react@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/svelte@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/vue@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @example/ai-elements@0.1.39

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/assistant-ui-claude@0.1.39

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/ui-angular@0.0.49

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/langgraph-sdk@1.9.23
    -   @langchain/angular@1.0.24

## @examples/ui-multimodal@0.0.25

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/ui-react@0.0.25

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/langgraph-sdk@1.9.23
    -   @langchain/react@1.0.24

## langgraph@1.0.43

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-06-17 15:34:21 -07:00
Christian Bromann 448721449f fix(langgraph): replay concurrent DeltaChannel writes in live order (#2544) 
## Summary
- Fix a non-deterministic divergence where a `DeltaChannel`'s
reconstructed state did not match its live state when concurrent writes
(notably a plain write + an `Overwrite`) were applied in the same
super-step. Live execution applied concurrent writes in task-**path**
order, while every checkpointer replays persisted writes in task-**id**
order, so an `Overwrite` hard reset could land at a different point on
reload.
- `_applyWrites` (`@langchain/langgraph`) now applies concurrent
`DeltaChannel` writes in the canonical `(task_id, idx)` order — the same
order checkpointers replay them in.
- The base `getDeltaChannelHistory` (`@langchain/langgraph-checkpoint`)
now stable-sorts each ancestor checkpoint's writes by `task_id`, making
reconstruction order independent of how a saver returns `pendingWrites`.
This fixes Postgres, SQLite, MongoDB, Redis, and any custom saver in one
place; MemorySaver was already correct via its override.
 2026-06-17 15:22:57 -07:00
Christian Bromann bc667a998a fix(langgraph): support DeltaChannel fields in StateSchema (#2549) 
## Summary
- Add `DeltaValue<Value, Input>` (`state/values/delta.ts`), a
`StateSchema` field backed by a `DeltaChannel`'s batch reducer +
`snapshotFrequency` — distinct from `ReducedValue`'s single-value
reducer.
- Wire `DeltaValue` into `StateSchema`: `getChannels()` maps it to a
`DeltaChannel` (forwarding `snapshotFrequency` and seeding the initial
value from the value-schema default);
`getJsonSchema()`/`getInputJsonSchema()`/`validateInput()` handle it
(incl. `Overwrite`) like `ReducedValue`; and the type helpers infer
`State`/`Update` correctly.
- Add the `MessagesDeltaValue` prebuilt (a `DeltaChannel`-backed drop-in
for `MessagesValue`); export `DeltaValue` and `MessagesDeltaValue` from
`@langchain/langgraph`.
- Previously `DeltaChannel` was only usable via `Annotation.Root` / raw
channel maps; the `StateSchema` class and Zod paths threw. This closes
the `StateSchema` gap (Zod remains a separate follow-up).
 2026-06-17 13:08:12 -07:00
Christian Bromann e73bf8a260 test(langgraph-core): add test coverage on merging tags and metadata 2026-06-17 12:45:20 -07:00
Christian Bromann 2134c8a2c0 fix(sdk): avoid scoped stream resubscribe churn (#2545) 
## Summary
- Defer final `ChannelRegistry` projection disposal by one microtask so
same-turn reacquires keep the existing projection runtime alive.
- Preserve `registry.size` as an active-consumer diagnostic while
allowing pending disposals to be cancelled.
- Add regression coverage for release-then-reacquire behavior.
 2026-06-17 12:43:03 -07:00
Christian Bromann be096663f4 fix(langgraph): dispatch stream messages handler inline (#2537) 
## Summary
- The v3 `messages` handler (`StreamProtocolMessagesHandler`) defaulted
to background callback dispatch (`awaitHandlers === false`), so its
synchronous `push()` onto the run stream could land after the Pregel
loop sealed the stream — where `IterableReadableWritableStream.push`
silently drops chunks.
- This caused empty per-message streams (`sub.messages`) for subagents
dispatched in parallel from a single tools step.
- Fix: set `awaitHandlers = true` so the handler dispatches inline and
every push happens during the originating model/chain call while the
stream is still open. This avoids the global over-wait, fake-timer
deadlock, and error-path unhandled rejections that a blanket
`awaitAllCallbacks()` drain before `stream.close()` would have
introduced.

