mirror of
https://github.com/langchain-ai/langgraphjs.git
synced 2026-07-21 16:45:24 -04:00
@langchain/langgraph@1.4.6
3008 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 github-actions[bot]
|
86389fa3a6 |
chore: version packages (#2567)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint@1.1.3 ### Patch Changes - [#2566](https://github.com/langchain-ai/langgraphjs/pull/2566) [`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-checkpoint-postgres): prevent createAgent failures with PostgresSaver Add BaseCheckpointSaver.toJSON() so ConfigurableModel can stringify runnable config without traversing pg Pool timers, and default missing checkpoint maps on load/copy so resume no longer crashes on undefined versions_seen. Closes [#1808](https://github.com/langchain-ai/langgraphjs/issues/1808). ## @langchain/langgraph-checkpoint-postgres@1.0.4 ### Patch Changes - [#2566](https://github.com/langchain-ai/langgraphjs/pull/2566) [`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-checkpoint-postgres): prevent createAgent failures with PostgresSaver Add BaseCheckpointSaver.toJSON() so ConfigurableModel can stringify runnable config without traversing pg Pool timers, and default missing checkpoint maps on load/copy so resume no longer crashes on undefined versions_seen. Closes [#1808](https://github.com/langchain-ai/langgraphjs/issues/1808). ## @langchain/langgraph-api@1.4.1 ### Patch Changes - [#2568](https://github.com/langchain-ai/langgraphjs/pull/2568) [`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-api): support configurable TypeScript loaders in dev server Add `node_loader` to `langgraph.json` (and `LANGGRAPH_NODE_LOADER` env override) so projects using reflect-metadata can use `ts-node` (`--loader ts-node/esm`) instead of the default tsx CLI. Other loaders default to `--import`; only registered shorthands like `ts-node` use `--loader`. `--no-reload` now also disables tsx's internal watch mode. Closes [#1834](https://github.com/langchain-ai/langgraphjs/issues/1834). - Updated dependencies \[]: - @langchain/langgraph-ui@1.4.1 ## @langchain/langgraph-cli@1.4.1 ### Patch Changes - [#2568](https://github.com/langchain-ai/langgraphjs/pull/2568) [`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-api): support configurable TypeScript loaders in dev server Add `node_loader` to `langgraph.json` (and `LANGGRAPH_NODE_LOADER` env override) so projects using reflect-metadata can use `ts-node` (`--loader ts-node/esm`) instead of the default tsx CLI. Other loaders default to `--import`; only registered shorthands like `ts-node` use `--loader`. `--no-reload` now also disables tsx's internal watch mode. Closes [#1834](https://github.com/langchain-ai/langgraphjs/issues/1834). - Updated dependencies \[[`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc)]: - @langchain/langgraph-api@1.4.1 ## @langchain/langgraph@1.4.6 ### Patch Changes - [`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): emit valid UUIDs for exit-mode delta task_ids Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that produced a 6-segment string Postgres rejects for `checkpoint_writes.task_id uuid` in LangGraph API. Embed the superstep in the first UUID group instead, matching langchain-ai/langgraph#8165. - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457), [`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4)]: - @langchain/langgraph-sdk@1.9.25 - @langchain/langgraph-checkpoint@1.1.3 ## @langchain/langgraph-sdk@1.9.25 ### Patch Changes - [#2565](https://github.com/langchain-ai/langgraphjs/pull/2565) [`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): bundle pure-ESM deps into CJS build to fix ERR_REQUIRE_ESM Bundle the pure-ESM dependencies `p-retry` and `p-queue` (and their transitive ESM-only deps) into the build output so the CJS artifact no longer does a top-level `require()` of an ESM module. This fixes `ERR_REQUIRE_ESM` for CommonJS consumers on Node versions where `require(ESM)` is not enabled by default (< 20.19 / < 22.12). Closes [#2562](https://github.com/langchain-ai/langgraphjs/issues/2562). ## @langchain/angular@1.0.26 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]: - @langchain/langgraph-sdk@1.9.25 ## @langchain/react@1.0.26 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]: - @langchain/langgraph-sdk@1.9.25 ## @langchain/svelte@1.0.26 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]: - @langchain/langgraph-sdk@1.9.25 ## @langchain/vue@1.0.26 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]: - @langchain/langgraph-sdk@1.9.25 ## @langchain/langgraph-ui@1.4.1 ## @example/ai-elements@0.1.42 ### Patch Changes - Updated dependencies \[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph@1.4.6 - @langchain/react@1.0.26 ## @examples/assistant-ui-claude@0.1.42 ### Patch Changes - Updated dependencies \[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph@1.4.6 - @langchain/react@1.0.26 ## @examples/ui-angular@0.0.52 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457), [`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph-sdk@1.9.25 - @langchain/langgraph@1.4.6 - @langchain/angular@1.0.26 ## @examples/ui-multimodal@0.0.28 ### Patch Changes - Updated dependencies \[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph@1.4.6 - @langchain/react@1.0.26 ## @examples/ui-react@0.0.28 ### Patch Changes - Updated dependencies \[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457), [`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph-sdk@1.9.25 - @langchain/langgraph@1.4.6 - @langchain/react@1.0.26 ## langgraph@1.0.46 ### Patch Changes - Updated dependencies \[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]: - @langchain/langgraph@1.4.6 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.26 @langchain/langgraph-api@1.4.1 @langchain/langgraph-checkpoint-postgres@1.0.4 @langchain/langgraph-checkpoint@1.1.3 @langchain/langgraph-cli@1.4.1 @langchain/langgraph-sdk@1.9.25 @langchain/langgraph-ui@1.4.1 @langchain/langgraph@1.4.6 @langchain/react@1.0.26 @langchain/svelte@1.0.26 @langchain/vue@1.0.26 |
||
|
Christian Bromann
|
03a0d8b863 |
fix(langgraph): emit valid UUIDs for exit-mode delta task_ids
Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed the superstep in the first UUID group instead, matching langgraph#8165. |
||
|
Christian Bromann
|
38d15e2f1f |
fix(langgraph-api): support configurable TypeScript loaders in dev server (#2568)
## Summary - Add configurable TypeScript loader support for the in-memory dev server to fix reflect-metadata / `emitDecoratorMetadata` incompatibility with tsx (esbuild). - Introduce `node_loader` on Node `langgraph.json` configs and `LANGGRAPH_NODE_LOADER` env override; default remains `tsx` CLI watch mode. - Generalize non-tsx loaders to `node [--watch] --import <loader> --import preload entrypoint`, with shorthand mapping for `ts-node` → `ts-node/esm`. - Add `spawn-args` helper + unit tests; add `ts-node` as optional peer dependency of `@langchain/langgraph-api`. Fixes #1834 |
||
|
Christian Bromann
|
091a46f32d |
fix(langgraph-checkpoint-postgres): prevent createAgent failures with PostgresSaver (#2566)
## Summary
- Add `BaseCheckpointSaver.toJSON()` so runnable
`configurable.__pregel_checkpointer` can be JSON-stringified without
traversing backend clients (fixes the circular `Timeout` error when
using `createAgent` with `PostgresSaver`).
- Harden `copyCheckpoint()` and `PostgresSaver._loadCheckpoint()` to
default missing `channel_versions` and `versions_seen` to `{}`, fixing
resume crashes on `__input__` after a failed first run.
- Add unit and integration tests covering stringify safety and missing
`versions_seen` recovery.
Fixes #1808
|
||
|
Christian Bromann
|
0558e472b7 |
fix(sdk): bundle pure-ESM deps into CJS build to fix ERR_REQUIRE_ESM (#2565)
## Summary - Fix `ERR_REQUIRE_ESM` in `@langchain/langgraph-sdk` for CommonJS consumers on Node < 20.19 / < 22.12: the CJS build no longer does a top-level `require()` of the pure-ESM `p-retry`/`p-queue`. They (and their transitive ESM-only deps) are now bundled and transpiled into relative CJS chunks. - Add per-package build overrides via an optional `tsdown.config.ts`, mirroring the langchainjs convention. `internal/build` discovers and merges it (`config: false` disables tsdown's own discovery so the config's imports resolve from the package dir), and re-exports `defineConfig` from `@langchain/build` so packages get type-safe configs without depending on `tsdown` directly. - Remove the leftover `libs/checkpoint-redis/langchain.config.js` (from the old `@langchain/scripts` build) — it was the only package still carrying one and the current tsdown build ignores it. Fixes #2562 |
||
|
Christian Bromann
|
379bfd9a7d |
test(langgraph-checkpoint-validation): cover channel carry-over reconstruction across checkpoints
Add a getTuple conformance test reproducing #2555: a node that updates only a subset of channels must not drop the channels it left untouched. Delta-storing savers (Postgres, Redis) persist only the channels in `newVersions` on each `put`, so on read they must reconstruct the carried-over channels from blobs written by ancestor checkpoints. The existing getTuple spec only re-wrote the same channel in the child checkpoint, so it never exercised carry-over reconstruction — which is how the Redis saver shipped 1.0.9 without it (fixed in 1.0.10, #2336). The new test runs against every saver and fails on the buggy behavior (returns `{ stepCount }` instead of `{ messages, stepCount }`). |
||
|
github-actions[bot]
|
31261c3be5 |
chore: version packages (#2558)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint-mongodb@1.4.0 ### Minor Changes - [#1928](https://github.com/langchain-ai/langgraphjs/pull/1928) [`3d7fcea`](https://github.com/langchain-ai/langgraphjs/commit/3d7fcea7d7ea7f1203d24be9df607d5a8e8717bc) Thanks [@Mihailoff](https://github.com/Mihailoff)! - Add TTL support for automatic checkpoint expiration - Add optional `ttl` parameter to MongoDBSaver (value in seconds) - Add `setup()` method to create TTL indexes on collections - Add `upserted_at` timestamp to documents when TTL is enabled - Each write refreshes TTL (expires after inactivity, not creation) ### Patch Changes - [#2556](https://github.com/langchain-ai/langgraphjs/pull/2556) [`bee3c91`](https://github.com/langchain-ai/langgraphjs/commit/bee3c91d0adc315ebde0622d8c4b1fff041c1bfd) Thanks [@mohamedkhaled4053](https://github.com/mohamedkhaled4053)! - Fix `MongoDBSaver.putWrites` throwing `MongoServerError: Invalid BulkOperation, Batch cannot be empty` when called with an empty `writes` array. This is reached by human-in-the-loop / `interrupt()` flows, where a task can complete producing zero channel writes and LangGraph calls `putWrites(config, [], taskId)`. `putWrites` now no-ops on empty writes, matching the behavior of the postgres and sqlite savers (which iterate and naturally skip empty batches). - [#2550](https://github.com/langchain-ai/langgraphjs/pull/2550) [`2b8cc2f`](https://github.com/langchain-ai/langgraphjs/commit/2b8cc2f3fd5c9d3c33b56e013292daf5d936428e) Thanks [@lazydiv](https://github.com/lazydiv)! - feat(checkpoint-mongodb): add setup() to create required indexes ## @langchain/langgraph-api@1.4.0 ### Minor Changes - [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559) [`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(langgraph-cli): add `deploy` command for LangSmith Deployment Port the Python CLI's `langgraph deploy` workflow to `@langchain/langgraph-cli`, including local and remote build paths, deployment lifecycle subcommands (`list`, `revisions list`, `delete`, `logs`), and host-backend client utilities with tests. ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph-api): preserve non-empty response_metadata on protocol-v2 state messages The protocol-v2 state normalizer stripped `response_metadata` from messages, dropping data that HITL flows rely on — an interrupt's card is carried on `AIMessage.response_metadata` (e.g. `{ cards: ... }`). Non-empty `response_metadata` is now retained so the card reaches the client. - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206)]: - @langchain/langgraph-ui@1.4.0 ## @langchain/langgraph-cli@1.4.0 ### Minor Changes - [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559) [`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(langgraph-cli): add `deploy` command for LangSmith Deployment Port the Python CLI's `langgraph deploy` workflow to `@langchain/langgraph-cli`, including local and remote build paths, deployment lifecycle subcommands (`list`, `revisions list`, `delete`, `logs`), and host-backend client utilities with tests. ### Patch Changes - Updated dependencies \[[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206), [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e), [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-api@1.4.0 ## @langchain/langgraph-ui@1.4.0 ### Minor Changes - [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559) [`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(langgraph-cli): add `deploy` command for LangSmith Deployment Port the Python CLI's `langgraph deploy` workflow to `@langchain/langgraph-cli`, including local and remote build paths, deployment lifecycle subcommands (`list`, `revisions list`, `delete`, `logs`), and host-backend client utilities with tests. ## @langchain/langgraph@1.4.5 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 ## @langchain/langgraph-sdk@1.9.24 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. ## @langchain/angular@1.0.25 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 ## @langchain/react@1.0.25 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 ## @langchain/svelte@1.0.25 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 ## @langchain/vue@1.0.25 ### Patch Changes - [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557) [`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): apply state update and goto alongside interrupt resume `respond(decision, { update, goto })` now maps to LangGraph's `Command(resume, update, goto)`, so a human-in-the-loop UI can commit a state update (e.g. push the interrupt card into state) in the **same superstep** as the resume — one checkpoint, no separate `updateState` write, no flicker. `@langchain/langgraph-api` forwards `update`/`goto` through `input.respond`, and `@langchain/core` message instances in `update` are serialized to dicts before transport, exactly like `submit()`. Bumps `@langchain/protocol` to `^0.0.18` for the `Goto` type. `respond`/`respondAll` also apply `update` **optimistically** (mirroring `submit()`): the pushed messages paint immediately, with stable ids minted so the resumed run's echo reconciles them in place. Without this the interrupt is cleared the instant `respond()` dispatches while the pushed card only reappears a server round-trip later — so the card would flicker in that gap. The optimistic state settles on the resumed run's terminal (pending → sent, or rolled back on a failure before any echo). User-initiated optimistic writes (`submit()` / `respond()` / `respondAll()`) now commit to the store **synchronously**, in the same tick as the triggering event, instead of being coalesced onto the next macrotask. This lets a framework render the pushed message in the **same commit** as any local UI state the caller flips alongside it (e.g. a HITL form swapping its inputs for the resolved card), so the card no longer blinks out for the one-macrotask window before the flush lands. High-frequency streaming writes keep their macrotask coalescing. - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 ## @example/ai-elements@0.1.41 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/react@1.0.25 - @langchain/langgraph@1.4.5 ## @examples/assistant-ui-claude@0.1.41 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/react@1.0.25 - @langchain/langgraph@1.4.5 ## @examples/ui-angular@0.0.51 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 - @langchain/angular@1.0.25 - @langchain/langgraph@1.4.5 ## @examples/ui-multimodal@0.0.27 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/react@1.0.25 - @langchain/langgraph@1.4.5 ## @examples/ui-react@0.0.27 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph-sdk@1.9.24 - @langchain/react@1.0.25 - @langchain/langgraph@1.4.5 ## langgraph@1.0.45 ### Patch Changes - Updated dependencies \[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]: - @langchain/langgraph@1.4.5 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.25 @langchain/langgraph-api@1.4.0 @langchain/langgraph-checkpoint-mongodb@1.4.0 @langchain/langgraph-cli@1.4.0 @langchain/langgraph-sdk@1.9.24 @langchain/langgraph-ui@1.4.0 @langchain/langgraph@1.4.5 @langchain/react@1.0.25 @langchain/svelte@1.0.25 @langchain/vue@1.0.25 |
||
|
Christian Bromann
|
5d279df5d5 |
chore(deps): bump langchain (#2564)
Bump langchainjs to latest release. --------- Signed-off-by: Christian Bromann <git@bromann.dev> Co-authored-by: open-swe[bot] <215916821+open-swe[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
48cbdd23fd |
feat(langgraph-cli): add deploy command for LangSmith Deployment (#2559)
## Summary - Add `langgraphjs deploy` to `@langchain/langgraph-cli`, porting the Python CLI's LangSmith Deployment workflow for JS projects. - Support local Docker build/push and remote source-archive upload paths, plus `deploy list`, `deploy revisions list`, `deploy delete`, and `deploy logs`. - Introduce host-backend client, archive/ignore/output helpers, and unit tests; wire the command into the CLI entrypoint and add the `ignore` dependency. Test on our deployment cookbook: ``` pnpm run deploy > js-langsmith@0.1.0 deploy /Users/christian.bromann/Sites/LangChain/deployment-cookbook/js-langsmith > langgraphjs deploy Note: 'langgraphjs deploy' is in beta. Expect frequent updates and improvements. Skipping reserved env var: LANGSMITH_API_KEY Skipping reserved env var: LANGSMITH_TENANT_ID Docker is installed but not running. Start Docker and try again. Using remote build instead. 1. Looking up deployment 'deployment-cookbook-agent' No deployment found. Will create. 2. Creating deployment 'deployment-cookbook-agent' Deployment ID: fc41ac21-0251-4caf-9f6b-e8e381520e59 3. Creating source archive Archive created (0.1 MB) 4. Requesting upload URL 5. Uploading source Uploading (0.1 MB)... 100% 6. Triggering remote build View status: https://smith.langchain.com/o/d7ca4f49-e65f-4c96-8d03-e1d713acb728/host/deployments/fc41ac21-0251-4caf-9f6b-e8e381520e59 QUEUED... (9s) AWAITING_BUILD... (18s) BUILDING... (3m 13s) AWAITING_DEPLOY... (3m 32s) DEPLOYING... (4m 50s) Deployment successful! URL: https://deployment-cookbook-agent-3569d4ef8d405f40850d56230f67258b.us.langgraph.app View status: https://smith.langchain.com/o/d7ca4f49-e65f-4c96-8d03-e1d713acb728/host/deployments/fc41ac21-0251-4caf-9f6b-e8e381520e59 ``` |
||
|
lazyDev
|
2b8cc2f3fd |
feat(checkpoint): add setup() to create required MongoDB indexes (#2550)
## Summary Fixes #2551 `MongoDBSaver` queries `checkpoints` and `checkpoint_writes` collections by `thread_id`, `checkpoint_ns`, and `checkpoint_id`, but never creates indexes on these fields. As the collections grow, every `getTuple()`, `list()`, and `putWrites()` call triggers a **full collection scan**. In production with ~450K checkpoints and ~570K checkpoint_writes, this caused: - `getState` taking **5-10 seconds** per request (scanning all 450K docs each time) - Total API response times of **30-40 seconds** instead of **3 seconds** ### Changes - Adds a `setup()` method to `MongoDBSaver` that creates a compound index `{ thread_id: 1, checkpoint_ns: 1, checkpoint_id: -1 }` on both collections - The method is idempotent (`createIndex` is a no-op when the index already exists), safe to call on every app start - Follows the same pattern as `MongoDBStore.start()` which already creates indexes ### Before / After (production, 450K checkpoints) | Metric | Before | After | |---|---|---| | Docs examined per query | 445,801 | 1 | | `checkpoints` query | 5,173ms | <10ms | | `checkpoint_writes` query | 925ms | <10ms | ### Test plan - [x] Unit test added verifying `setup()` creates indexes on both collections with correct key spec - [x] Existing integration tests pass --------- Signed-off-by: Christian Bromann <git@bromann.dev> Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
dependabot[bot]
|
617cac92a4 |
chore(deps-dev): bump typeorm from 0.3.28 to 0.3.29 (#2563)
Bumps [typeorm](https://github.com/typeorm/typeorm) from 0.3.28 to 0.3.29. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typeorm/typeorm/releases">typeorm's releases</a>.</em></p> <blockquote> <h2>0.3.29</h2> <h2>What's Changed</h2> <ul> <li>fix: fix up aggregate methods ambiguous column by <a href="https://github.com/Cprakhar"><code>@Cprakhar</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11822">typeorm/typeorm#11822</a></li> <li>fix: prevent eager-loaded entities from overwriting manual relations by <a href="https://github.com/LeviHeber"><code>@LeviHeber</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11267">typeorm/typeorm#11267</a></li> <li>fix: release query runner when there is no migration to revert by <a href="https://github.com/mjr128"><code>@mjr128</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11232">typeorm/typeorm#11232</a></li> <li>fix: add async to the method using setFindOptions() by <a href="https://github.com/bindon"><code>@bindon</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/10787">typeorm/typeorm#10787</a></li> <li>chore: disable eslint errors for chai assertions by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11833">typeorm/typeorm#11833</a></li> <li>ci(tests): Remove limitation of branches to run on by <a href="https://github.com/OSA413"><code>@OSA413</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11794">typeorm/typeorm#11794</a></li> <li>ci: upgrade actions to v6 by <a href="https://github.com/pkuczynski"><code>@pkuczynski</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11844">typeorm/typeorm#11844</a></li> <li>docs(v0.3): add version dropdown (stable/dev) by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11863">typeorm/typeorm#11863</a></li> <li>fix(sap): <code>QueryBuilder</code> parameter of type JS <code>Date</code> not escaped correctly by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11867">typeorm/typeorm#11867</a></li> <li>feat(sap): add pool timeout by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11868">typeorm/typeorm#11868</a></li> <li>feat(qodo): enable new review experience in v0.3 by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11910">typeorm/typeorm#11910</a></li> <li>feat: add <code>returning</code> option to update/upsert operations by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11782">typeorm/typeorm#11782</a></li> <li>test: enable repository-returning test by <a href="https://github.com/gioboa"><code>@gioboa</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11913">typeorm/typeorm#11913</a></li> <li>chore(qodo): disable in progress notification in v0.3 by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11928">typeorm/typeorm#11928</a></li> <li>ci(docs): add deploy Github Action to v0.3 branch by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11929">typeorm/typeorm#11929</a></li> <li>chore(qodo): disable persistent comments and inline code suggestions in v0.3 by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11989">typeorm/typeorm#11989</a></li> <li>chore(deps): update all dependencies to the latest minor version by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12015">typeorm/typeorm#12015</a></li> <li>fix(redis): redis cache version detection by <a href="https://github.com/mguida22"><code>@mguida22</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/11936">typeorm/typeorm#11936</a></li> <li>ci: remove summary comments location policy by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12117">typeorm/typeorm#12117</a></li> <li>ci(qodo): remove /improve from pr and push commands by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12129">typeorm/typeorm#12129</a></li> <li>ci: migrate from npm to pnpm by <a href="https://github.com/pkuczynski"><code>@pkuczynski</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12193">typeorm/typeorm#12193</a></li> <li>ci(qodo): sync qodo pr agent config from master by <a href="https://github.com/naorpeled"><code>@naorpeled</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12265">typeorm/typeorm#12265</a></li> <li>ci: remove docs indexing by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12435">typeorm/typeorm#12435</a></li> <li>fix(security): validate limit() in Update/SoftDelete query builders by <a href="https://github.com/smith-xyz"><code>@smith-xyz</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12437">typeorm/typeorm#12437</a></li> <li>chore(deps): update all minor by <a href="https://github.com/alumni"><code>@alumni</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12443">typeorm/typeorm#12443</a></li> <li>chore(release): release 0.3.29 by <a href="https://github.com/michaelbromley"><code>@michaelbromley</code></a> in <a href="https://redirect.github.com/typeorm/typeorm/pull/12442">typeorm/typeorm#12442</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/LeviHeber"><code>@LeviHeber</code></a> made their first contribution in <a href="https://redirect.github.com/typeorm/typeorm/pull/11267">typeorm/typeorm#11267</a></li> <li><a href="https://github.com/mjr128"><code>@mjr128</code></a> made their first contribution in <a href="https://redirect.github.com/typeorm/typeorm/pull/11232">typeorm/typeorm#11232</a></li> <li><a href="https://github.com/bindon"><code>@bindon</code></a> made their first contribution in <a href="https://redirect.github.com/typeorm/typeorm/pull/10787">typeorm/typeorm#10787</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md">typeorm's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">0.3.29</a> (2026-05-08)</h2> <h3>Bug Fixes</h3> <ul> <li>add async to the method using setFindOptions() (<a href="https://redirect.github.com/typeorm/typeorm/issues/10787">#10787</a>) (<a href="https://github.com/typeorm/typeorm/commit/cc07c90f1de51bd31c0c450fae3a200f355c37f1">cc07c90</a>)</li> <li>change import for process dependency (<a href="https://redirect.github.com/typeorm/typeorm/issues/11248">#11248</a>) (<a href="https://github.com/typeorm/typeorm/commit/1c67c3b02632c92cac33f5cfd6895a92e93571d8">1c67c3b</a>)</li> <li><strong>cli:</strong> init command loading non-existing package.json (<a href="https://redirect.github.com/typeorm/typeorm/issues/11947">#11947</a>) (<a href="https://github.com/typeorm/typeorm/commit/4d9d1a61c68ecc9b8161abbd59594e69fe052a80">4d9d1a6</a>)</li> <li>fix up aggregate methods ambiguous column (<a href="https://redirect.github.com/typeorm/typeorm/issues/11822">#11822</a>) (<a href="https://github.com/typeorm/typeorm/commit/6e34756b9d6cc8b7b96cfeab869483ef62b2a7e6">6e34756</a>)</li> <li>fix up limit with joins (<a href="https://redirect.github.com/typeorm/typeorm/issues/11987">#11987</a>) (<a href="https://github.com/typeorm/typeorm/commit/3657db86b9c26cd3fcb839279ad0e2f2165305fa">3657db8</a>)</li> <li>getPendingMigrations unnecessarily creating migrations table (<a href="https://redirect.github.com/typeorm/typeorm/issues/11672">#11672</a>) (<a href="https://github.com/typeorm/typeorm/commit/1dbc22428bdfd0b33760afe7bcbb5456d9eab8be">1dbc224</a>)</li> <li><strong>postgres:</strong> execute queries sequentially to avoid pg 8.19.0 deprecation warning (<a href="https://redirect.github.com/typeorm/typeorm/issues/12105">#12105</a>) (<a href="https://github.com/typeorm/typeorm/commit/79829a0f63cb4620a95d73841a77099b988cc1be">79829a0</a>)</li> <li>prevent columns with select false from being returned (<a href="https://redirect.github.com/typeorm/typeorm/issues/11944">#11944</a>) (<a href="https://github.com/typeorm/typeorm/commit/6b20831bb7bc285a9accbdfca6563e73d818d435">6b20831</a>)</li> <li>prevent eager-loaded entities from overwriting manual relations (<a href="https://redirect.github.com/typeorm/typeorm/issues/11267">#11267</a>) (<a href="https://github.com/typeorm/typeorm/commit/2d8c5158db1aef458cd909db05059fff9129305a">2d8c515</a>)</li> <li>propagate schema and database to closure junction table (<a href="https://redirect.github.com/typeorm/typeorm/issues/12110">#12110</a>) (<a href="https://github.com/typeorm/typeorm/commit/58b403f04cfe1e0aae17e6064279cee5e1a33eb3">58b403f</a>)</li> <li><strong>redis:</strong> redis cache version detection (<a href="https://redirect.github.com/typeorm/typeorm/issues/11936">#11936</a>) (<a href="https://github.com/typeorm/typeorm/commit/f22c7a2358108c6656f15470250d937bf440f71d">f22c7a2</a>)</li> <li>release query runner when there is no migration to revert (<a href="https://redirect.github.com/typeorm/typeorm/issues/11232">#11232</a>) (<a href="https://github.com/typeorm/typeorm/commit/a46eb0a7e18df52a39e5f39ae2c4e67a89c945d9">a46eb0a</a>)</li> <li><strong>sap:</strong> <code>QueryBuilder</code> parameter of type JS <code>Date</code> not escaped correctly (<a href="https://redirect.github.com/typeorm/typeorm/issues/11867">#11867</a>) (<a href="https://github.com/typeorm/typeorm/commit/51534362daed2f1cc9ce72ee0886e894892face7">5153436</a>)</li> <li><strong>security:</strong> validate limit() in Update/SoftDelete query builders (<a href="https://redirect.github.com/typeorm/typeorm/issues/12437">#12437</a>) (<a href="https://github.com/typeorm/typeorm/commit/0d7991a27a13a9af7818505e51dddb52c8299d0a">0d7991a</a>)</li> <li>virtual property handling in schema builder (<a href="https://redirect.github.com/typeorm/typeorm/issues/11000">#11000</a>) (<a href="https://github.com/typeorm/typeorm/commit/5bd3255dbd992387c5b7940cb95295570ae56c86">5bd3255</a>)</li> </ul> <h3>Features</h3> <ul> <li>add <code>returning</code> option to update/upsert operations (<a href="https://redirect.github.com/typeorm/typeorm/issues/11782">#11782</a>) (<a href="https://github.com/typeorm/typeorm/commit/11d9767212e95e9e36e09af5e1eac4668c326551">11d9767</a>)</li> <li><strong>sap:</strong> add pool timeout (<a href="https://redirect.github.com/typeorm/typeorm/issues/11868">#11868</a>) (<a href="https://github.com/typeorm/typeorm/commit/b4e2ad2a6cbd941a8a665b5d7fde6bb28546ffef">b4e2ad2</a>)</li> <li><strong>sap:</strong> support locking in select (<a href="https://redirect.github.com/typeorm/typeorm/issues/11996">#11996</a>) (<a href="https://github.com/typeorm/typeorm/commit/86a9e3e1d8e019ef036ccd4935bdc6c25898cf75">86a9e3e</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typeorm/typeorm/commit/0ed009a12867e302ecbc7cedfd442cc60d21c006"><code>0ed009a</code></a> ci: add npm environment to publish job for trusted publishing</li> <li><a href="https://github.com/typeorm/typeorm/commit/6ede38bb0e51939dee50c88ab7bfa88cd407e5e9"><code>6ede38b</code></a> chore: enable trusted publishing in publish workflow</li> <li><a href="https://github.com/typeorm/typeorm/commit/578d9e9636b5bd3beef6e1482f366126caf9d843"><code>578d9e9</code></a> chore: fix pnpm publish for v0.3</li> <li><a href="https://github.com/typeorm/typeorm/commit/253f060b3513f465638a05a27f75244148de8bf8"><code>253f060</code></a> chore: disable git check on pnpm publish for v0.3</li> <li><a href="https://github.com/typeorm/typeorm/commit/1b5476fd2936e925484fe126b8dd621f11d75021"><code>1b5476f</code></a> chore: set pnpm publish branch for v0.3</li> <li><a href="https://github.com/typeorm/typeorm/commit/17c6ec2e83e81312c0f1b2b27fa0a22551acd04f"><code>17c6ec2</code></a> chore(release): release 0.3.29 (<a href="https://redirect.github.com/typeorm/typeorm/issues/12442">#12442</a>)</li> <li><a href="https://github.com/typeorm/typeorm/commit/0ac80921c249b37886c131546ca01ab851abe0fe"><code>0ac8092</code></a> chore(deps): update all minor (<a href="https://redirect.github.com/typeorm/typeorm/issues/12443">#12443</a>)</li> <li><a href="https://github.com/typeorm/typeorm/commit/0d7991a27a13a9af7818505e51dddb52c8299d0a"><code>0d7991a</code></a> fix(security): validate limit() in Update/SoftDelete query builders (<a href="https://redirect.github.com/typeorm/typeorm/issues/12437">#12437</a>)</li> <li><a href="https://github.com/typeorm/typeorm/commit/c38c754a06618a69277cb5069845ae68a0af8ef0"><code>c38c754</code></a> ci: remove docs indexing (<a href="https://redirect.github.com/typeorm/typeorm/issues/12435">#12435</a>)</li> <li><a href="https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc"><code>1b66c44</code></a> Merge commit from fork</li> <li>Additional commits viewable in <a href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for typeorm since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
b1e856d987 |
feat(sdk): apply state update and goto alongside interrupt resume (#2557)
## Summary
- Add `update` and `goto` options to `respond()` across the SDK so
resolving an interrupt can apply a state update and/or directed jump in
the **same superstep** — mapped to LangGraph's `Command(resume, update,
goto)`. The canonical use case is a HITL flow that pushes the interrupt
card into state at the moment it answers, committed in one checkpoint
with no flicker.
- `@langchain/langgraph-sdk`: new `update`/`goto` fields on
`StreamRespondAllOptions`, forwarded by
`StreamController.respond`/`respondAll`; `@langchain/core` `BaseMessage`
instances under the `messagesKey` are serialized to dicts before
transport, exactly like `submit()`.
- `@langchain/langgraph-api`: forward `update`/`goto` from
`input.respond` into the run `Command` in both the protocol service and
the embedded server.
- `@langchain/react`, `@langchain/vue`, `@langchain/svelte`,
`@langchain/angular`: document the new `respond({ update, goto })`
capability (incl. `BaseMessage` examples).