---------

Signed-off-by: Christian Bromann <git@bromann.dev>
 2026-06-17 12:39:29 -07:00
dependabot[bot] c18622faf7 chore(deps): bump @angular/compiler from 22.0.0 to 22.0.1 (#2541) 
Bumps
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/compiler's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4645850e24d2764313040b6711af93d3fd426825"><code>4645850</code></a>
refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor</li>
<li><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a>
fix(compiler): disallow i18n event attributes</li>
<li><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a>
fix(compiler): sanitize <code>href</code>/<code>xlink:href</code>
attributes of any element of the ...</li>
<li><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><code>393b84c</code></a>
fix(compiler): sanitize two-way properties</li>
<li><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><code>3d9ca2f</code></a>
fix(compiler-cli): bind switch exhaustive check expressions</li>
<li><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><code>a56f1cd</code></a>
fix(compiler): more robust logic to check if regex can be optimized</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/compiler">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 12:38:21 -07:00
Christian Bromann 38cfe01ff0 fix(langgraph): merge instead of overwrite in ensureLangGraphConfig (#2531) 
## Summary
- Port of langgraph#7926: `ensureLangGraphConfig` now per-key merges
`callbacks`, `tags`, `metadata`, and `configurable` across configs
instead of overwriting, so values bound via `.withConfig({...})` are
preserved when a later config (e.g. invoke-time `thread_id`) only
supplies a subset of keys. Later configs still win per key on collision.
- Merged dicts are fresh objects, fixing a by-reference mutation where
`propagateConfigurableToMetadata` could mutate a shared bound config's
`metadata` across invocations.
- Removed the now-redundant `combineCallbacks` pre-combine in
`Pregel.streamEvents` (v1/v2). Because the config merge now folds in
`this.config` callbacks, pre-combining re-registered graph-bound
handlers and double-fired them; only call-time callbacks are forwarded
now.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-06-17 12:38:03 -07:00
dependabot[bot] 4808541753 chore(deps): bump @angular/core from 22.0.0 to 22.0.1 (#2538) 
Bumps
[@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/core's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4b0c3b8b8f1dbdb6ba31cb6499c393b1ccd81c6c"><code>4b0c3b8</code></a>
refactor(core): Update registerNgModuleType to support codegen
typechecking</li>
<li><a
href="https://github.com/angular/angular/commit/dbf64c8eb55ef5d2480abfbb4e362edccf79f971"><code>dbf64c8</code></a>
test(core): fix AI tools test flake</li>
<li><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><code>045bb73</code></a>
fix(core): validate lowercase SVG animation attribute names</li>
<li><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a>
fix(compiler): disallow i18n event attributes</li>
<li><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a>
fix(compiler): sanitize <code>href</code>/<code>xlink:href</code>
attributes of any element of the ...</li>
<li><a
href="https://github.com/angular/angular/commit/b1f02eb5c5fd6c4a62cadf4ff4f04a3046a65002"><code>b1f02eb</code></a>
refactor(core): add internal utility</li>
<li><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><code>85d2d10</code></a>
fix(forms): harden FormGroup control lookups against prototype
shadowing</li>
<li><a
href="https://github.com/angular/angular/commit/6e3d51d7df3c8a4013cee7ec96c03835e0eeb9e2"><code>6e3d51d</code></a>
refactor(migrations): Improve <code>safeNavigationMigration</code>
heuristic</li>
<li><a
href="https://github.com/angular/angular/commit/01ea640539efda57e35807cef61abaf403686fe9"><code>01ea640</code></a>
refactor(core): Fix DirectiveDefinition interface to allow abstract
classes</li>
<li><a
href="https://github.com/angular/angular/commit/a704b08379e92294c59e47af7703edfefdaff6b8"><code>a704b08</code></a>
docs: add Signal Forms and v22 guidance to AI best-practices and
llms.txt</li>
<li>Additional commits viewable in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 11:31:42 -07:00
dependabot[bot] a9fce5ea1c chore(deps-dev): bump @vitest/browser from 4.1.8 to 4.1.9 (#2539) 
Bumps
[@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser)
from 4.1.8 to 4.1.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">@​vitest/browser's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.9</h2>
<h3>🐞 Bug Fixes</h3>
<ul>
<li>Fix <code>importOriginal</code> with optimizer and query import
[backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David
Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw
HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Wait for orchestrator readiness before resolving browser sessions
[backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus
O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a>
<a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw
HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li>
<li>Wait for iframe tester readiness before preparing [backport to v4] -
by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a>
<a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw
HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>mocker</strong>:
<ul>
<li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by
<strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>,
<strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a>
<a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw
HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>pool</strong>:
<ul>
<li>Prevent test run hang on worker crash [backport to v4] - by
<strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a>
<a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw
HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5><a
href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a>
chore: release v4.1.9 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10598">#10598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/fbc626c401ee9215ee07c0d19801cff820e289d6"><code>fbc626c</code></a>
fix(browser): wait for iframe tester readiness before preparing (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10497">#10497</a>)
[bac...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a>
fix(browser): wait for orchestrator readiness before resolving browser
sessio...</li>
<li>See full diff in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/browser">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 20:54:33 -07:00
dependabot[bot] 7d8295dcca chore(deps): bump hono from 4.12.23 to 4.12.25 (#2548) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple
<code>Set-Cookie</code> response headers being joined into one
comma-separated value for ALB single-header responses and VPC Lattice
v2, where the value could not be split back into individual cookies and
clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request
header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request
headers being written with overwrite instead of append, where only the
last value of a header such as <code>X-Forwarded-For</code> reached the
application and the remaining values were silently dropped.
GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@​types/glob</code> by <a
href="https://github.com/rtritto"><code>@​rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir"><code>@​tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand &quot;::&quot; to eight zero groups by <a
href="https://github.com/youcefzemmar"><code>@​youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a>
4.12.25</li>
<li><a
href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/74c2cf8ef4f5cc29a876380df1ba230ff7128b3f"><code>74c2cf8</code></a>
test(aws-lambda): update integration tests (<a
href="https://redirect.github.com/honojs/hono/issues/5012">#5012</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1"><code>7ae7cba</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/1b1384815485f9d6590c6966e23a06fd07166cb7"><code>1b13848</code></a>
chore(ci): bump codecov-action to v7.0.0 (<a
href="https://redirect.github.com/honojs/hono/issues/5011">#5011</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/5fdde5ab5a7d7c89eba4d1ceab76f4a7c011cd3b"><code>5fdde5a</code></a>
4.12.24</li>
<li><a
href="https://github.com/honojs/hono/commit/c78932d745cdf6284ae131a156479ac930da0262"><code>c78932d</code></a>
fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; (<a
href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.25">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.23&new-version=4.12.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:33:25 -07:00
dependabot[bot] 1a42b9f21f chore(deps): bump tar from 7.5.11 to 7.5.16 (#2547) 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a>
7.5.16</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a>
do not apply PAX header fields to meta entries</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a>
update project deps</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a>
fix inconsequential typo in PENDINGLINKS symbol name</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a>
remove some uses of mutate-fs</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a>
7.5.15</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a>
fix: regression in pending links detection</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a>
7.5.14</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a>
stricter protection against hardlinks preempting their targets</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a>
update workflows and deps</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.11&new-version=7.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:33:12 -07:00
dependabot[bot] ada52690f6 chore(deps-dev): bump ws from 8.20.1 to 8.21.0 (#2546) 
Bumps [ws](https://github.com/websockets/ws) from 8.20.1 to 8.21.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.21.0</h2>
<h1>Features</h1>
<ul>
<li>Introduced the <code>maxBufferedChunks</code> and
<code>maxFragments</code> options (2b2abd45).</li>
</ul>
<h1>Bug fixes</h1>
<ul>
<li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li>
</ul>
<p>A high volume of tiny fragments and data chunks could be sent by a
peer, using
modest network traffic, to crash a <code>ws</code> server or client due
to OOM.</p>
<pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p>
<p>ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});</p>
<p>ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>client close - code: ${code} reason:
${reason.toString()}</code>);
});
});</p>
<p>wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>server close - code: ${code} reason:
${reason.toString()}</code>);
});
});
</code></pre></p>
<p>The vulnerability was responsibly disclosed and fixed by <a
href="https://github.com/Nadav0077">Nadav Magier</a>.</p>
<p>In vulnerable versions, the issue can be mitigated by lowering the
value of the
<code>maxPayload</code> option if possible.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a>
[dist] 8.21.0</li>
<li><a
href="https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a"><code>2b2abd4</code></a>
[security] Limit retained message parts</li>
<li><a
href="https://github.com/websockets/ws/commit/78eabe2a6677b231bf9c82601bde86ff91639490"><code>78eabe2</code></a>
[security] Add latest vulnerability to SECURITY.md</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=8.20.1&new-version=8.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:32:29 -07:00
dependabot[bot] 58a29a2e61 chore(deps-dev): bump vite from 8.0.5 to 8.0.16 (#2543) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 8.0.5 to 8.0.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.10</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.9</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.8</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.7</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16">8.0.16</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> reject UNC paths for launch-editor-middleware
(<a
href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>)
(<a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9">50b9512</a>)</li>
<li>reject windows alternate paths (<a
href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>)
(<a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546">dc245c7</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15">8.0.15</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>send 408 on request timeout (<a
href="https://redirect.github.com/vitejs/vite/issues/22476">#22476</a>)
(<a
href="https://github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797">c85c9ee</a>)</li>
<li>update rolldown to 1.0.3 (<a
href="https://redirect.github.com/vitejs/vite/issues/22538">#22538</a>)
(<a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575">646dbed</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>capitalize error messages and remove spurious space in parse error
(<a
href="https://redirect.github.com/vitejs/vite/issues/22488">#22488</a>)
(<a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3">85a0eff</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22511">#22511</a>)
(<a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa">2686d7d</a>)</li>
<li><strong>dev:</strong> fix html-proxy cache key mismatch for /@fs/
HTML paths (<a
href="https://redirect.github.com/vitejs/vite/issues/21762">#21762</a>)
(<a
href="https://github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e">47c4213</a>)</li>
<li><strong>glob:</strong> error on relative glob in virtual module when
no files match (<a
href="https://redirect.github.com/vitejs/vite/issues/22497">#22497</a>)
(<a
href="https://github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c">5c8e98f</a>)</li>
<li><strong>optimizer:</strong> close the rolldown bundle when write()
rejects (<a
href="https://redirect.github.com/vitejs/vite/issues/22528">#22528</a>)
(<a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815">e3cfb9d</a>)</li>
<li><strong>resolve:</strong> provide onWarn for viteResolvePlugin in JS
plugin containers (<a
href="https://redirect.github.com/vitejs/vite/issues/22509">#22509</a>)
(<a
href="https://github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83">40985f1</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22566">#22566</a>)
(<a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd">3052a67</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>correct logic in <code>collectAllModules</code> function (<a
href="https://redirect.github.com/vitejs/vite/issues/22562">#22562</a>)
(<a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c">6978a9c</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14">8.0.14</a>
(2026-05-21)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/22484">#22484</a>)
(<a
href="https://github.com/vitejs/vite/commit/96efc88570b6a6ddf1a910f106920cbac07b3cf0">96efc88</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22471">#22471</a>)
(<a
href="https://github.com/vitejs/vite/commit/98b81632139d51820f82036e58d6fbbf122b77b3">98b8163</a>)</li>
<li><strong>dev:</strong> handle errors when sending messages to vite
server (<a
href="https://redirect.github.com/vitejs/vite/issues/22450">#22450</a>)
(<a
href="https://github.com/vitejs/vite/commit/e8e9a34dcf2540139de558a10187630884d10217">e8e9a34</a>)</li>
<li><strong>html:</strong> handle trailing slash paths in
transformIndexHtml (<a
href="https://redirect.github.com/vitejs/vite/issues/22480">#22480</a>)
(<a
href="https://github.com/vitejs/vite/commit/5d94d1bffdb2a15de9341194d89baec86ce1f693">5d94d1b</a>)</li>
<li><strong>optimizer:</strong> pass oxc jsx options to transformSync in
dependency scan (<a
href="https://redirect.github.com/vitejs/vite/issues/22342">#22342</a>)
(<a
href="https://github.com/vitejs/vite/commit/b3132dacea9c6e0cf526cd9f0f09d850f577c262">b3132da</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22470">#22470</a>)
(<a
href="https://github.com/vitejs/vite/commit/7cb728eb629cc677661f1bc52a044ffc0b87fc7f">7cb728e</a>)</li>
<li>remove irrelevant commits from changelog (<a
href="https://github.com/vitejs/vite/commit/2c69495f250edf01132d4a20128de19dbe836086">2c69495</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>glob:</strong> do not rewrite import path for absolute base
(<a
href="https://redirect.github.com/vitejs/vite/issues/22310">#22310</a>)
(<a
href="https://github.com/vitejs/vite/commit/0ae2844ab6d6d1ccf78a2975b8132769fc35b302">0ae2844</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/f94df87ff03b40b65e29bacdc04cc18c7bccaa4a"><code>f94df87</code></a>
release: v8.0.16</li>
<li><a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546"><code>dc245c7</code></a>
fix: reject windows alternate paths (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9"><code>50b9512</code></a>
fix(deps): reject UNC paths for launch-editor-middleware (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/8d1b0195fd186d0b3297d7cd17acff6c96797420"><code>8d1b019</code></a>
release: v8.0.15</li>
<li><a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa"><code>2686d7d</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511">#22511</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd"><code>3052a67</code></a>
chore(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566">#22566</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815"><code>e3cfb9d</code></a>
fix(optimizer): close the rolldown bundle when write() rejects (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528">#22528</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c"><code>6978a9c</code></a>
refactor: correct logic in <code>collectAllModules</code> function (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562">#22562</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575"><code>646dbed</code></a>
feat: update rolldown to 1.0.3 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538">#22538</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3"><code>85a0eff</code></a>
fix: capitalize error messages and remove spurious space in parse error
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488">#22488</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:31:52 -07:00
dependabot[bot] 932d31ae84 chore(deps): bump @angular/common from 22.0.0 to 22.0.1 (#2540) 
Bumps
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/common's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><code>2dd65d2</code></a>
fix(http): pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> ...</li>
<li><a
href="https://github.com/angular/angular/commit/1bd5a562f54b8ec7378e7c7f928285be59091f97"><code>1bd5a56</code></a>
docs: deprecate XHR support for server-side rendering in HTTP docs and
recomm...</li>
<li><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><code>3c2892c</code></a>
fix(common): prevent prototype pollution in formatDateTime</li>
<li><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><code>c4b5fa3</code></a>
fix(common): escape CSS string-terminating characters in
escapeCssUrl</li>
<li><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><code>4254eb4</code></a>
fix(http): preserve empty referrer option in HttpRequest</li>
<li><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><code>167bd4c</code></a>
fix(http): Rejects non-HTTP(S) URLs in JSONP requests</li>
<li><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><code>dfff57e</code></a>
fix(common): Limits date format string length</li>
<li><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><code>1d87c49</code></a>
fix(common): use cryptographically secure SHA-256 for transfer cache key
gene...</li>
<li><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><code>ffb06c0</code></a>
fix(http): ensure query parameters are inserted before URL
fragments</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/common">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@angular/common&package-manager=npm_and_yarn&previous-version=22.0.0&new-version=22.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:12:32 -07:00
MohMaherId 25907eb0be fix(langgraph-checkpoint-redis): add blob reconstruction for channel_values in multi-node graphs (#2336) 
## Summary

Fixes #2334

`RedisSaver.put()` delta-filters `channel_values` based on
`newVersions`, storing only channels written by the current node. Unlike
`PostgresSaver` (which stores channel blobs separately and reconstructs
in `getTuple()`), `RedisSaver` had no reconstruction logic — channels
not written by the last node were silently lost.

This PR completes the blob storage layer:

- **`put()`**: writes each changed channel as a version-keyed Redis JSON
key (`checkpoint_blob:{thread_id}:{ns}:{channel}:{version}`)
- **`loadCheckpointWithWrites()`**: for each channel in
`channel_versions` missing from `channel_values`, looks up the blob at
the recorded version and reconstructs full state

The `checkpoint_blobs` RediSearch index already existed with the correct
schema (`thread_id`, `checkpoint_ns`, `channel`, `version`, `type`) — it
just wasn't wired up.

### Reproduction

```json
{
  "name": "redis-checkpoint-bug",
  "private": true,
  "type": "module",
  "scripts": {
    "dev": "tsx redis-bug.ts",
    "dev:redis": "REDIS_URL=redis://localhost:6379 tsx redis-bug.ts"
  },
  "dependencies": {
    "@langchain/core": "^1.1.40",
    "@langchain/langgraph": "^1.2.9",
    "@langchain/langgraph-checkpoint": "^1.0.1",
    "@langchain/langgraph-checkpoint-redis": "1.0.4"
  },
  "devDependencies": {
    "tsx": "^4.19.0"
  }
}
```

Save the reproduction code from #2334 as `redis-bug.ts`, then:
```bash
docker run -d --name redis-test -p 6379:6379 redis:7-alpine
pnpm install && pnpm dev:redis
```

### Test plan

- [x] Added integration test: multi-channel state where node B writes
only `{status, category}` (not `messages`), verifying `messages`
survives in `getTuple()` result
- [x] Passes `oxfmt --check` and `oxlint`
- [x] Includes changeset
- [x] CI: unit tests
- [x] CI: lint + format
- [x] CI: build
 2026-06-14 17:41:13 -07:00
Mason Daugherty fa45cd95b1 ci(infra): align pinned action SHAs in setup-and-build composite action (#2535) 
The `setup-and-build` composite action pinned older SHAs for
`pnpm/action-setup`, `actions/setup-node`, and
`actions/download-artifact` than the workflows that consume it
(`ci.yml`, `release.yml`, etc.). Standardizing on the workflows' SHAs
leaves one pinned commit per action across the repo — same major
versions, just the newer (gh-verified) SHAs already running in CI.

## Changes
- Repoint the composite action's three `uses:` lines to the SHAs the
workflows already use: `pnpm/action-setup` v4 → `0e279bb9`,
`actions/setup-node` v6 → `48b55a01`, `actions/download-artifact` v4 →
`3e5f45b2`.
 2026-06-12 21:29:58 -04:00
github-actions[bot] 957cac4ea4 chore: version packages (#2526) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-checkpoint-redis@1.0.9

### Patch Changes

- [#2525](https://github.com/langchain-ai/langgraphjs/pull/2525)
[`829a32a`](https://github.com/langchain-ai/langgraphjs/commit/829a32a30cc22103b1cb0aba6a027b7ccdb68447)
Thanks [@lhlyu](https://github.com/lhlyu)! - Fix Redis checkpoint
pending write deserialization when a write document has no `value`
field. RedisJSON omits `undefined` values, so `loadPendingWrites` now
restores a missing `value` as `undefined` instead of passing it through
JSON parsing.

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-api@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-ui@1.3.1

## @langchain/langgraph-cli@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-api@1.3.1

## @langchain/langgraph@1.4.2

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph-checkpoint@1.1.1

## @langchain/langgraph-supervisor@1.1.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-ui@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-sdk@1.9.22

### Patch Changes

- [#2529](https://github.com/langchain-ai/langgraphjs/pull/2529)
[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): reconnect SSE streams when heartbeat idle is detected

Detect half-open SSE connections by watching for server keep-alive
heartbeats (`: heartbeat`) and reconnecting with Last-Event-ID or
`since` when they stop. `"auto"` mode arms only after heartbeats are
observed, so long tool calls and HITL pauses do not false-fire on
heartbeat-emitting servers.

- [#2528](https://github.com/langchain-ai/langgraphjs/pull/2528)
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
Allow custom `AgentServerAdapter`s to be late-bound and re-bound to a
thread. Adapters can now implement an optional `setThreadId(threadId)`,
which `client.threads.stream(threadId, { transport })` calls when
binding the active thread — including the lazily-minted id from the
first `submit()` on a `threadId: null` controller. The built-in
`ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and
`HttpAgentServerAdapter` implement it: `threadId` is now optional at
construction, request URLs derive from the currently-bound thread, and
`paths` entries may be functions of the thread id (`(threadId) =>
string`). This lets a single custom transport back a lazy
thread-creation flow instead of being pinned to one thread at
construction.

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/angular@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/react@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/svelte@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/vue@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @example/ai-elements@0.1.38

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/assistant-ui-claude@0.1.38

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/ui-angular@0.0.48

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph@1.4.2
    -   @langchain/angular@1.0.23

## @examples/ui-multimodal@0.0.24

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/ui-react@0.0.24

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## langgraph@1.0.42

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.23 @langchain/langgraph-api@1.3.1 @langchain/langgraph-checkpoint-redis@1.0.9 @langchain/langgraph-checkpoint@1.1.1 @langchain/langgraph-cli@1.3.1 @langchain/langgraph-sdk@1.9.22 @langchain/langgraph-supervisor@1.1.1 @langchain/langgraph-ui@1.3.1 @langchain/langgraph@1.4.2 @langchain/react@1.0.23 @langchain/svelte@1.0.23 @langchain/vue@1.0.23 		2026-06-12 14:33:35 -07:00
dependabot[bot] 696ed53e02 chore(deps): bump esbuild from 0.25.12 to 0.28.1 (#2532) 
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.12 to
0.28.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@​dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@​sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
  using x = new Resource()
  x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog: 2025</h1>
<p>This changelog documents all esbuild versions published in the year
2025 (versions 0.25.0 through 0.27.2).</p>
<h2>0.27.2</h2>
<ul>
<li>
<p>Allow import path specifiers starting with <code>#/</code> (<a
href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p>
<p>Previously the specification for <code>package.json</code> disallowed
import path specifiers starting with <code>#/</code>, but this
restriction <a
href="https://redirect.github.com/nodejs/node/pull/60864">has recently
been relaxed</a> and support for it is being added across the JavaScript
ecosystem. One use case is using it for a wildcard pattern such as
mapping <code>#/*</code> to <code>./src/*</code> (previously you had to
use another character such as <code>#_*</code> instead, which was more
confusing). There is some more context in <a
href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p>
<p>This change was contributed by <a
href="https://github.com/hybrist"><code>@​hybrist</code></a>.</p>
</li>
<li>
<p>Automatically add the <code>-webkit-mask</code> prefix (<a
href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p>
<p>This release automatically adds the <code>-webkit-</code> vendor
prefix for the <a
href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a>
CSS shorthand property:</p>
<pre lang="css"><code>/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
<p>/* Old output (with --target=chrome110) */<br />
main {<br />
mask: url(x.png) center/5rem no-repeat;<br />
}</p>
<p>/* New output (with --target=chrome110) */<br />
main {<br />
-webkit-mask: url(x.png) center/5rem no-repeat;<br />
mask: url(x.png) center/5rem no-repeat;<br />
}<br />
</code></pre></p>
<p>This change was contributed by <a
href="https://github.com/BPJEnnova"><code>@​BPJEnnova</code></a>.</p>
</li>
<li>
<p>Additional minification of <code>switch</code> statements (<a
href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p>
<p>This release contains additional minification patterns for reducing
<code>switch</code> statements. Here is an example:</p>
<pre lang="js"><code>// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a>
publish 0.28.1 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a>
security: add integrity checks to the Deno API</li>
<li><a
href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a>
enforce non-negative size in gzip parser</li>
<li><a
href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a>
security: forbid <code>\\</code> in local dev server requests</li>
<li><a
href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>:
don't inline <code>using</code> declarations</li>
<li><a
href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>:
renaming of nested <code>var</code> declarations</li>
<li><a
href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a>
fix some typos</li>
<li><a
href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a>
chore: fix some minor issues in comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a>
follow up: cjs evaluation fixes</li>
<li><a
href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>:
esm evaluation fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.25.12...v0.28.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for esbuild since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.25.12&new-version=0.28.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-12 14:32:55 -07:00
Christian Bromann e7e8035fad fix(sdk): late-bind threadId on custom AgentServerAdapter transports (#2528) 
## Summary
- Add optional `setThreadId(threadId)` to `TransportAdapter` and call it
from `client.threads.stream` when binding a custom adapter to the active
thread (including the id minted on the first `submit()` of a `threadId:
null` stream).
- Make `threadId` optional at construction on
`ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and
`HttpAgentServerAdapter`; derive command/stream/state URLs from the
currently-bound thread and allow `paths` entries to be `(threadId) =>
string`.
- Add unit tests for lazy binding, re-binding, function paths, and
`client.threads.stream` wiring.
- Document lazy thread binding for custom backends in core SDK and
framework docs (React, Vue, Svelte, Angular).
 2026-06-12 13:24:41 -07:00
Christian Bromann ba31f045d1 fix(sdk): reconnect SSE streams when heartbeat idle is detected (#2529) 
## Summary
- Add heartbeat-adaptive idle reconnect for SSE streams
(`idleReconnectStream`) so half-open connections (e.g. platform revision
rollover) are detected when `: heartbeat` comments stop arriving and the
existing reconnect path resumes with `Last-Event-ID` or `since`.
- `"auto"` mode (default on built-in SSE transports) stays dormant until
heartbeats are observed, sizes the idle window from their cadence (~15s
on the platform's 5s heartbeat), and does not false-fire during long
tool calls or HITL pauses.
- Expose `streamIdleReconnect?: IdleReconnectMode` on `runs.stream`,
`runs.joinStream`, and `threads.stream`; reuse `IdleReconnectMode`
across public option types.
 2026-06-12 13:21:51 -07:00
Christian Bromann 9e114e55d3 chore(deps): remove uuid dependency in favor of embedded uuid in core (#2527) 
## Summary
- Remove the direct `uuid` npm dependency from `@langchain/langgraph`,
`@langchain/langgraph-checkpoint`,
`@langchain/langgraph-checkpoint-redis`, `@langchain/langgraph-api`,
`@langchain/langgraph-supervisor`, and `@langchain/langgraph-sdk`.
- Switch all UUID generation and validation to
`@langchain/core/utils/uuid` (v4, v5, v6, v7, and `validate`).
- Drop unused `@types/uuid` devDependencies from checkpoint backend
packages that no longer reference `uuid` directly.

fixes #2481
 2026-06-12 10:54:29 -07:00
谕℃ 829a32a30c fix(langgraph-checkpoint-redis): handle undefined pending writes (#2525) 
## Summary

Fix Redis checkpoint restore when a pending write document has no
`value` field.