- Fix: the protocol-v2 state normalizer stripped `response_metadata`,
which HITL cards ride on (`AIMessage.response_metadata`); non-empty
`response_metadata` is now preserved.
- Add React browser tests (`interrupt_card_graph` fixture via
`createAgent`) covering the approve and reject paths: the FE-pushed card
lands in committed state exactly once and persists through a slow tool
execution.
|
||
|
George Mihailov
|
3d7fcea7d7 |
feat(langgraph-checkpoint-mongodb): add TTL support for automatic checkpoint data expiration (#1928)
Add optional TTL parameter to MongoDBSaver that enables automatic
expiration of checkpoints using MongoDB's TTL indexes.
- Add `ttl` option to MongoDBSaverParams (value in seconds)
- Add `setup()` method to create TTL indexes, returns Error[] for caller
to handle failures
- Add `upserted_at` timestamp to documents when TTL is enabled
- Each write refreshes TTL (expires after inactivity, not creation)
```js
// Create checkpointer with 1-hour TTL (in seconds)
const checkpointer = new MongoDBSaver({
client,
ttl: 3600,
});
// Create TTL indexes (call on startup/deployment)
const errors = await checkpointer.setup();
if (errors.length) {
console.warn("Failed to create TTL indexes:", errors);
}
```
Fixes # (issue)
Ever growing records in database.
---------
Co-authored-by: Christian Bromann <git@bromann.dev>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
||
|
dependabot[bot]
|
d95ed2095d |
chore(deps-dev): bump uuid from 14.0.0 to 14.0.1 (#2560)
Bumps [uuid](https://github.com/uuidjs/uuid) from 14.0.0 to 14.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uuidjs/uuid/releases">uuid's releases</a>.</em></p> <blockquote> <h2>v14.0.1</h2> <h2><a href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">14.0.1</a> (2026-06-20)</h2> <h3>Bug Fixes</h3> <ul> <li>add types condition to node export for moduleResolution bundler (<a href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>) (<a href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e">27ffae5</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md">uuid's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">14.0.1</a> (2026-06-20)</h2> <h3>Bug Fixes</h3> <ul> <li>add types condition to node export for moduleResolution bundler (<a href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>) (<a href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e">27ffae5</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uuidjs/uuid/commit/70177807e9229dfacde2038dc1e722f1828f358a"><code>7017780</code></a> chore(main): release 14.0.1 (<a href="https://redirect.github.com/uuidjs/uuid/issues/964">#964</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/f2c3e4b513e47968f568ad1bf96417c6924e83a7"><code>f2c3e4b</code></a> chore: fix release-please workflow (<a href="https://redirect.github.com/uuidjs/uuid/issues/963">#963</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e"><code>27ffae5</code></a> fix: add types condition to node export for moduleResolution bundler (<a href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/664cb3163531f49d3a5125f732d38724621bfcaa"><code>664cb31</code></a> Remove outdated security contact information (<a href="https://redirect.github.com/uuidjs/uuid/issues/959">#959</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/d729016037c4e1b09a522f4854a96f4f4add9047"><code>d729016</code></a> fix(ci): checkout PR head commit in browser workflow (<a href="https://redirect.github.com/uuidjs/uuid/issues/957">#957</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/89a5ebcc56999fc25c95350f922693b71fb11d32"><code>89a5ebc</code></a> Workflows (<a href="https://redirect.github.com/uuidjs/uuid/issues/948">#948</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/196e208db33d568d8d43d5b549d5d0eb3d9b0fbf"><code>196e208</code></a> chore: fix workflow (<a href="https://redirect.github.com/uuidjs/uuid/issues/947">#947</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/95af4489be459d6ba14d137b6fcd87ffd0953e91"><code>95af448</code></a> chore: update workflows (<a href="https://redirect.github.com/uuidjs/uuid/issues/946">#946</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/3b57f95555ab1b8432213264b5eaa318958fb8fe"><code>3b57f95</code></a> chore: add workflow_dispatch (<a href="https://redirect.github.com/uuidjs/uuid/issues/944">#944</a>)</li> <li><a href="https://github.com/uuidjs/uuid/commit/a433096a74e1d1815432fb1bed8115369785a1a9"><code>a433096</code></a> chore: add 12.x and 13.x maintenance release branches (<a href="https://redirect.github.com/uuidjs/uuid/issues/941">#941</a>)</li> <li>Additional commits viewable in <a href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Mohamed Khaled
|
bee3c91d0a |
fix(langgraph-checkpoint-mongodb): no-op putWrites on empty writes (#2556)
## Summary `MongoDBSaver.putWrites` builds a `bulkWrite` operations array from `writes` and calls `collection.bulkWrite(operations)`. When `writes` is empty, `operations` is empty and the MongoDB driver throws: ``` MongoServerError: Invalid BulkOperation, Batch cannot be empty ``` This is reached in normal operation by **human-in-the-loop / `interrupt()`** flows: when a graph interrupts to wait for input, a task can complete producing **zero channel writes**, so LangGraph calls `putWrites(config, [], taskId)` and the saver throws. The other first-party savers don't hit this — `checkpoint-postgres` and `checkpoint-sqlite` iterate over `writes`, so an empty array is a natural no-op. The sibling `store.ts` in this same package already guards its bulk write with `if (bulkOps.length > 0)`. `putWrites` was simply missing the equivalent guard. ## Fix Skip the `bulkWrite` call when there are no operations, mirroring the existing guard in `store.ts`. The guard is at the call site (not an early return), so the existing `configurable` validation is preserved. This aligns the MongoDB saver's empty-writes behavior with the postgres and sqlite savers. ## Tests - **Unit** (`checkpoints.test.ts`): asserts `putWrites(config, [], taskId)` resolves and that `bulkWrite` is **not** called. Verified to fail before the fix (`bulkWrite` was called with `[]`). - **Integration** (`checkpoints.int.test.ts`): asserts `putWrites` with empty writes resolves and persists nothing — the truest repro against the real driver. `pnpm build`, `pnpm lint`, `pnpm format:check`, and the unit suite all pass locally. A changeset is included (`@langchain/langgraph-checkpoint-mongodb` patch). ## Related Same class of HITL / `interrupt()` + `putWrites` bug previously fixed for the Redis saver: #1996 / #2026. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
github-actions[bot]
|
e6082e0575 |
chore: version packages (#2554)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph@1.4.4 ### Patch Changes - [#2552](https://github.com/langchain-ai/langgraphjs/pull/2552) [`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): isolate concurrent singleton-agent invocations by thread `ensureLangGraphConfig` ignores the ambient `AsyncLocalStorage` `configurable` on root-level invokes that supply an invoke-time `thread_id` and have no nesting keys (ignoring graph-bound `.withConfig()` defaults). On a fresh top-level run the ambient `configurable` can belong to another concurrent invocation, so its keys — internal scratchpad/task-input as well as user keys like `tenant_id`/`user_id` — must not leak in; values the caller wants arrive through the explicit (bound + invoke-time) configs. Ambient nesting (`__pregel_read__`) and bound child graphs invoked from parent tasks are unaffected. This prevents cross-invocation leakage between concurrent `invoke()` calls on a shared compiled graph (e.g. BullMQ workers with `concurrency > 1`). Complements the config-merge fix that stopped shared graph-bound `metadata`/`configurable` objects from being mutated across invocations ([#2040](https://github.com/langchain-ai/langgraphjs/issues/2040)). - [#2553](https://github.com/langchain-ai/langgraphjs/pull/2553) [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): recognize JSON-erased `Overwrite` values across runtimes `Overwrite` already survives JSON serialization in JS because `Overwrite.toJSON()` emits the canonical `{ "__overwrite__": value }` sentinel. `_getOverwriteValue` now additionally recognizes the discriminator form `{ "type": "__overwrite__", value }` produced when a typed `Overwrite` from another runtime (e.g. a Python dataclass routed through the LangGraph API server) is serialized and its type is erased. This keeps `Overwrite` (and `DeltaChannel`) semantics intact across cross-runtime JSON boundaries. These delta-channel APIs remain Beta. ## @example/ai-elements@0.1.40 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 ## @examples/assistant-ui-claude@0.1.40 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 ## @examples/ui-angular@0.0.50 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 ## @examples/ui-multimodal@0.0.26 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 ## @examples/ui-react@0.0.26 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 ## langgraph@1.0.44 ### Patch Changes - Updated dependencies \[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783), [`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]: - @langchain/langgraph@1.4.4 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.24 @langchain/langgraph-checkpoint-redis@1.0.10 @langchain/langgraph-checkpoint@1.1.2 @langchain/langgraph-sdk@1.9.23 @langchain/langgraph@1.4.4 @langchain/react@1.0.24 @langchain/svelte@1.0.24 @langchain/vue@1.0.24 |
||
|
Christian Bromann
|
d662cbbc63 |
fix(langgraph): isolate concurrent singleton-agent invocations by thread (#2552)
## Summary - Hardens `ensureLangGraphConfig` so root-level invokes with an explicit `thread_id` (and no nesting keys) no longer inherit langgraph-internal `configurable` entries from `AsyncLocalStorage`, preventing scratchpad/`currentTaskInput` leakage between concurrent `invoke()` calls on a singleton agent. - Adds unit tests for the new ALS-skipping behavior and an end-to-end regression test that verifies checkpoint and tool state stay isolated across concurrent invocations on a shared graph with `.withConfig()`. - Complements #2531 (config merge / shared bound-config mutation fix), which was the primary cause of cross-thread contamination reported in #2040. fixes #2040 |
||
|
Christian Bromann
|
1c2aa5bfea |
fix(langgraph): recognize JSON-erased Overwrite values across runtimes (#2553)
## Summary
- JS `Overwrite` already survives JSON serialization because
`Overwrite.toJSON()` emits the canonical `{ "__overwrite__": value }`
sentinel, which `_getOverwriteValue` recognizes.
- This adds recognition of the discriminator form `{ "type":
"__overwrite__", value }` that results when a typed `Overwrite` from
another runtime (notably a Python dataclass, post
langchain-ai/langgraph#8127) is serialized through a JSON boundary and
its type is erased.
- Brings JS to full parity with Python's three-form `_get_overwrite`
(instance, sentinel dict, discriminator dict), so `Overwrite`
round-trips both directions across the JS↔Python API boundary.