RedisJSON omits `undefined` values, but `loadPendingWrites` always tried
to deserialize:

```ts
JSON.stringify(writeDoc.value)

When value is missing, this produces undefined and can fail with:

JSON Parse error: Unexpected EOF

This breaks interrupt/resume checkpoint loading.

## Changes

- Treat missing pending write value as undefined.
- Apply the fix to both RedisSaver and ShallowRedisSaver.
- Add unit tests for both.
 2026-06-11 10:06:49 -07:00
github-actions[bot] 34a01255e1 chore: version packages (#2524) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-supervisor@1.1.0

### Minor Changes

- [#2521](https://github.com/langchain-ai/langgraphjs/pull/2521)
[`56682a6`](https://github.com/langchain-ai/langgraphjs/commit/56682a69a24d0dfb210f1fb5187c51e3adc356bf)
Thanks [@open-swe](https://github.com/apps/open-swe)! -
feat(langgraph-supervisor): Add `addHandoffMessages` to
`createSupervisor` and `createHandoffTool`, allowing supervisor-to-agent
handoff bookkeeping messages to be omitted from the expert agent's
message history. When `addHandoffBackMessages` is not provided, it now
defaults to the same value as `addHandoffMessages`, matching the Python
package behavior.

`createHandoffTool` now also accepts `description` as the preferred
option name while continuing to support the existing `agentDescription`
option as deprecated for backwards compatibility.

### Patch Changes

- [#2407](https://github.com/langchain-ai/langgraphjs/pull/2407)
[`59d4765`](https://github.com/langchain-ai/langgraphjs/commit/59d4765870bc0cddf3ef594b128ab3280533cb6c)
Thanks [@pragnyanramtha](https://github.com/pragnyanramtha)! - Normalize
all whitespace in supervisor handoff tool names.

## @langchain/langgraph@1.4.1

### Patch Changes

- [#2520](https://github.com/langchain-ai/langgraphjs/pull/2520)
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(state): validate Zod state updates from nodes

Validate node return values and Command updates against Zod state schema
    constraints before applying them to graph state.

Fixes [#2519](https://github.com/langchain-ai/langgraphjs/issues/2519)

- [#2511](https://github.com/langchain-ai/langgraphjs/pull/2511)
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(ToolNode): forward graph state to tools via `runtime.state`

`ToolNode` now forwards its input to each tool through the second
argument as `runtime.state`. When using `ToolNode` as a node in a
LangGraph graph, this gives tools access to the current graph state for
workflows that need tool-call support in LangGraph proper. Tools can
type the second parameter as `ToolRuntime<StateType>` from
`@langchain/core/tools` and read `runtime.state` directly. This works in
every runtime, including web browsers, and removes the need for
`getCurrentTaskInput()` (which relies on
`node:async_hooks`/`AsyncLocalStorage`). `getCurrentTaskInput(config)`
continues to work for backwards compatibility.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/langgraph-sdk@1.9.21

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- [#2523](https://github.com/langchain-ai/langgraphjs/pull/2523)
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): stop re-streaming seeded messages on idle-thread submit

An idle (finished) thread defers its root SSE pump, so the first
`submit()` brings it up and the transport replays the finished run from
`seq=0`. The replayed `messages` channel carries no step (unlike
`values`, guarded by `maxStep`), so it rebuilt each already-complete
message from an empty `message-start` and re-streamed the whole turn
token-by-token — a visible "messages replay" of the existing
conversation. Seal the message ids seeded from the idle `getState()`
snapshot so replayed deltas can't downgrade the complete tail; the seal
lifts once a newer checkpoint advances the timeline or on thread rebind,
and ids from the next run are never sealed.

- [#2462](https://github.com/langchain-ai/langgraphjs/pull/2462)
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect

Add automatic reconnect with resume (`since` for SSE) for protocol
transports,
wire `AsyncCaller` through `client.threads.stream`, and expose optional
reconnect tuning on `ThreadStreamOptions`. Includes integration tests
against
    an in-process mock langgraph-api server.

## @langchain/angular@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/react@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/svelte@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/vue@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @example/ai-elements@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/assistant-ui-claude@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-angular@0.0.47

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/angular@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-multimodal@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-react@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## langgraph@1.0.41

### Patch Changes

- Updated dependencies
\[[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/langgraph@1.4.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.22 @langchain/langgraph-sdk@1.9.21 @langchain/langgraph-supervisor@1.1.0 @langchain/langgraph@1.4.1 @langchain/react@1.0.22 @langchain/svelte@1.0.22 @langchain/vue@1.0.22 		2026-06-10 17:09:31 -07:00
open-swe[bot] febba20e49 fix(internal): update changelog 2026-06-10 17:06:23 -07:00
Christian Bromann 17c44a38b7 fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect (#2462) 
## Summary
- Add automatic reconnect for v2 `ProtocolSseTransportAdapter` and
`ProtocolWebSocketTransportAdapter` (resume via `since` on SSE, full
buffer replay on WebSocket, with `MaxWebSocketReconnectAttemptsError`
when the budget is exceeded).
- Wire `AsyncCaller` and reconnect defaults through
`client.threads.stream`, with optional `maxReconnectAttempts`,
`reconnectDelayMs`, and `onReconnect` on `ThreadStreamOptions`.
- Disable auto-reconnect when a custom `fetch` is passed (test/mocks),
and add `pnpm test:int` integration tests using `client.threads.stream`
+ `run.start` against an in-process mock server.

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 17:05:35 -07:00
Pragnyan Ramtha 59d4765870 fix(langgraph-supervisor): normalize handoff tool whitespace (#2407) 
## Summary

- normalize all whitespace runs in supervisor handoff agent names
- prevent generated handoff tool names from retaining spaces after the
first normalized segment
- add focused coverage for a multi-word agent name and a patch changeset
for `@langchain/langgraph-supervisor`

## Validation

- `git diff --check` -> passed
- `pnpm --dir libs/langgraph-supervisor exec vitest run
src/tests/supervisor.test.ts` -> 5 passed
- `pnpm --filter @langchain/langgraph-supervisor build:internal` ->
passed, including `attw` and `publint`

## Notes

The sibling `langgraph-swarm` handoff helper already uses global
whitespace replacement; this aligns supervisor handoff naming with that
behavior.

Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-06-10 16:27:18 -07:00
Christian Bromann 2da5c3374f fix(langgraph): validate Zod state updates from nodes (#2520) 
## Summary
- Validates StateGraph node return values and Command updates against
Zod state schema constraints before applying writes.
- Preserves Overwrite behavior by validating reducer overwrites against
stored value schemas.
- Adds regression coverage for invalid Zod node returns and Command
updates.

Fixes #2519

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
 2026-06-10 15:56:53 -07:00
Christian Bromann 7c3e9e93f3 fix(sdk): stop re-streaming seeded messages on idle-thread submit (#2523) 
## Summary
- Fixes a visible "messages replay" where opening a finished thread and
submitting re-streamed every existing message token-by-token.
- Root cause: an idle thread defers its root SSE pump, so the first
`submit()` replays the finished run from `seq=0`. The `messages` channel
carries no step (unlike `values`, guarded by `#maxStep`), so it rebuilt
each already-complete message from an empty `message-start`, clobbering
the tail seeded from `getState()`.
- Adds a message-id seal in `RootMessageProjection`: ids seeded from an
idle thread's `getState()` snapshot drop replayed `messages` deltas in
`handleMessage()`. The seal is cleared on thread rebind (`reset()`) and
lifts in `applyValues()` once a strictly-newer checkpoint `step`
advances the timeline past the seed. `controller.hydrate()` only seals
for idle threads (`!threadActive`) — active threads keep streaming their
live tail, and ids from the next run are never sealed.

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
 2026-06-10 15:31:26 -07:00
Christian Bromann 3855985dd0 fix(sdk): add per-event channel effect selector (#2522) 
## Summary
- Add a side-effect counterpart to `useChannel`: `useChannelEffect`
(React, Svelte, Vue) and `injectChannelEffect` (Angular). It invokes an
`onEvent` callback once per raw protocol event and returns nothing, so
it never re-renders — the idiomatic v1 replacement for the removed
`onLangChainEvent` / `onCustomEvent` callbacks used for
analytics/logging.
- Back all four bindings with a new framework-agnostic
`acquireChannelEffect(registry, channels, namespace, options)` helper in
`@langchain/langgraph-sdk/stream`. It acquires the same ref-counted
`channelProjection` as `useChannel` (so an effect consumer and a
matching `useChannel` share one server subscription and survive thread
swaps), diffs the shared store by event identity, skips events buffered
before it attaches (no double-counting history on a late mount), and
resets correctly across thread rebinds.
- API matches the agreed shape with `target`, `enabled`, `replay`
(defaults to `false`/live-only — opposite of `useChannel`),
`bufferSize`, `onEvent`, and `onError`. Callbacks are read from a
ref/lazy wrapper so fresh inline closures never re-subscribe.
- Update selector docs and `v1-migration.md` in all four SDKs, noting
the callback now receives v1 protocol events (`lifecycle.*`, `tools.*`,
`messages.*`, `custom`) rather than legacy LangChain event names.

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
 2026-06-10 15:19:27 -07:00
open-swe[bot] 56682a69a2 feat(supervisor): add addHandoffMessages option [closes #2499] (#2521) 
## Description
Adds an `addHandoffMessages` option to `createSupervisor` and
`createHandoffTool` (defaulting to `true` for backward compatibility).
When `false`, the supervisor-to-agent handoff bookkeeping messages (the
supervisor `AIMessage` with the handoff tool call and the handoff
`ToolMessage`) are omitted from the expert agent's message history,
matching the Python `langgraph-supervisor` behavior. This avoids invalid
tool-call sequences for providers that strictly validate them.

## Release Note
Add `addHandoffMessages` option to `@langchain/langgraph-supervisor` to
omit supervisor-to-agent handoff messages from expert agent history.

## Test Plan
- [ ] Verify expert agent history excludes handoff
`AIMessage`/`ToolMessage` when `addHandoffMessages: false`

Made by [Open SWE](https://openswe.vercel.app)

closes #2499

---------

Co-authored-by: Christian Bromann <731337+christian-bromann@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-06-10 15:18:59 -07:00
Christian Bromann ef04db316d docs: document first-class graph-state access for ToolNode tools (#2511) 
Tools running inside a ToolNode can already read the current graph state
via `getCurrentTaskInput()`, but this was not documented as a
first-class option and the browser-safe variant (passing config
explicitly) was not surfaced.

This adds:

- JSDoc on getCurrentTaskInput documenting the optional config arg and
browser usage
- A ToolNode JSDoc example showing how tools access graph state and
runtime context
- Browser-safe guidance in the agents context docs and the
pass-run-time-values-to-tools how-to (`getCurrentTaskInput(config)`)
- A regression test verifying a ToolNode tool can read graph state via
getCurrentTaskInput(config)

Closes #2506
 2026-06-10 15:18:04 -07:00
github-actions[bot] 39df14b11f chore: version packages (#2513) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.0

### Minor Changes

- [#2452](https://github.com/langchain-ai/langgraphjs/pull/2452)
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
`DeltaChannel` and the writes-history saver API (beta).

`DeltaChannel` is a reducer channel that stores only a sentinel in
checkpoint
blobs instead of the full accumulated value, reconstructing state on
read by
replaying ancestor writes through a batch reducer. This avoids
re-serializing
the entire accumulated value at every step (e.g. long message
histories).

- `DeltaChannel(reducer, { snapshotFrequency })` in
`@langchain/langgraph` —
count-based snapshot cadence (default `snapshotFrequency=1000`) plus a
system bound `DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT` (default 5000, env
        `LANGGRAPH_DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT`).
- `messagesDeltaReducer` — a batching-invariant messages reducer that
coerces
        raw object/string writes, for use with `DeltaChannel`.
- `BaseCheckpointSaver.getDeltaChannelHistory({ config, channels })`
(beta) —
walks the parent chain returning per-channel `{ writes, seed? }`, with a
        direct-storage override in `MemorySaver`.
- `counters_since_delta_snapshot` added to `CheckpointMetadata`;
`DeltaSnapshot`
        serialization support in the JSON+ serializer.

Reconstruction is wired through the Pregel read/execution paths
(initialization,
`getState`, `updateState`, local reads) and `exit` durability
accumulates and
anchors delta writes so threads remain reconstructible without forcing
    snapshots.

### Patch Changes

- [#2450](https://github.com/langchain-ai/langgraphjs/pull/2450)
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
node-level timeouts.

A `timeout` option is now supported on `StateGraph.addNode`, the
functional API
(`task`/`entrypoint`), and the `Send` constructor. Pass a number of
milliseconds
    for a hard wall-clock cap, or a `TimeoutPolicy` for finer control:

    ```ts
    import { TimeoutPolicy } from "@langchain/langgraph";

    // hard wall-clock cap on each attempt
    builder.addNode("agent", agentFn, { timeout: 60_000 });

    // full control
    builder.addNode("agent", agentFn, {
      timeout: {
        runTimeout: 60_000, // hard wall-clock cap, never refreshed
        idleTimeout: 10_000, // cap on time without observable progress
        refreshOn: "auto", // "auto" | "heartbeat"
      },
    });

    // per-task override
    new Send("agent", state, { timeout: { idleTimeout: 5_000 } });
    ```

    When a timeout fires, a `NodeTimeoutError` (carrying `node`, `kind`
(`"run"`/`"idle"`), `timeout`, `elapsed`, `runTimeout`, `idleTimeout`)
is raised,
the attempt's buffered writes are dropped, and the node's `AbortSignal`
is
aborted. `idleTimeout` is refreshed by observable progress (writes,
custom
stream-writer calls, child-task scheduling, callback events) or an
explicit
    `runtime.heartbeat()` call. The timer resets per retry attempt, and
    `NodeTimeoutError` is retryable under the default retry policy.

Ports langchain-ai/langgraph#7599,
[#7646](https://github.com/langchain-ai/langgraphjs/issues/7646), and
[#7659](https://github.com/langchain-ai/langgraphjs/issues/7659).

## @langchain/langgraph@1.4.0

### Minor Changes

- [#2449](https://github.com/langchain-ai/langgraphjs/pull/2449)
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
cooperative, between-superstep graph draining via `RunControl`.

    A new `RunControl` (exported from `@langchain/langgraph`) exposes
`requestDrain(reason)` plus read-only `drainRequested` / `drainReason`.
Pass it
through the new `control` option on `invoke` / `stream` / `streamEvents`
(and the
functional API). It is surfaced on `runtime.control`, so nodes can read
it or call
    `requestDrain()` themselves, and it is propagated into subgraphs.

When a drain is requested, the Pregel loop checks the flag at the top of
each
superstep (after the previous step's writes are applied and
checkpointed): if more
tasks remain it saves the checkpoint and throws the new `GraphDrained`
error (also
under `durability: "exit"`), so the run can be resumed later from the
same config.
If the graph naturally finishes on that tick it returns normally and the
caller can
inspect `control.drainRequested`. A drain requested inside a subgraph
bubbles up and
stops the parent at its next boundary. Draining never cancels work that
is already
running — pair it with an `AbortSignal` if you need a hard upper bound.

- [#2452](https://github.com/langchain-ai/langgraphjs/pull/2452)
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
`DeltaChannel` and the writes-history saver API (beta).

`DeltaChannel` is a reducer channel that stores only a sentinel in
checkpoint
blobs instead of the full accumulated value, reconstructing state on
read by
replaying ancestor writes through a batch reducer. This avoids
re-serializing
the entire accumulated value at every step (e.g. long message
histories).

- `DeltaChannel(reducer, { snapshotFrequency })` in
`@langchain/langgraph` —
count-based snapshot cadence (default `snapshotFrequency=1000`) plus a
system bound `DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT` (default 5000, env
        `LANGGRAPH_DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT`).
- `messagesDeltaReducer` — a batching-invariant messages reducer that
coerces
        raw object/string writes, for use with `DeltaChannel`.
- `BaseCheckpointSaver.getDeltaChannelHistory({ config, channels })`
(beta) —
walks the parent chain returning per-channel `{ writes, seed? }`, with a
        direct-storage override in `MemorySaver`.
- `counters_since_delta_snapshot` added to `CheckpointMetadata`;
`DeltaSnapshot`
        serialization support in the JSON+ serializer.

Reconstruction is wired through the Pregel read/execution paths
(initialization,
`getState`, `updateState`, local reads) and `exit` durability
accumulates and
anchors delta writes so threads remain reconstructible without forcing
    snapshots.

- [#2451](https://github.com/langchain-ai/langgraphjs/pull/2451)
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(langgraph): add node-level error handlers

`StateGraph.addNode(name, fn, { errorHandler })` now accepts a
first-class
node-level error handler. The handler runs ONLY after the failing node's
`retryPolicy` is exhausted, so retry and handling stay decoupled. It
receives a
typed `NodeError { node, error }` and the typed node input state, can
return a
state update, and can route to a recovery branch via `new Command({ goto
})`
    (saga / compensation flows).

Failure provenance is checkpointed (via a reserved `ERROR_SOURCE_NODE`
write) so
handlers observe the same context after a checkpoint resume. Uncaught
node
errors without a handler still abort the run as before, and
`GraphBubbleUp`
    errors (such as `interrupt()`) are never swallowed by a handler.

`StateGraph.setNodeDefaults({ errorHandler })` now also accepts a
graph-wide
default handler. It is materialized at `compile()` as a single shared
handler
and invoked for every regular node that does not set its own
`errorHandler`. A
per-node handler always takes precedence, the default never catches a
failure
raised by an error-handler node itself (handler failures fail the run),
and the
    default is not inherited by subgraphs.

    Ports the Python feature from langchain-ai/langgraph#7233.

- [#2450](https://github.com/langchain-ai/langgraphjs/pull/2450)
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
node-level timeouts.

A `timeout` option is now supported on `StateGraph.addNode`, the
functional API
(`task`/`entrypoint`), and the `Send` constructor. Pass a number of
milliseconds
    for a hard wall-clock cap, or a `TimeoutPolicy` for finer control:

    ```ts
    import { TimeoutPolicy } from "@langchain/langgraph";

    // hard wall-clock cap on each attempt
    builder.addNode("agent", agentFn, { timeout: 60_000 });

    // full control
    builder.addNode("agent", agentFn, {
      timeout: {
        runTimeout: 60_000, // hard wall-clock cap, never refreshed
        idleTimeout: 10_000, // cap on time without observable progress
        refreshOn: "auto", // "auto" | "heartbeat"
      },
    });

    // per-task override
    new Send("agent", state, { timeout: { idleTimeout: 5_000 } });
    ```

    When a timeout fires, a `NodeTimeoutError` (carrying `node`, `kind`
(`"run"`/`"idle"`), `timeout`, `elapsed`, `runTimeout`, `idleTimeout`)
is raised,
the attempt's buffered writes are dropped, and the node's `AbortSignal`
is
aborted. `idleTimeout` is refreshed by observable progress (writes,
custom
stream-writer calls, child-task scheduling, callback events) or an
explicit
    `runtime.heartbeat()` call. The timer resets per retry attempt, and
    `NodeTimeoutError` is retryable under the default retry policy.

Ports langchain-ai/langgraph#7599,
[#7646](https://github.com/langchain-ai/langgraphjs/issues/7646), and
[#7659](https://github.com/langchain-ai/langgraphjs/issues/7659).

- [#2461](https://github.com/langchain-ai/langgraphjs/pull/2461)
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)
Thanks [@christian-bromann](https://github.com/christian-bromann)! - Add
`StateGraph.setNodeDefaults()` for setting graph-wide node policy
defaults (`retryPolicy`, `cachePolicy`). Per-node values passed to
`addNode` always take precedence, and defaults are resolved at
`compile()` time so call order does not matter. Defaults are not
inherited by subgraphs. Ports Python's `set_node_defaults()`
(langchain-ai/langgraph#7747).

### Patch Changes

- [#2179](https://github.com/langchain-ai/langgraphjs/pull/2179)
[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(core): time travel replay/fork for graphs with interrupts and
subgraphs

Ports Python fixes for stale RESUME writes during replay, wrong subgraph
checkpoint loading during time travel, missing fork checkpoints on
replay, and direct-to-subgraph time travel.

- [#2514](https://github.com/langchain-ai/langgraphjs/pull/2514)
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(schema): expose StateSchema JSON schemas for Studio introspection

    Route StateSchema runtime definitions through getJsonSchema() and
    getInputJsonSchema() so LangGraph Studio receives state, input, and
    context schemas when graphs use the StateSchema primitive.

Fixes [#2466](https://github.com/langchain-ai/langgraphjs/issues/2466)

- [#2471](https://github.com/langchain-ai/langgraphjs/pull/2471)
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
perf(core): skip debug checkpoint snapshots when not streaming them

Avoid building full-state `mapDebugCheckpoint` payloads on every tick
when
    no consumer subscribed to `checkpoints` or `debug` stream modes. v3
companion checkpoint envelopes are unchanged (they come from values
metadata).

- [#2472](https://github.com/langchain-ai/langgraphjs/pull/2472)
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
perf(core): index pending writes for O(1) task-prep lookups

Build a PendingWritesIndex once per \_prepareNextTasks call so resume
and
skip-done-task checks avoid repeated linear scans over
checkpointPendingWrites.

- [#2473](https://github.com/langchain-ai/langgraphjs/pull/2473)
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
perf(core): optimize applyWrites, interrupt seen, and channel errors

Reduce allocations in \_applyWrites, fix O(N²) interrupt versions_seen
updates,
skip stack traces on EmptyChannelError control flow, and cache task
lists in
    the pregel loop and runner.

- [#2444](https://github.com/langchain-ai/langgraphjs/pull/2444)
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(remote): add RemoteGraph v3 streaming support