Delta-channel APIs remain Beta.
|
||
|
github-actions[bot]
|
73ecaa0fb5 |
chore: version packages (#2536)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint@1.1.2 ### Patch Changes - [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544) [`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): make concurrent DeltaChannel writes deterministic on replay Concurrent same-superstep writes to a `DeltaChannel` could reconstruct from a checkpoint differently than they were applied live, because live execution ordered them by task path while savers replayed them by task id. This fixes that divergence in two complementary ways: - Plain concurrent writes are now applied in the canonical `(task_id, idx)` order on both paths: `_applyWrites` orders them that way live, and the `getDeltaChannelHistory` walk enforces the same order so reconstruction matches live for every saver (Postgres, SQLite, MongoDB, Redis, and custom). - An `Overwrite` now wins its entire super-step: every sibling write in the same step — before AND after the `Overwrite` — is discarded, matching `BinaryOperatorAggregate`. This makes the result independent of the (unstable) ordering of concurrent fan-in writes; previously a plain write that landed after an `Overwrite` in the same step was still folded in. To keep reconstruction in sync with this `Overwrite` rule, any `DeltaChannel` that sees an `Overwrite` in a super-step is now force-snapshotted at the next checkpoint (and, under `"exit"` durability, in the final checkpoint). The post-overwrite value is materialized into `channel_values`, so a cold read seeds from that snapshot and never has to replay across the reset — making live and reconstructed state identical without changing the sparse-replay history shape. These delta-channel APIs remain Beta. - [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531) [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): forward task metadata and name subagents via lc_agent_name `mapDebugTasks` now forwards filtered user-meaningful task config metadata (including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle transformer uses that metadata to set subagent `graph_name` from `lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }` from parent tool-dispatch tasks. Adds the shared `EXCLUDED_METADATA_KEYS` constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928. ## @langchain/langgraph-checkpoint-redis@1.0.10 ### Patch Changes - [#2336](https://github.com/langchain-ai/langgraphjs/pull/2336) [`25907eb`](https://github.com/langchain-ai/langgraphjs/commit/25907eb0be25258c26327c6c68c72bc828ee1cff) Thanks [@MohMaherId](https://github.com/MohMaherId)! - fix(langgraph-checkpoint-redis): persist and reconstruct full `channel_values` across multi-node graphs. `RedisSaver.put()` delta-filters `channel_values` to only the channels written by the current node, but `getTuple()` had no reconstruction logic — unlike `PostgresSaver` — so any multi-node graph whose last node wrote a subset of channels silently lost the others. Each changed channel is now persisted as a version-keyed `checkpoint_blob:*` entry in `put()` and missing channels are reconstructed from those blobs on read. `deleteThread()` now also deletes the `checkpoint_blob:*` keys. Without this the blobs introduced above would orphan forever (memory growth) and thread deletion would be incomplete, matching `PostgresSaver.deleteThread()` parity. When `ttlConfig.refreshOnRead` is enabled, reads now refresh the TTL of the reconstructed `checkpoint_blob:*` keys alongside the checkpoint key. Otherwise a read would keep the checkpoint alive while the blobs it depends on expired, silently dropping reconstructed channels. On write, `put()` now refreshes the TTL of every blob the checkpoint references (the full `channel_versions` set), not just the channels changed by the current node, so carried-over blobs from earlier nodes expire in lockstep with the checkpoint doc. This write-side refresh is independent of `refreshOnRead`. The per-channel blob writes also now run in parallel. Known limitation: with TTL enabled, a carried-over blob can still be lost if it expires during an idle gap longer than `defaultTTL` (no read or write refreshed it in time). When that happens the channel is left cleanly absent on read rather than erroring. Fully closing this gap (re-persisting expired blobs) is tracked as a follow-up. ## @langchain/langgraph@1.4.3 ### Patch Changes - [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544) [`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): make concurrent DeltaChannel writes deterministic on replay Concurrent same-superstep writes to a `DeltaChannel` could reconstruct from a checkpoint differently than they were applied live, because live execution ordered them by task path while savers replayed them by task id. This fixes that divergence in two complementary ways: - Plain concurrent writes are now applied in the canonical `(task_id, idx)` order on both paths: `_applyWrites` orders them that way live, and the `getDeltaChannelHistory` walk enforces the same order so reconstruction matches live for every saver (Postgres, SQLite, MongoDB, Redis, and custom). - An `Overwrite` now wins its entire super-step: every sibling write in the same step — before AND after the `Overwrite` — is discarded, matching `BinaryOperatorAggregate`. This makes the result independent of the (unstable) ordering of concurrent fan-in writes; previously a plain write that landed after an `Overwrite` in the same step was still folded in. To keep reconstruction in sync with this `Overwrite` rule, any `DeltaChannel` that sees an `Overwrite` in a super-step is now force-snapshotted at the next checkpoint (and, under `"exit"` durability, in the final checkpoint). The post-overwrite value is materialized into `channel_values`, so a cold read seeds from that snapshot and never has to replay across the reset — making live and reconstructed state identical without changing the sparse-replay history shape. These delta-channel APIs remain Beta. - [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531) [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): merge instead of overwrite in `ensureLangGraphConfig` `ensureLangGraphConfig` now per-key merges `callbacks`, `tags`, `metadata`, and `configurable` across configs instead of last-write-wins, so values bound via `.withConfig({...})` survive when a later (e.g. invoke-time) config supplies other keys. The merged dicts are fresh objects, fixing a by-reference mutation of shared base configs. Also drops the now-redundant `combineCallbacks` workaround in `streamEvents`, which double-registered and double-fired graph-bound callbacks. - [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531) [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): preserve namespace nesting for imperative graph invokes When a compiled graph is invoked from inside another graph's running task (e.g. a tool body calling `subAgent.invoke(...)`), the surrounding task context — including the langgraph-internal nesting keys (`__pregel_read`, `__pregel_stream`, `checkpoint_ns`, the checkpoint map) — is propagated implicitly via `AsyncLocalStorage`. The base `Runnable.stream` calls langchain-core's `ensureConfig`, which replaces the ambient `configurable` wholesale whenever the caller passes its own. Because `createAgent` always supplies a `configurable`, every tool-invoked sub-agent lost those keys, ran as a fresh root run, and had its streamed events flattened to the root namespace instead of nesting under the triggering task. `Pregel.stream` now merges the ambient `configurable` underneath the caller's (caller keys win per-key) when the ambient marks an active task (`__pregel_read` present) but the explicit `configurable` is missing it. Declared subgraph nodes (which already carry their own `__pregel_read`) and top-level runs are unaffected. - [#2537](https://github.com/langchain-ai/langgraphjs/pull/2537) [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): dispatch stream messages handler inline The v3 `messages` handler (`StreamProtocolMessagesHandler`, which powers `run.messages`) only performs a synchronous `push()` onto the run's stream, but its callbacks were dispatched on LangChain's background callback queue (the default `awaitHandlers === false`). A model or tool call inside a nested or parallel task could therefore flush its `messages` chunk _after_ the Pregel loop returned and sealed the stream, where `IterableReadableWritableStream.push` silently drops chunks once closed. This surfaced as empty per-message streams (`sub.messages`) for subagents dispatched in parallel from a single tools step. The handler now sets `awaitHandlers = true` so its callbacks run inline — every push happens during the originating model/chain call while the stream is still open. This avoids the global over-wait, fake-timer deadlock, and error-path unhandled rejections that a blanket `awaitAllCallbacks()` drain before close would have introduced. - [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531) [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): forward task metadata and name subagents via lc_agent_name `mapDebugTasks` now forwards filtered user-meaningful task config metadata (including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle transformer uses that metadata to set subagent `graph_name` from `lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }` from parent tool-dispatch tasks. Adds the shared `EXCLUDED_METADATA_KEYS` constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928. - [#2549](https://github.com/langchain-ai/langgraphjs/pull/2549) [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(langgraph): support DeltaChannel fields in StateSchema Add a `DeltaValue` state field (and a `MessagesDeltaValue` prebuilt) so a `DeltaChannel` can be declared via `StateSchema`, not just `Annotation.Root` or a raw channel map. `StateSchema` now maps `DeltaValue` to a `DeltaChannel` (forwarding `snapshotFrequency` and the value-schema default) and validates its inputs/`Overwrite` updates like `ReducedValue`. - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)]: - @langchain/langgraph-checkpoint@1.1.2 - @langchain/langgraph-sdk@1.9.23 ## @langchain/langgraph-sdk@1.9.23 ### Patch Changes - [#2545](https://github.com/langchain-ai/langgraphjs/pull/2545) [`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): avoid scoped stream resubscribe churn Defer final projection disposal by one microtask so framework bindings that release and immediately reacquire the same scoped projection during reactive updates keep the existing stream subscription instead of rotating through root-only and scoped SSE filters. ## @langchain/angular@1.0.24 ### Patch Changes - Updated dependencies \[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]: - @langchain/langgraph-sdk@1.9.23 ## @langchain/react@1.0.24 ### Patch Changes - Updated dependencies \[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]: - @langchain/langgraph-sdk@1.9.23 ## @langchain/svelte@1.0.24 ### Patch Changes - Updated dependencies \[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]: - @langchain/langgraph-sdk@1.9.23 ## @langchain/vue@1.0.24 ### Patch Changes - Updated dependencies \[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]: - @langchain/langgraph-sdk@1.9.23 ## @example/ai-elements@0.1.39 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 - @langchain/react@1.0.24 ## @examples/assistant-ui-claude@0.1.39 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 - @langchain/react@1.0.24 ## @examples/ui-angular@0.0.49 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 - @langchain/langgraph-sdk@1.9.23 - @langchain/angular@1.0.24 ## @examples/ui-multimodal@0.0.25 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 - @langchain/react@1.0.24 ## @examples/ui-react@0.0.25 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 - @langchain/langgraph-sdk@1.9.23 - @langchain/react@1.0.24 ## langgraph@1.0.43 ### Patch Changes - Updated dependencies \[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8), [`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b), [`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]: - @langchain/langgraph@1.4.3 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
448721449f |
fix(langgraph): replay concurrent DeltaChannel writes in live order (#2544)
## Summary - Fix a non-deterministic divergence where a `DeltaChannel`'s reconstructed state did not match its live state when concurrent writes (notably a plain write + an `Overwrite`) were applied in the same super-step. Live execution applied concurrent writes in task-**path** order, while every checkpointer replays persisted writes in task-**id** order, so an `Overwrite` hard reset could land at a different point on reload. - `_applyWrites` (`@langchain/langgraph`) now applies concurrent `DeltaChannel` writes in the canonical `(task_id, idx)` order — the same order checkpointers replay them in. - The base `getDeltaChannelHistory` (`@langchain/langgraph-checkpoint`) now stable-sorts each ancestor checkpoint's writes by `task_id`, making reconstruction order independent of how a saver returns `pendingWrites`. This fixes Postgres, SQLite, MongoDB, Redis, and any custom saver in one place; MemorySaver was already correct via its override. |
||
|
Christian Bromann
|
bc667a998a |
fix(langgraph): support DeltaChannel fields in StateSchema (#2549)
## Summary - Add `DeltaValue<Value, Input>` (`state/values/delta.ts`), a `StateSchema` field backed by a `DeltaChannel`'s batch reducer + `snapshotFrequency` — distinct from `ReducedValue`'s single-value reducer. - Wire `DeltaValue` into `StateSchema`: `getChannels()` maps it to a `DeltaChannel` (forwarding `snapshotFrequency` and seeding the initial value from the value-schema default); `getJsonSchema()`/`getInputJsonSchema()`/`validateInput()` handle it (incl. `Overwrite`) like `ReducedValue`; and the type helpers infer `State`/`Update` correctly. - Add the `MessagesDeltaValue` prebuilt (a `DeltaChannel`-backed drop-in for `MessagesValue`); export `DeltaValue` and `MessagesDeltaValue` from `@langchain/langgraph`. - Previously `DeltaChannel` was only usable via `Annotation.Root` / raw channel maps; the `StateSchema` class and Zod paths threw. This closes the `StateSchema` gap (Zod remains a separate follow-up). |
||
|
Christian Bromann
|
e73bf8a260 | test(langgraph-core): add test coverage on merging tags and metadata | ||
|
Christian Bromann
|
2134c8a2c0 |
fix(sdk): avoid scoped stream resubscribe churn (#2545)
## Summary - Defer final `ChannelRegistry` projection disposal by one microtask so same-turn reacquires keep the existing projection runtime alive. - Preserve `registry.size` as an active-consumer diagnostic while allowing pending disposals to be cancelled. - Add regression coverage for release-then-reacquire behavior. |
||
|
Christian Bromann
|
be096663f4 |
fix(langgraph): dispatch stream messages handler inline (#2537)
## Summary - The v3 `messages` handler (`StreamProtocolMessagesHandler`) defaulted to background callback dispatch (`awaitHandlers === false`), so its synchronous `push()` onto the run stream could land after the Pregel loop sealed the stream — where `IterableReadableWritableStream.push` silently drops chunks. - This caused empty per-message streams (`sub.messages`) for subagents dispatched in parallel from a single tools step. - Fix: set `awaitHandlers = true` so the handler dispatches inline and every push happens during the originating model/chain call while the stream is still open. This avoids the global over-wait, fake-timer deadlock, and error-path unhandled rejections that a blanket `awaitAllCallbacks()` drain before `stream.close()` would have introduced. --------- Signed-off-by: Christian Bromann <git@bromann.dev> |
||
|
dependabot[bot]
|
c18622faf7 |
chore(deps): bump @angular/compiler from 22.0.0 to 22.0.1 (#2541)
Bumps [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) from 22.0.0 to 22.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/compiler's releases</a>.</em></p> <blockquote> <h2>22.0.1</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix - c4b5fa3c92" /></a></td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix - dfff57ede9" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix - 3c2892c8df" /></a></td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix - 1d87c49f6e" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix - 1ee224ca30" /></a></td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix - a56f1cdf8f" /></a></td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix - 5946c18275" /></a></td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix - 393b84caf8" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix - 3d9ca2f173" /></a></td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix - 669146b0e7" /></a></td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix - 562a566ead" /></a></td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix - fa546f382d" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix - 29fdb98684" /></a></td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix - cdcea80327" /></a></td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix - 4289c4c840" /></a></td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix - 3dd433b39a" /></a></td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix - 045bb736b3" /></a></td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix - 11836a670a" /></a></td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix - 85d2d100e3" /></a></td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix - e51ad374ea" /></a></td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix - 55b7b5a6b6" /></a></td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix - ffb06c0514" /></a></td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix - 2dd65d21e6" /></a></td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix - 4254eb416c" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix - 167bd4c162" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix - 43a0e28729" /></a></td> <td>prevent external template inlay hints from appearing in TS files</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/compiler's changelog</a>.</em></p> <blockquote> <h1>22.0.1 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td> <td>fix</td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td> <td>fix</td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td> <td>fix</td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td> <td>fix</td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td> <td>fix</td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td> <td>fix</td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td> <td>fix</td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td> <td>fix</td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td> <td>fix</td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td> <td>fix</td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td> <td>fix</td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td> <td>fix</td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td> <td>fix</td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td> <td>fix</td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td> <td>fix</td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td> <td>fix</td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td> <td>fix</td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td> <td>fix</td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/4645850e24d2764313040b6711af93d3fd426825"><code>4645850</code></a> refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor</li> <li><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a> fix(compiler): disallow i18n event attributes</li> <li><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a> fix(compiler): sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the ...</li> <li><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><code>393b84c</code></a> fix(compiler): sanitize two-way properties</li> <li><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><code>3d9ca2f</code></a> fix(compiler-cli): bind switch exhaustive check expressions</li> <li><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><code>a56f1cd</code></a> fix(compiler): more robust logic to check if regex can be optimized</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v22.0.1/packages/compiler">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
38cfe01ff0 |
fix(langgraph): merge instead of overwrite in ensureLangGraphConfig (#2531)
## Summary
- Port of langgraph#7926: `ensureLangGraphConfig` now per-key merges
`callbacks`, `tags`, `metadata`, and `configurable` across configs
instead of overwriting, so values bound via `.withConfig({...})` are
preserved when a later config (e.g. invoke-time `thread_id`) only
supplies a subset of keys. Later configs still win per key on collision.
- Merged dicts are fresh objects, fixing a by-reference mutation where
`propagateConfigurableToMetadata` could mutate a shared bound config's
`metadata` across invocations.
- Removed the now-redundant `combineCallbacks` pre-combine in
`Pregel.streamEvents` (v1/v2). Because the config merge now folds in
`this.config` callbacks, pre-combining re-registered graph-bound
handlers and double-fired them; only call-time callbacks are forwarded
now.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
|
||
|
dependabot[bot]
|
4808541753 |
chore(deps): bump @angular/core from 22.0.0 to 22.0.1 (#2538)
Bumps [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) from 22.0.0 to 22.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/core's releases</a>.</em></p> <blockquote> <h2>22.0.1</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix - c4b5fa3c92" /></a></td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix - dfff57ede9" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix - 3c2892c8df" /></a></td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix - 1d87c49f6e" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix - 1ee224ca30" /></a></td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix - a56f1cdf8f" /></a></td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix - 5946c18275" /></a></td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix - 393b84caf8" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix - 3d9ca2f173" /></a></td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix - 669146b0e7" /></a></td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix - 562a566ead" /></a></td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix - fa546f382d" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix - 29fdb98684" /></a></td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix - cdcea80327" /></a></td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix - 4289c4c840" /></a></td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix - 3dd433b39a" /></a></td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix - 045bb736b3" /></a></td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix - 11836a670a" /></a></td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix - 85d2d100e3" /></a></td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix - e51ad374ea" /></a></td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix - 55b7b5a6b6" /></a></td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix - ffb06c0514" /></a></td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix - 2dd65d21e6" /></a></td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix - 4254eb416c" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix - 167bd4c162" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix - 43a0e28729" /></a></td> <td>prevent external template inlay hints from appearing in TS files</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/core's changelog</a>.</em></p> <blockquote> <h1>22.0.1 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td> <td>fix</td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td> <td>fix</td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td> <td>fix</td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td> <td>fix</td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td> <td>fix</td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td> <td>fix</td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td> <td>fix</td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td> <td>fix</td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td> <td>fix</td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td> <td>fix</td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td> <td>fix</td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td> <td>fix</td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td> <td>fix</td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td> <td>fix</td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td> <td>fix</td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td> <td>fix</td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td> <td>fix</td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td> <td>fix</td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/4b0c3b8b8f1dbdb6ba31cb6499c393b1ccd81c6c"><code>4b0c3b8</code></a> refactor(core): Update registerNgModuleType to support codegen typechecking</li> <li><a href="https://github.com/angular/angular/commit/dbf64c8eb55ef5d2480abfbb4e362edccf79f971"><code>dbf64c8</code></a> test(core): fix AI tools test flake</li> <li><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><code>045bb73</code></a> fix(core): validate lowercase SVG animation attribute names</li> <li><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a> fix(compiler): disallow i18n event attributes</li> <li><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a> fix(compiler): sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the ...</li> <li><a href="https://github.com/angular/angular/commit/b1f02eb5c5fd6c4a62cadf4ff4f04a3046a65002"><code>b1f02eb</code></a> refactor(core): add internal utility</li> <li><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><code>85d2d10</code></a> fix(forms): harden FormGroup control lookups against prototype shadowing</li> <li><a href="https://github.com/angular/angular/commit/6e3d51d7df3c8a4013cee7ec96c03835e0eeb9e2"><code>6e3d51d</code></a> refactor(migrations): Improve <code>safeNavigationMigration</code> heuristic</li> <li><a href="https://github.com/angular/angular/commit/01ea640539efda57e35807cef61abaf403686fe9"><code>01ea640</code></a> refactor(core): Fix DirectiveDefinition interface to allow abstract classes</li> <li><a href="https://github.com/angular/angular/commit/a704b08379e92294c59e47af7703edfefdaff6b8"><code>a704b08</code></a> docs: add Signal Forms and v22 guidance to AI best-practices and llms.txt</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v22.0.1/packages/core">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a9fce5ea1c |
chore(deps-dev): bump @vitest/browser from 4.1.8 to 4.1.9 (#2539)
Bumps [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser) from 4.1.8 to 4.1.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/browser's releases</a>.</em></p> <blockquote> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10598">#10598</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/fbc626c401ee9215ee07c0d19801cff820e289d6"><code>fbc626c</code></a> fix(browser): wait for iframe tester readiness before preparing (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10497">#10497</a>) [bac...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a> fix(browser): wait for orchestrator readiness before resolving browser sessio...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/browser">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7d8295dcca |
chore(deps): bump hono from 4.12.23 to 4.12.25 (#2548)