Expose the v3 `streamEvents` surface for `RemoteGraph` by adapting
remote SDK thread streams to the local `GraphRunStream` shape.

- Updated dependencies
\[[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198)]:
    -   @langchain/langgraph-checkpoint@1.1.0

## @langchain/langgraph-checkpoint-mongodb@1.3.4

### Patch Changes

- [#2517](https://github.com/langchain-ai/langgraphjs/pull/2517)
[`67a4f8d`](https://github.com/langchain-ai/langgraphjs/commit/67a4f8da580eb527fa6f201a4c72895754fe37f7)
Thanks [@jackjin1997](https://github.com/jackjin1997)! - fix:
`MongoDBSaver.putWrites` now honors `WRITES_IDX_MAP`, pinning special
channels (`__error__`, `__scheduled__`, `__interrupt__`, `__resume__`)
to fixed negative indices instead of the call-local ordinal. Previously
a mixed `putWrites([[...regular...], [INTERRUPT, …]], taskId)` placed
the INTERRUPT at a positive idx that could collide with a regular write
at the same `(task_id, idx)`, and the unconditional `$set` upsert
silently overwrote whichever row landed there first. The
conflict-resolution clause now matches the Postgres / SQLite (TS and
Python) checkpointers: `$set` only when every channel is a special one,
`$setOnInsert` otherwise.

## @langchain/langgraph-checkpoint-postgres@1.0.3

### Patch Changes

- [#2512](https://github.com/langchain-ai/langgraphjs/pull/2512)
[`375c73f`](https://github.com/langchain-ai/langgraphjs/commit/375c73fcd1ef06145301df80466fda35c0a99385)
Thanks [@jackjin1997](https://github.com/jackjin1997)! - fix: reject SQL
`LIKE` wildcards (`%`, `_`) and the backslash escape character in
`PostgresStore` namespace labels. `BaseStore.search()` matches
namespaces via `namespace_path LIKE ${prefix}%`, and these characters in
caller-supplied namespace labels are interpreted as wildcards by
Postgres even through a bound parameter — letting a namespace prefix of
`["%"]` match every namespace in the store across tenants.
`validateNamespace` now throws for these characters at all `search` /
`get` / `put` entrypoints, keeping store-wide consistency. CWE-1336.

## @langchain/langgraph-checkpoint-redis@1.0.8

### Patch Changes

- [#2518](https://github.com/langchain-ai/langgraphjs/pull/2518)
[`9182ea3`](https://github.com/langchain-ai/langgraphjs/commit/9182ea35ecc1f932eb864fa7dc4fb32a00c5f7d6)
Thanks [@jackjin1997](https://github.com/jackjin1997)! - fix:
`RedisSaver.putWrites` now honors `WRITES_IDX_MAP`, pinning special
channels (`__error__`, `__scheduled__`, `__interrupt__`, `__resume__`)
to fixed negative indices in their Redis key
(`checkpoint_write:…:<idx>`) instead of the call-local ordinal.
Previously a mixed `putWrites([[…regular…], [INTERRUPT, …]], taskId)`
placed the INTERRUPT key at the positive idx of its position in the
batch, where a peer task's regular write at the same idx would overwrite
it via the unconditional `JSON.SET`. The conflict-resolution clause now
matches Postgres / SQLite / MongoDB: unguarded `JSON.SET` when every
write is a special channel, `JSON.SET … NX` (insert-or-ignore)
otherwise.

## @langchain/langgraph-checkpoint-sqlite@1.0.3

### Patch Changes

- [#2516](https://github.com/langchain-ai/langgraphjs/pull/2516)
[`f6a6d26`](https://github.com/langchain-ai/langgraphjs/commit/f6a6d26b7e69003c4fa052f3cd3319f3e72f0f8f)
Thanks [@jackjin1997](https://github.com/jackjin1997)! - fix:
`SqliteSaver.putWrites` now honors `WRITES_IDX_MAP`, pinning special
channels (`__error__`, `__scheduled__`, `__interrupt__`, `__resume__`)
to fixed negative indices instead of the call-local ordinal. Previously
a follow-up `putWrites([[INTERRUPT, …]], taskId)` for the same
checkpoint silently `REPLACE`d the regular write previously stored at
`idx=0` for that task, losing data. The conflict-resolution clause also
now matches the Python checkpointer contract: `OR REPLACE` only when
every channel is a special one (so e.g. INTERRUPT→RESUME state
transitions overwrite), `OR IGNORE` otherwise.

## @langchain/angular@1.0.21

### Patch Changes

- [#2515](https://github.com/langchain-ai/langgraphjs/pull/2515)
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix: make AnyStream a true supertype so selector hooks need no cast

    A concrete `useStream<typeof agent>()` handle was not assignable to
    `AnyStream` because generic-computed covariant members (`toolCalls`,
`values`) don't widen under `any` — `InferToolCalls<any>[]` resolves to
`AssembledToolCall<…, never>[]`, narrower than a concrete handle.
Override
    those members with their widest forms (preserving each framework's
reactivity wrapper — plain arrays for React/Svelte, `ShallowRef` for
Vue,
`Signal` for Angular) so the message/tool/value selector hooks accept a
    fully-typed stream without an `as AnyStream` cast.

## @langchain/react@1.0.21

### Patch Changes

- [#2515](https://github.com/langchain-ai/langgraphjs/pull/2515)
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix: make AnyStream a true supertype so selector hooks need no cast

    A concrete `useStream<typeof agent>()` handle was not assignable to
    `AnyStream` because generic-computed covariant members (`toolCalls`,
`values`) don't widen under `any` — `InferToolCalls<any>[]` resolves to
`AssembledToolCall<…, never>[]`, narrower than a concrete handle.
Override
    those members with their widest forms (preserving each framework's
reactivity wrapper — plain arrays for React/Svelte, `ShallowRef` for
Vue,
`Signal` for Angular) so the message/tool/value selector hooks accept a
    fully-typed stream without an `as AnyStream` cast.

## @langchain/svelte@1.0.21

### Patch Changes

- [#2515](https://github.com/langchain-ai/langgraphjs/pull/2515)
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix: make AnyStream a true supertype so selector hooks need no cast

    A concrete `useStream<typeof agent>()` handle was not assignable to
    `AnyStream` because generic-computed covariant members (`toolCalls`,
`values`) don't widen under `any` — `InferToolCalls<any>[]` resolves to
`AssembledToolCall<…, never>[]`, narrower than a concrete handle.
Override
    those members with their widest forms (preserving each framework's
reactivity wrapper — plain arrays for React/Svelte, `ShallowRef` for
Vue,
`Signal` for Angular) so the message/tool/value selector hooks accept a
    fully-typed stream without an `as AnyStream` cast.

## @langchain/vue@1.0.21

### Patch Changes

- [#2515](https://github.com/langchain-ai/langgraphjs/pull/2515)
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix: make AnyStream a true supertype so selector hooks need no cast

    A concrete `useStream<typeof agent>()` handle was not assignable to
    `AnyStream` because generic-computed covariant members (`toolCalls`,
`values`) don't widen under `any` — `InferToolCalls<any>[]` resolves to
`AssembledToolCall<…, never>[]`, narrower than a concrete handle.
Override
    those members with their widest forms (preserving each framework's
reactivity wrapper — plain arrays for React/Svelte, `ShallowRef` for
Vue,
`Signal` for Angular) so the message/tool/value selector hooks accept a
    fully-typed stream without an `as AnyStream` cast.

## @example/ai-elements@0.1.36

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0
    -   @langchain/react@1.0.21

## @examples/assistant-ui-claude@0.1.36

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0
    -   @langchain/react@1.0.21

## @examples/ui-angular@0.0.46

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0
    -   @langchain/angular@1.0.21

## @examples/ui-multimodal@0.0.22

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0
    -   @langchain/react@1.0.21

## @examples/ui-react@0.0.22

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`49b8c1a`](https://github.com/langchain-ai/langgraphjs/commit/49b8c1a04cf03a77069a955816b0f5af2f68ab41),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0
    -   @langchain/react@1.0.21

## langgraph@1.0.40

### Patch Changes

- Updated dependencies
\[[`01c67df`](https://github.com/langchain-ai/langgraphjs/commit/01c67dfa4dfea98509d6e1f35fa16de8c5d6a7c4),
[`d12d269`](https://github.com/langchain-ai/langgraphjs/commit/d12d2693308e37951266bc8197daa656daa6e2aa),
[`a8e7659`](https://github.com/langchain-ai/langgraphjs/commit/a8e7659a9d22fd84425aaf26bda88667c76b185a),
[`9e0201d`](https://github.com/langchain-ai/langgraphjs/commit/9e0201d8bd2d85490ca49e7e62126bda32b9121b),
[`9b96f60`](https://github.com/langchain-ai/langgraphjs/commit/9b96f60af64c0d25f780cfe00c1cb7698f3b5773),
[`8e06ace`](https://github.com/langchain-ai/langgraphjs/commit/8e06ace95cd2279a8cf9d350f01268a253376dc9),
[`d65a920`](https://github.com/langchain-ai/langgraphjs/commit/d65a9209d7fad603f45562c2b28c3d25502c8318),
[`2f6d873`](https://github.com/langchain-ai/langgraphjs/commit/2f6d87368e590ae2fc2a7990fd13cb0a5fe3c198),
[`a8b0036`](https://github.com/langchain-ai/langgraphjs/commit/a8b0036557333d16c95dfe51ccd61ee4cfdc600b),
[`4096933`](https://github.com/langchain-ai/langgraphjs/commit/4096933741e44d065e9b172f3bf86a621a88cc1e),
[`801d955`](https://github.com/langchain-ai/langgraphjs/commit/801d955d391f9fd9326a6696bff6c2f039883301)]:
    -   @langchain/langgraph@1.4.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.21 @langchain/langgraph-checkpoint-mongodb@1.3.4 @langchain/langgraph-checkpoint-postgres@1.0.3 @langchain/langgraph-checkpoint-redis@1.0.8 @langchain/langgraph-checkpoint-sqlite@1.0.3 @langchain/langgraph-checkpoint@1.1.0 @langchain/langgraph@1.4.0 @langchain/react@1.0.21 @langchain/svelte@1.0.21 @langchain/vue@1.0.21 		2026-06-10 10:41:31 -07:00
Jackjin 9182ea35ec fix(langgraph-checkpoint-redis): honor WRITES_IDX_MAP for special channels in putWrites (#2518) 
## Summary

Third in the series following #2516 (SQLite) and #2517 (MongoDB).
`RedisSaver.putWrites` stored each write at the call-local ordinal `idx`
— the key suffix in `checkpoint_write:<thread>:<ns>:<ckpt>:<task>:<idx>`
was just the loop index — and always used unguarded `JSON.SET`, ignoring
`WRITES_IDX_MAP`.

- A follow-up `putWrites([[INTERRUPT, value]], taskId)` for the same
checkpoint computed `idx=0` and collided with the task's first regular
write key; the unconditional `JSON.SET` silently overwrote whichever row
landed there first.
- A mixed call like `[[foo, …], [bar, …], [INTERRUPT, …]]` shifted the
INTERRUPT to idx=2, where a peer task storing a regular write at the
same idx for the same task_id would clobber it.

### Cross-impl parity after this PR

| Checkpointer | `WRITES_IDX_MAP` | Conflict clause |
|---|---|---|
| Memory (TS) | ✅ | gated by `idx >= 0` |
| Postgres (TS) | ✅ | `OR REPLACE` vs `INSERT` based on `all special` |
| SQLite (TS, #2516) | ✅ | `OR REPLACE` vs `OR IGNORE` based on `all
special` |
| MongoDB (TS, #2517) | ✅ | `$set` vs `$setOnInsert` based on `all
special` |
| **Redis (TS, this PR)** | ✅ | `JSON.SET` vs `JSON.SET … NX` based on
`all special` |

### Fix

1. Key suffix now resolves to `WRITES_IDX_MAP[channel] ?? idx`, so ERROR
/ SCHEDULED / INTERRUPT / RESUME land at fixed negative indices that
can't collide with per-step regular writes.
2. The `JSON.SET` call switches between unguarded and the `NX` modifier
depending on whether every write targets a special channel. State
transitions like INTERRUPT → RESUME still overwrite (both special); a
regular write from one task can never silently overwrite another
concurrent task's regular write at the same idx.

### Tests

Mock-based unit test in a new `putWrites.test.ts` (no Redis needed)
captures every `client.json.set` call site and asserts:

- Mixed regular + INTERRUPT batch → key tails `[-3, 0, 1]` (vs the
pre-fix `[0, 1, 2]`) and every JSON.SET carries `{ NX: true }`.
- Special-only batch (RESUME) → key tail `-4` and no NX (so state
transitions can overwrite).

**Reverse-verified**: with the fix reverted both new tests fail.

## AI Disclosure

Identified via cross-implementation review against #2516 and #2517 —