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.25</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3>CORS Middleware reflects any Origin with credentials when <code>origin</code> defaults to the wildcard</h3> <p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting the request <code>Origin</code> and sending <code>Access-Control-Allow-Credentials: true</code> when <code>credentials: true</code> is set without an explicit <code>origin</code>, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p> <h3>Body Limit Middleware can be bypassed on AWS Lambda by understating <code>Content-Length</code></h3> <p>Affects: <code>hono/body-limit</code> on AWS Lambda (<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the request being built with the client-declared <code>Content-Length</code> while the body is delivered fully buffered, where a client could declare a small <code>Content-Length</code> with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2</p> <h3>Path traversal in <code>serve-static</code> on Windows via encoded backslash (<code>%5C</code>)</h3> <p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (<code>%5C</code>) decoded to <code>\</code> was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44</p> <h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers into one value, dropping cookies on ALB single-header and Lattice</h3> <p>Affects: <code>hono/aws-lambda</code>. Fixes multiple <code>Set-Cookie</code> response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p> <h3>Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest</h3> <p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as <code>X-Forwarded-For</code> reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p</p> <h2>v4.12.24</h2> <h2>What's Changed</h2> <ul> <li>docs(contribution): simplifyAI Usage Policy by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li> <li>chore: remove <code>@types/glob</code> by <a href="https://github.com/rtritto"><code>@rtritto</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li> <li>fix(bearer-auth): mention verifyToken in missing-options error message by <a href="https://github.com/tan7vir"><code>@tan7vir</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li> <li>refactor(language): Test/improve tests on languages middleware by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li> <li>fix(utils/ipaddr): expand "::" to eight zero groups by <a href="https://github.com/youcefzemmar"><code>@youcefzemmar</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li> <li>fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by <a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@Mohammad-Faiz-Cloud-Engineer</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li> <li>refactor(timing): Test/add test for middleware timing by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li> <li>fix(utils/ipaddr): render the unspecified address binary as "::" by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a> 4.12.25</li> <li><a href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/74c2cf8ef4f5cc29a876380df1ba230ff7128b3f"><code>74c2cf8</code></a> test(aws-lambda): update integration tests (<a href="https://redirect.github.com/honojs/hono/issues/5012">#5012</a>)</li> <li><a href="https://github.com/honojs/hono/commit/7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1"><code>7ae7cba</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/1b1384815485f9d6590c6966e23a06fd07166cb7"><code>1b13848</code></a> chore(ci): bump codecov-action to v7.0.0 (<a href="https://redirect.github.com/honojs/hono/issues/5011">#5011</a>)</li> <li><a href="https://github.com/honojs/hono/commit/5fdde5ab5a7d7c89eba4d1ceab76f4a7c011cd3b"><code>5fdde5a</code></a> 4.12.24</li> <li><a href="https://github.com/honojs/hono/commit/c78932d745cdf6284ae131a156479ac930da0262"><code>c78932d</code></a> fix(utils/ipaddr): render the unspecified address binary as "::" (<a href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.25">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
1a42b9f21f |
chore(deps): bump tar from 7.5.11 to 7.5.16 (#2547)
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a> 7.5.16</li> <li><a href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a> do not apply PAX header fields to meta entries</li> <li><a href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a> update project deps</li> <li><a href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a> fix inconsequential typo in PENDINGLINKS symbol name</li> <li><a href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a> remove some uses of mutate-fs</li> <li><a href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a> 7.5.15</li> <li><a href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a> fix: regression in pending links detection</li> <li><a href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a> 7.5.14</li> <li><a href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a> stricter protection against hardlinks preempting their targets</li> <li><a href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a> update workflows and deps</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ada52690f6 |
chore(deps-dev): bump ws from 8.20.1 to 8.21.0 (#2546)
Bumps [ws](https://github.com/websockets/ws) from 8.20.1 to 8.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <p>The vulnerability was responsibly disclosed and fixed by <a href="https://github.com/Nadav0077">Nadav Magier</a>.</p> <p>In vulnerable versions, the issue can be mitigated by lowering the value of the <code>maxPayload</code> option if possible.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li><a href="https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a"><code>2b2abd4</code></a> [security] Limit retained message parts</li> <li><a href="https://github.com/websockets/ws/commit/78eabe2a6677b231bf9c82601bde86ff91639490"><code>78eabe2</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
58a29a2e61 |
chore(deps-dev): bump vite from 8.0.5 to 8.0.16 (#2543)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.5 to 8.0.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v8.0.16</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.15</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.14</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.13</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.11</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.10</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.9</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.8</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16">8.0.16</a> (2026-06-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>deps:</strong> reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>) (<a href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9">50b9512</a>)</li> <li>reject windows alternate paths (<a href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>) (<a href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546">dc245c7</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15">8.0.15</a> (2026-06-01)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>send 408 on request timeout (<a href="https://redirect.github.com/vitejs/vite/issues/22476">#22476</a>) (<a href="https://github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797">c85c9ee</a>)</li> <li>update rolldown to 1.0.3 (<a href="https://redirect.github.com/vitejs/vite/issues/22538">#22538</a>) (<a href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575">646dbed</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>capitalize error messages and remove spurious space in parse error (<a href="https://redirect.github.com/vitejs/vite/issues/22488">#22488</a>) (<a href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3">85a0eff</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22511">#22511</a>) (<a href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa">2686d7d</a>)</li> <li><strong>dev:</strong> fix html-proxy cache key mismatch for /@fs/ HTML paths (<a href="https://redirect.github.com/vitejs/vite/issues/21762">#21762</a>) (<a href="https://github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e">47c4213</a>)</li> <li><strong>glob:</strong> error on relative glob in virtual module when no files match (<a href="https://redirect.github.com/vitejs/vite/issues/22497">#22497</a>) (<a href="https://github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c">5c8e98f</a>)</li> <li><strong>optimizer:</strong> close the rolldown bundle when write() rejects (<a href="https://redirect.github.com/vitejs/vite/issues/22528">#22528</a>) (<a href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815">e3cfb9d</a>)</li> <li><strong>resolve:</strong> provide onWarn for viteResolvePlugin in JS plugin containers (<a href="https://redirect.github.com/vitejs/vite/issues/22509">#22509</a>) (<a href="https://github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83">40985f1</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22566">#22566</a>) (<a href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd">3052a67</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li>correct logic in <code>collectAllModules</code> function (<a href="https://redirect.github.com/vitejs/vite/issues/22562">#22562</a>) (<a href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c">6978a9c</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14">8.0.14</a> (2026-05-21)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>update rolldown to 1.0.2 (<a href="https://redirect.github.com/vitejs/vite/issues/22484">#22484</a>) (<a href="https://github.com/vitejs/vite/commit/96efc88570b6a6ddf1a910f106920cbac07b3cf0">96efc88</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22471">#22471</a>) (<a href="https://github.com/vitejs/vite/commit/98b81632139d51820f82036e58d6fbbf122b77b3">98b8163</a>)</li> <li><strong>dev:</strong> handle errors when sending messages to vite server (<a href="https://redirect.github.com/vitejs/vite/issues/22450">#22450</a>) (<a href="https://github.com/vitejs/vite/commit/e8e9a34dcf2540139de558a10187630884d10217">e8e9a34</a>)</li> <li><strong>html:</strong> handle trailing slash paths in transformIndexHtml (<a href="https://redirect.github.com/vitejs/vite/issues/22480">#22480</a>) (<a href="https://github.com/vitejs/vite/commit/5d94d1bffdb2a15de9341194d89baec86ce1f693">5d94d1b</a>)</li> <li><strong>optimizer:</strong> pass oxc jsx options to transformSync in dependency scan (<a href="https://redirect.github.com/vitejs/vite/issues/22342">#22342</a>) (<a href="https://github.com/vitejs/vite/commit/b3132dacea9c6e0cf526cd9f0f09d850f577c262">b3132da</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22470">#22470</a>) (<a href="https://github.com/vitejs/vite/commit/7cb728eb629cc677661f1bc52a044ffc0b87fc7f">7cb728e</a>)</li> <li>remove irrelevant commits from changelog (<a href="https://github.com/vitejs/vite/commit/2c69495f250edf01132d4a20128de19dbe836086">2c69495</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li><strong>glob:</strong> do not rewrite import path for absolute base (<a href="https://redirect.github.com/vitejs/vite/issues/22310">#22310</a>) (<a href="https://github.com/vitejs/vite/commit/0ae2844ab6d6d1ccf78a2975b8132769fc35b302">0ae2844</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/f94df87ff03b40b65e29bacdc04cc18c7bccaa4a"><code>f94df87</code></a> release: v8.0.16</li> <li><a href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546"><code>dc245c7</code></a> fix: reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9"><code>50b9512</code></a> fix(deps): reject UNC paths for launch-editor-middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8d1b0195fd186d0b3297d7cd17acff6c96797420"><code>8d1b019</code></a> release: v8.0.15</li> <li><a href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa"><code>2686d7d</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511">#22511</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd"><code>3052a67</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566">#22566</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815"><code>e3cfb9d</code></a> fix(optimizer): close the rolldown bundle when write() rejects (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528">#22528</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c"><code>6978a9c</code></a> refactor: correct logic in <code>collectAllModules</code> function (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562">#22562</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575"><code>646dbed</code></a> feat: update rolldown to 1.0.3 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538">#22538</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3"><code>85a0eff</code></a> fix: capitalize error messages and remove spurious space in parse error (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488">#22488</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
932d31ae84 |
chore(deps): bump @angular/common from 22.0.0 to 22.0.1 (#2540)
Bumps [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) from 22.0.0 to 22.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@angular/common's releases</a>.</em></p> <blockquote> <h2>22.0.1</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix - c4b5fa3c92" /></a></td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix - dfff57ede9" /></a></td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix - 3c2892c8df" /></a></td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix - 1d87c49f6e" /></a></td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix - 1ee224ca30" /></a></td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix - a56f1cdf8f" /></a></td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix - 5946c18275" /></a></td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix - 393b84caf8" /></a></td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix - 3d9ca2f173" /></a></td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix - 669146b0e7" /></a></td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix - 562a566ead" /></a></td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix - fa546f382d" /></a></td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix - 29fdb98684" /></a></td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix - cdcea80327" /></a></td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix - 4289c4c840" /></a></td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix - 3dd433b39a" /></a></td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix - 045bb736b3" /></a></td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix - 11836a670a" /></a></td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix - 85d2d100e3" /></a></td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix - e51ad374ea" /></a></td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix - 55b7b5a6b6" /></a></td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix - ffb06c0514" /></a></td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix - 2dd65d21e6" /></a></td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix - 4254eb416c" /></a></td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix - 167bd4c162" /></a></td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix - 43a0e28729" /></a></td> <td>prevent external template inlay hints from appearing in TS files</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@angular/common's changelog</a>.