same root cause class, different storage layer.
 2026-06-09 23:05:32 -07:00
Christian Bromann 4096933741 fix(core): add RemoteGraph v3 streaming support (#2444) 
## Summary
- Add `RemoteGraph.streamEvents(..., { version: "v3" })` support backed
by SDK `ThreadStream`.
- Adapt remote v3 streams to the local `GraphRunStream` surface,
including values, messages, lifecycle, output, interrupts, abort, and
SSE encoding.
- Replace external-env RemoteGraph integration coverage with a local
LangGraph API server test.
 2026-06-09 23:03:44 -07:00
Jackjin 67a4f8da58 fix(langgraph-checkpoint-mongodb): honor WRITES_IDX_MAP for special channels in putWrites (#2517) 
## Summary

Follow-up to #2516 (which fixed the same bug for `SqliteSaver`).
`MongoDBSaver.putWrites` stored every write at the call-local ordinal
`idx` and always used `$set`, ignoring `WRITES_IDX_MAP`. So:

- A follow-up `putWrites([[INTERRUPT, value]], taskId)` for the same
checkpoint computed `idx=0` and collided with the task's first regular
write — the unconditional `$set` upsert silently overwrote whichever row
landed there first.
- A mixed call `putWrites([[foo, …], [bar, …], [INTERRUPT, …]], taskId)`
shifted the INTERRUPT to idx=2, where a peer task storing a regular
write at the same idx for the same task_id would clobber it.

The fix mirrors `BaseCheckpointSaver.put_writes` semantics and the
Postgres / SQLite (TS and Python) implementations.

### Cross-impl parity after this PR

| Checkpointer | `WRITES_IDX_MAP` | Conflict clause |
|---|---|---|
| Memory (TS) | ✅ | gated by `idx >= 0` |
| Postgres (TS) | ✅ | `OR REPLACE` vs `INSERT` based on `all special` |
| SQLite (TS, #2516) | ✅ | `OR REPLACE` vs `OR IGNORE` based on `all
special` |
| **MongoDB (TS, this PR)** | ✅ | `$set` vs `$setOnInsert` based on `all
special` |
| Redis (TS) | ❌ | follow-up needed |

### Fix

1. `idx` resolves to `WRITES_IDX_MAP[channel] ?? idx`, so ERROR /
SCHEDULED / INTERRUPT / RESUME land at fixed negative indices that can't
collide with per-step regular writes.
2. The update operator switches between `$set` and `$setOnInsert`
depending on whether every write targets a special channel. State
transitions like INTERRUPT → RESUME still overwrite (both special); a
regular write from one task can never silently overwrite another
concurrent task's regular write at the same idx.

When timestamps are enabled, the `$setOnInsert` path also defers
`upserted_at` to insert-only, so a no-op upsert against a peer task's
existing row doesn't bump that row's "last modified" stamp.

### Tests

Mock-based unit test (no real MongoDB needed) captures `bulkWrite`
operations and asserts:
- Mixed regular + INTERRUPT batch → indices `[-3, 0, 1]` (vs the pre-fix
`[0, 1, 2]`) and every op uses `$setOnInsert`.
- Special-only batch (RESUME) → idx `-4` and uses `$set`.

**Reverse-verified**: with the fix reverted the test fails with
`Received [0, 1, 2]`.

## AI Disclosure

Identified via cross-implementation review against the SQLite fix in
#2516 — same root cause class, separate test surface.
 2026-06-09 22:59:46 -07:00
Christian Bromann 92f77927fb fix(api): fix peer dep range 2026-06-09 22:42:07 -07:00
Christian Bromann 01c67dfa4d fix(core): replay bug, direct to subgraphs (#2179) 
## Summary

Ports Python time-travel fixes
([#7038](https://github.com/langchain-ai/langgraph/pull/7038),
[#7115](https://github.com/langchain-ai/langgraph/pull/7115),
[#7498](https://github.com/langchain-ai/langgraph/pull/7498),
[#7499](https://github.com/langchain-ai/langgraph/pull/7499)) into
`@langchain/langgraph` so replay/fork behave correctly with interrupts
and nested subgraphs.

- **Stale `RESUME` on replay** — Replaying from a checkpoint before an
interrupt no longer consumes cached resume writes; interrupts re-fire
with the correct payload.
- **Subgraph checkpoint loading on time travel** — Introduces
`ReplayState` (`CONFIG_KEY_REPLAY_STATE`) so nested subgraphs load the
checkpoint that existed at the replay point on first visit, then resume
normal head loading within the same run.
- **Parent fork checkpoints on replay** — Time travel runs through
`PregelLoop._first()` (not `stream()` delegation on the parent
`Pregel`), creating an eager `source: "fork"` checkpoint and propagating
`ReplayState` to subgraphs.
- **Direct-to-subgraph time travel** — `getState()` subgraph delegation
is guarded with `CONFIG_KEY_READ`; direct subgraph configs strip stale
`RESUME` writes and prefer explicit `checkpoint_id` over
`checkpoint_map` when both are set.
- **Streaming** — Fixes subgraph interrupt namespace when streaming with
`subgraphs: true` (empty `checkpoint_ns` no longer becomes `[""]`;
parent emits interrupts under the deepest `checkpoint_map` namespace).

Closes #2325 (supersedes the earlier partial port).

### Implementation notes

| Area | Change |
|------|--------|
| `pregel/replay.ts` | New `ReplayState` class (mirrors Python) |
| `pregel/loop.ts` | Replay/time-travel detection, fork creation,
`RESUME` stripping, `ReplayState` wiring, stream namespace helpers |
| `pregel/index.ts` | `getState` subgraph delegation guard only (removed
`stream()` bypass that skipped parent fork creation) |
| Tests | `time_travel.test.ts` (14), `time_travel_extended.test.ts`
(33), shared `time_travel_helpers.ts`, Vitest matchers `toBeInterrupted`
/ `toHaveInterruptValue` |

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-09 22:40:56 -07:00
Christian Bromann a8e7659a9d feat(core): DeltaChannel + writes-history saver API (#2452) 
`DeltaChannel` is a reducer channel that stores only a sentinel in
checkpoint blobs instead of the full accumulated value, reconstructing
state on read by replaying ancestor writes through a batch reducer. This
avoids re-serializing the entire accumulated value at every step (e.g.
long message histories).

- `DeltaChannel(reducer, { snapshotFrequency })` in
`@langchain/langgraph`, count-based snapshot cadence (default
`snapshotFrequency=1000`) plus a system bound
`DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT` (default 5000, env
`LANGGRAPH_DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT`).
- `messagesDeltaReducer` — a batching-invariant messages reducer that
coerces raw object/string writes, for use with `DeltaChannel`.
- `BaseCheckpointSaver.getDeltaChannelHistory({ config, channels })`
(beta), walks the parent chain returning per-channel `{ writes, seed?
}`, with a direct-storage override in `MemorySaver`.
- `counters_since_delta_snapshot` added to `CheckpointMetadata`;
`DeltaSnapshot` serialization support in the JSON+ serializer.

Reconstruction is wired through the Pregel read/execution paths
(initialization, `getState`, `updateState`, local reads) and `exit`
durability accumulates and anchors delta writes so threads remain
reconstructible without forcing snapshots.
 2026-06-09 22:12:09 -07:00
Christian Bromann d12d269330 feat(langgraph): cooperative graph drain via RunControl (#2449) 
## Summary

Ports Python PR
[langchain-ai/langgraph#7274](https://github.com/langchain-ai/langgraph/pull/7274)
("allow graph to graceful shutdown/drain by request") to LangGraphJS.
Adds cooperative, between-superstep draining so a run can be asked to
stop at the next superstep boundary, persist its checkpoint, and surface
a resumable terminal error.

This is the JS PR for the **Graph draining / graceful shutdown** parity
unit.

## What's added

- **`RunControl`** (new `pregel/runtime.ts`, exported from
`@langchain/langgraph`): a run-scoped handle with `requestDrain(reason =
"shutdown")` and read-only `drainRequested` / `drainReason`.
- **`GraphDrained`** (`errors.ts`): a `GraphBubbleUp` subclass carrying
`reason`, thrown when a run exits early due to drain. Plus an
`isGraphDrained` guard.
- **`control` option** on `invoke` / `stream` / `streamEvents` /
`invoke`'s functional-API equivalents. It is surfaced on
`runtime.control` (nodes can read it or call `requestDrain()`), and
propagated into subgraphs. A fresh `RunControl` is provided per run when
none is passed.

## Semantics (cooperative, between-superstep)

`requestDrain()` flips a flag. The Pregel loop checks it at the top of
each `tick()`, **after** the previous superstep's writes have been
applied and checkpointed and the next tasks have been prepared. It never
preempts work that is already running.

| Scenario | Behavior |
|---|---|
| Node mid-execution | Runs to completion; drain takes effect at the
next superstep. |
| Graph naturally finishes on the same tick where drain was requested |
Returns normally (status `done`). No `GraphDrained`. Caller can inspect
`control.drainRequested`. |
| More tasks remain | Saves the last completed superstep's checkpoint
(also under `durability: "exit"`) and throws `GraphDrained(reason)`.
Resume with `invoke(null, config)`. |
| Subgraph requests drain | `GraphDrained` bubbles up through the parent
loop and stops it at its own next boundary; the parent's checkpoint is
saved and resumable. |

Draining does **not** cancel async work. Pair it with an `AbortSignal`
if you need a hard upper bound (see the `drain then cancel after a
graceful timeout` test).

## Files

- `errors.ts` — `GraphDrained` + `isGraphDrained`
- `pregel/runtime.ts` — `RunControl`
- `pregel/runnable_types.ts` — `control?: RunControl` on `Runtime`
- `pregel/types.ts` — `control` on `PregelOptions`
- `pregel/utils/config.ts`, `constants.ts` — config-key wiring
- `pregel/loop.ts` — `"draining"` status + drain check at the tick
boundary
- `pregel/index.ts` — option wiring + raising `GraphDrained`
- `pregel/runner.ts` — subgraph drain bubble-up handling

## Tests

`libs/langgraph-core/src/tests/run_control.test.ts` (14 tests, all sync
+ async where applicable):
drain stops the next step (sync/async), terminal-step drain finishes
normally, exit- and default-durability resume, pre-drained control,
subgraph → parent bubble + resume, external concurrent drain,
drain-then-cancel via `AbortSignal`, reading/`requestDrain()` via
`runtime.control`, `stream()` accepts control, and functional-API
in-flight `task` futures still resolve. Full package suite passes (1358
+ 14, 0 failures); lint and format are clean.

## Notable divergence from Python

Python added `"drained"` to a local `SubgraphStatus` literal. The JS v3
stream lifecycle uses `AgentStatus` from the external
`@langchain/protocol` package, which has no `"drained"` member, so
`GraphDrained` propagates through streams as the terminal error rather
than as a new lifecycle status. The parity-relevant signal — the
`GraphDrained` exception — is what consumers catch. Noted in the
changeset.

## Source

- Python PR: https://github.com/langchain-ai/langgraph/pull/7274
- Parity plan section: Graph draining / graceful shutdown
 2026-06-09 21:53:30 -07:00
Christian Bromann d65a9209d7 feat(langgraph): add node-level error handlers (#2451) 
`StateGraph.addNode(name, fn, { errorHandler })` now accepts a
first-class node-level error handler. The handler runs ONLY after the
failing node's `retryPolicy` is exhausted, so retry and handling stay
decoupled. It receives a typed `NodeError { node, error }`, can return a
state update, and can route to a recovery branch via `new Command({ goto
})` (saga / compensation flows).

Failure provenance is checkpointed (via a reserved `ERROR_SOURCE_NODE`
write) so handlers observe the same context after a checkpoint resume.
Uncaught node errors without a handler still abort the run as before,
and `GraphBubbleUp` errors (such as `interrupt()`) are never swallowed
by a handler.

Ports the Python feature from langchain-ai/langgraph#7233.
 2026-06-09 21:52:45 -07:00
Christian Bromann 2f6d87368e feat(langgraph): add node-level timeouts (timeout on addNode, task, entrypoint, Send) (#2450) 
A `timeout` option is now supported on `StateGraph.addNode`, the
functional API (`task`/`entrypoint`), and the `Send` constructor. Pass a
number of milliseconds for a hard wall-clock cap, or a `TimeoutPolicy`
for finer control:

```ts
import { TimeoutPolicy } from "@langchain/langgraph";

// hard wall-clock cap on each attempt
builder.addNode("agent", agentFn, { timeout: 60_000 });

// full control
builder.addNode("agent", agentFn, {
  timeout: {
    runTimeout: 60_000, // hard wall-clock cap, never refreshed
    idleTimeout: 10_000, // cap on time without observable progress
    refreshOn: "auto", // "auto" | "heartbeat"
  },
});

// per-task override
new Send("agent", state, { idleTimeout: 5_000 });
```

When a timeout fires, a `NodeTimeoutError` (carrying `node`, `kind`
(`"run"`/`"idle"`), `timeout`, `elapsed`, `runTimeout`, `idleTimeout`)
is raised, the attempt's buffered writes are dropped, and the node's
`AbortSignal` is aborted. `idleTimeout` is refreshed by observable
progress (writes, custom stream-writer calls, child-task scheduling,
callback events) or an explicit `runtime.heartbeat()` call. The timer
resets per retry attempt, and `NodeTimeoutError` is retryable under the
default retry policy.

Ports langchain-ai/langgraph `#7599`, `#7646`, and `#7659`.
 2026-06-09 20:50:22 -07:00
Jackjin f6a6d26b7e fix(langgraph-checkpoint-sqlite): honor WRITES_IDX_MAP for special channels in putWrites (#2516) 
## Summary

`SqliteSaver.putWrites` stored every write at the call-local ordinal
`idx`, ignoring `WRITES_IDX_MAP`. So when an `INTERRUPT` (or `ERROR` /
`SCHEDULED` / `RESUME`) followed a regular write for the same task, both
landed at `idx=0` and the table PK `(thread_id, checkpoint_ns,
checkpoint_id, task_id, idx)` collided — `INSERT OR REPLACE` silently
dropped the regular write.

Other checkpointer implementations (Memory in `libs/checkpoint`,
Postgres) and the **Python** SQLite checkpointer
(`langgraph/checkpoint/sqlite/__init__.py`) all pin special channels to
fixed negative indices via `WRITES_IDX_MAP` so they can't collide with
per-step regular writes.

### Cross-impl parity before this PR

| Checkpointer | `WRITES_IDX_MAP` | Conflict clause |
|---|---|---|
| Memory (TS) | ✅ | gated by `idx >= 0` |
| Postgres (TS) | ✅ | `OR REPLACE` vs `INSERT` based on `all special` |
| Python SQLite | ✅ | `OR REPLACE` vs `OR IGNORE` based on `all special`
|
| **TS SQLite** | ❌ | always `OR REPLACE` |

### Fix

1. `idx` resolves to `WRITES_IDX_MAP[channel] ?? idx`.
2. Statement switches between `INSERT OR REPLACE` and `INSERT OR IGNORE`
depending on whether every write targets a special channel, matching
`langgraph/checkpoint/sqlite/__init__.py`. INTERRUPT→RESUME state
transitions overwrite (both special); concurrent tasks can't clobber
each other's regular writes at the same idx.

### Tests

New regression test interleaves regular and special-channel writes
across two tasks (`task_A` does regular writes → INTERRUPT → RESUME,
`task_B` does a regular write). All five logical writes survive
`getTuple().pendingWrites`.

**Reverse-verified**: without the fix, `task_A:foo` and
`task_A:__interrupt__` both disappear from the round-trip — the test
fails with `Set { task_A:__resume__, task_A:bar, task_B:baz }`.

## AI Disclosure

This bug was identified via cross-implementation review against the
Python SQLite checkpointer and TS `MemorySaver` / `PostgresSaver`, with
AI assistance. The fix mirrors the Python reference implementation.
 2026-06-09 20:31:08 -07:00
Christian Bromann 49b8c1a04c fix: make AnyStream a true supertype so selector hooks need no cast (#2515) 
## Summary
- `AnyStream` (`UseStreamReturn<any, any, any>`) was not actually a
supertype of concrete stream handles: members computed from the generics
in covariant positions don't collapse under `any`. `toolCalls` resolves
via `InferToolCalls<any>` to `AssembledToolCall<string, …, never>[]`,
whose `never` output slot is narrower than a concrete handle's
`unknown`, so `UseStreamReturn<typeof agent>` failed to assign and every
`useMessages`/`useToolCalls`/`useValues` (`inject*` on Angular) call
required an `as AnyStream` cast.
- Redefined `AnyStream` in all four framework packages to `Omit` the
generic-computed members and re-add them at their widest forms,
preserving each framework's reactivity wrapper: plain arrays for
React/Svelte, `Readonly<ShallowRef<…>>` for Vue, `Signal<…>` for
Angular. React also drops `~stateType` (the only package that has that
member).
- Retyped each package's internal `getRegistry` to accept `AnyStream`,
removed React's duplicate local `AnyStream` in `selectors.ts` in favor
of the public type, and corrected the misleading doc comments.
- Downstream (`langchainplus` agent-chat-v2) can drop its `stream as
AnyStream` casts once these ship.
 2026-06-09 20:27:08 -07:00
Christian Bromann 801d955d39 feat(langgraph): add StateGraph.setNodeDefaults() for graph-wide node policy defaults (#2461) 
## Summary
- Add `StateGraph.setNodeDefaults({ retryPolicy?, cachePolicy? })` for
graph-wide node policy defaults, resolved at `compile()` so call order
does not matter; per-node `addNode` options always take precedence.
- Defaults are not inherited by subgraphs (parity with Python #7747).
- Consolidate duplicate `retryPolicy` / `cachePolicy` fields into
exported `NodePolicyOptions` with shared TSDoc; `NodeDefaults` and
`StateGraphAddNodeOptions` both use it; internal specs use
`ResolvedNodePolicies` after boolean `cachePolicy` normalization.
 2026-06-09 18:43:31 -07:00
Christian Bromann 9b96f60af6 perf(core): gate debug checkpoint snapshots on stream mode (#2471) 
## Summary
- Skip building full-state `mapDebugCheckpoint` payloads on every tick
unless the stream subscribes to `checkpoints` or `debug`.
- Gate `mapDebugTasks` the same way for `tasks` or `debug`, including
dynamically pushed tasks in `acceptPush`.
- v3 `streamEvents` companion `checkpoints` events are unchanged; they
are derived from values metadata, not `mapDebugCheckpoint`.

This change only skips building full-state mapDebugCheckpoint / pre-run
mapDebugTasks payloads when the stream is not subscribed to checkpoints,
tasks, or debug. Execution, checkpoint persistence, and emitted chunks
for a given streamMode are unchanged, `_emit` already dropped those
events for other modes, so this removes wasted work rather than altering
behavior.

v3 streamEvents companion checkpoints envelopes are unaffected; they
come from values metadata via `_emitValuesWithCheckpointMeta`, not from
`mapDebugCheckpoint`. Subscribers to checkpoints, tasks, or debug still
receive the same debug snapshots as before.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-09 18:01:36 -07:00
Christian Bromann 8e06ace95c perf(core): index pending writes for O(1) task-prep lookups (#2472) 
## Summary
- Add `PendingWritesIndex` built once in `_prepareNextTasks` with maps
for null resume, per-task resume values, and task IDs with successful
writes.
- Use the index in `_scratchpad` and PULL early-exit checks instead of
repeated `find`/`filter`/`some` over `pendingWrites`.
- Preserve linear-scan fallbacks when `_prepareSingleTask` is invoked
without a pre-built index.

This is a performance-only change: task preparation and resume behavior
are unchanged.
 2026-06-09 17:20:37 -07:00