</em></p> <blockquote> <h1>22.0.1 (2026-06-10)</h1> <h2>Deprecations</h2> <h3>platform-server</h3> <ul> <li>XHR support in <code>@angular/platform-server</code> is deprecated. Use standard <code>fetch</code> APIs instead. (cherry picked from commit 8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li> </ul> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td> <td>fix</td> <td>escape CSS string-terminating characters in escapeCssUrl</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td> <td>fix</td> <td>Limits date format string length</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td> <td>fix</td> <td>prevent prototype pollution in formatDateTime</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td> <td>fix</td> <td>use cryptographically secure SHA-256 for transfer cache key generation</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td> <td>fix</td> <td>disallow i18n event attributes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td> <td>fix</td> <td>more robust logic to check if regex can be optimized</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td> <td>fix</td> <td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any element of the MathML namespace</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td> <td>fix</td> <td>sanitize two-way properties</td> </tr> </tbody> </table> <h3>compiler-cli</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td> <td>fix</td> <td>bind switch exhaustive check expressions</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td> <td>fix</td> <td>disable WebMCP during SSR</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td> <td>fix</td> <td>Handle synchronous errors in PendingTasks.run function</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td> <td>fix</td> <td>harden TransferState restoration against DOM clobbering</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td> <td>fix</td> <td>prevent dangling prevConsumer reference from leaking destroyed views (<a href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td> <td>fix</td> <td>require WebMCP tool descriptions</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td> <td>fix</td> <td>update comment for Default change detection</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td> <td>fix</td> <td>use Object.hasOwn to handle null-prototype objects in toStylingKeyValueArray</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td> <td>fix</td> <td>validate lowercase SVG animation attribute names</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td> <td>fix</td> <td>delay mcp reading the form model by a <code>tick</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td> <td>fix</td> <td>harden FormGroup control lookups against prototype shadowing</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td> <td>fix</td> <td>remove animationstart listener on component destroy to prevent memory leak</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td> <td>fix</td> <td>set <code>additionalProperties: false</code> on generated WebMCP form</td> </tr> </tbody> </table> <h3>http</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td> <td>fix</td> <td>ensure query parameters are inserted before URL fragments</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td> <td>fix</td> <td>pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> on post/patch requests</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td> <td>fix</td> <td>preserve empty referrer option in HttpRequest</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td> <td>fix</td> <td>Rejects non-HTTP(S) URLs in JSONP requests</td> </tr> </tbody> </table> <h3>language-service</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><code>2dd65d2</code></a> fix(http): pass down the <code>reportUploadProgress</code> and <code>reportDownloadProgress</code> ...</li> <li><a href="https://github.com/angular/angular/commit/1bd5a562f54b8ec7378e7c7f928285be59091f97"><code>1bd5a56</code></a> docs: deprecate XHR support for server-side rendering in HTTP docs and recomm...</li> <li><a href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><code>3c2892c</code></a> fix(common): prevent prototype pollution in formatDateTime</li> <li><a href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><code>c4b5fa3</code></a> fix(common): escape CSS string-terminating characters in escapeCssUrl</li> <li><a href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><code>4254eb4</code></a> fix(http): preserve empty referrer option in HttpRequest</li> <li><a href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><code>167bd4c</code></a> fix(http): Rejects non-HTTP(S) URLs in JSONP requests</li> <li><a href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><code>dfff57e</code></a> fix(common): Limits date format string length</li> <li><a href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><code>1d87c49</code></a> fix(common): use cryptographically secure SHA-256 for transfer cache key gene...</li> <li><a href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><code>ffb06c0</code></a> fix(http): ensure query parameters are inserted before URL fragments</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v22.0.1/packages/common">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
MohMaherId
|
25907eb0be |
fix(langgraph-checkpoint-redis): add blob reconstruction for channel_values in multi-node graphs (#2336)
## Summary Fixes #2334 `RedisSaver.put()` delta-filters `channel_values` based on `newVersions`, storing only channels written by the current node. Unlike `PostgresSaver` (which stores channel blobs separately and reconstructs in `getTuple()`), `RedisSaver` had no reconstruction logic — channels not written by the last node were silently lost. This PR completes the blob storage layer: - **`put()`**: writes each changed channel as a version-keyed Redis JSON key (`checkpoint_blob:{thread_id}:{ns}:{channel}:{version}`) - **`loadCheckpointWithWrites()`**: for each channel in `channel_versions` missing from `channel_values`, looks up the blob at the recorded version and reconstructs full state The `checkpoint_blobs` RediSearch index already existed with the correct schema (`thread_id`, `checkpoint_ns`, `channel`, `version`, `type`) — it just wasn't wired up. ### Reproduction ```json { "name": "redis-checkpoint-bug", "private": true, "type": "module", "scripts": { "dev": "tsx redis-bug.ts", "dev:redis": "REDIS_URL=redis://localhost:6379 tsx redis-bug.ts" }, "dependencies": { "@langchain/core": "^1.1.40", "@langchain/langgraph": "^1.2.9", "@langchain/langgraph-checkpoint": "^1.0.1", "@langchain/langgraph-checkpoint-redis": "1.0.4" }, "devDependencies": { "tsx": "^4.19.0" } } ``` Save the reproduction code from #2334 as `redis-bug.ts`, then: ```bash docker run -d --name redis-test -p 6379:6379 redis:7-alpine pnpm install && pnpm dev:redis ``` ### Test plan - [x] Added integration test: multi-channel state where node B writes only `{status, category}` (not `messages`), verifying `messages` survives in `getTuple()` result - [x] Passes `oxfmt --check` and `oxlint` - [x] Includes changeset - [x] CI: unit tests - [x] CI: lint + format - [x] CI: build |
||
|
Mason Daugherty
|
fa45cd95b1 |
ci(infra): align pinned action SHAs in setup-and-build composite action (#2535)
The `setup-and-build` composite action pinned older SHAs for `pnpm/action-setup`, `actions/setup-node`, and `actions/download-artifact` than the workflows that consume it (`ci.yml`, `release.yml`, etc.). Standardizing on the workflows' SHAs leaves one pinned commit per action across the repo — same major versions, just the newer (gh-verified) SHAs already running in CI. ## Changes - Repoint the composite action's three `uses:` lines to the SHAs the workflows already use: `pnpm/action-setup` v4 → `0e279bb9`, `actions/setup-node` v6 → `48b55a01`, `actions/download-artifact` v4 → `3e5f45b2`. |
||
|
github-actions[bot]
|
957cac4ea4 |
chore: version packages (#2526)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-checkpoint@1.1.1 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. ## @langchain/langgraph-checkpoint-redis@1.0.9 ### Patch Changes - [#2525](https://github.com/langchain-ai/langgraphjs/pull/2525) [`829a32a`](https://github.com/langchain-ai/langgraphjs/commit/829a32a30cc22103b1cb0aba6a027b7ccdb68447) Thanks [@lhlyu](https://github.com/lhlyu)! - Fix Redis checkpoint pending write deserialization when a write document has no `value` field. RedisJSON omits `undefined` values, so `loadPendingWrites` now restores a missing `value` as `undefined` instead of passing it through JSON parsing. - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. ## @langchain/langgraph-api@1.3.1 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-ui@1.3.1 ## @langchain/langgraph-cli@1.3.1 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-api@1.3.1 ## @langchain/langgraph@1.4.2 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 - @langchain/langgraph-checkpoint@1.1.1 ## @langchain/langgraph-supervisor@1.1.1 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. ## @langchain/langgraph-ui@1.3.1 ### Patch Changes - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. ## @langchain/langgraph-sdk@1.9.22 ### Patch Changes - [#2529](https://github.com/langchain-ai/langgraphjs/pull/2529) [`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): reconnect SSE streams when heartbeat idle is detected Detect half-open SSE connections by watching for server keep-alive heartbeats (`: heartbeat`) and reconnecting with Last-Event-ID or `since` when they stop. `"auto"` mode arms only after heartbeats are observed, so long tool calls and HITL pauses do not false-fire on heartbeat-emitting servers. - [#2528](https://github.com/langchain-ai/langgraphjs/pull/2528) [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952) Thanks [@christian-bromann](https://github.com/christian-bromann)! - Allow custom `AgentServerAdapter`s to be late-bound and re-bound to a thread. Adapters can now implement an optional `setThreadId(threadId)`, which `client.threads.stream(threadId, { transport })` calls when binding the active thread — including the lazily-minted id from the first `submit()` on a `threadId: null` controller. The built-in `ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and `HttpAgentServerAdapter` implement it: `threadId` is now optional at construction, request URLs derive from the currently-bound thread, and `paths` entries may be functions of the thread id (`(threadId) => string`). This lets a single custom transport back a lazy thread-creation flow instead of being pinned to one thread at construction. - [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527) [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - chore(deps): remove uuid dependency in favor of embedded uuid in core Replace direct `uuid` package imports with `@langchain/core/utils/uuid` across langgraph packages to deduplicate dependencies and align with @langchain/core's embedded UUID utilities. ## @langchain/angular@1.0.23 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 ## @langchain/react@1.0.23 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 ## @langchain/svelte@1.0.23 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 ## @langchain/vue@1.0.23 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 ## @example/ai-elements@0.1.38 ### Patch Changes - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph@1.4.2 - @langchain/react@1.0.23 ## @examples/assistant-ui-claude@0.1.38 ### Patch Changes - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph@1.4.2 - @langchain/react@1.0.23 ## @examples/ui-angular@0.0.48 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 - @langchain/langgraph@1.4.2 - @langchain/angular@1.0.23 ## @examples/ui-multimodal@0.0.24 ### Patch Changes - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph@1.4.2 - @langchain/react@1.0.23 ## @examples/ui-react@0.0.24 ### Patch Changes - Updated dependencies \[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700), [`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952), [`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph-sdk@1.9.22 - @langchain/langgraph@1.4.2 - @langchain/react@1.0.23 ## langgraph@1.0.42 ### Patch Changes - Updated dependencies \[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]: - @langchain/langgraph@1.4.2 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.23 @langchain/langgraph-api@1.3.1 @langchain/langgraph-checkpoint-redis@1.0.9 @langchain/langgraph-checkpoint@1.1.1 @langchain/langgraph-cli@1.3.1 @langchain/langgraph-sdk@1.9.22 @langchain/langgraph-supervisor@1.1.1 @langchain/langgraph-ui@1.3.1 @langchain/langgraph@1.4.2 @langchain/react@1.0.23 @langchain/svelte@1.0.23 @langchain/vue@1.0.23 |
||
|
dependabot[bot]
|
696ed53e02 |
chore(deps): bump esbuild from 0.25.12 to 0.28.1 (#2532)
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.12 to 0.28.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();</p> <p></code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md">esbuild's changelog</a>.</em></p> <blockquote> <h1>Changelog: 2025</h1> <p>This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).</p> <h2>0.27.2</h2> <ul> <li> <p>Allow import path specifiers starting with <code>#/</code> (<a href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p> <p>Previously the specification for <code>package.json</code> disallowed import path specifiers starting with <code>#/</code>, but this restriction <a href="https://redirect.github.com/nodejs/node/pull/60864">has recently been relaxed</a> and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping <code>#/*</code> to <code>./src/*</code> (previously you had to use another character such as <code>#_*</code> instead, which was more confusing). There is some more context in <a href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p> <p>This change was contributed by <a href="https://github.com/hybrist"><code>@hybrist</code></a>.</p> </li> <li> <p>Automatically add the <code>-webkit-mask</code> prefix (<a href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p> <p>This release automatically adds the <code>-webkit-</code> vendor prefix for the <a href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a> CSS shorthand property:</p> <pre lang="css"><code>/* Original code */ main { mask: url(x.png) center/5rem no-repeat } <p>/* Old output (with --target=chrome110) */<br /> main {<br /> mask: url(x.png) center/5rem no-repeat;<br /> }</p> <p>/* New output (with --target=chrome110) */<br /> main {<br /> -webkit-mask: url(x.png) center/5rem no-repeat;<br /> mask: url(x.png) center/5rem no-repeat;<br /> }<br /> </code></pre></p> <p>This change was contributed by <a href="https://github.com/BPJEnnova"><code>@BPJEnnova</code></a>.</p> </li> <li> <p>Additional minification of <code>switch</code> statements (<a href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p> <p>This release contains additional minification patterns for reducing <code>switch</code> statements. Here is an example:</p> <pre lang="js"><code>// Original code switch (x) { case 0: foo() break case 1: default: bar() } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a> publish 0.28.1 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a> security: add integrity checks to the Deno API</li> <li><a href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a> enforce non-negative size in gzip parser</li> <li><a href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a> security: forbid <code>\\</code> in local dev server requests</li> <li><a href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>: don't inline <code>using</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>: renaming of nested <code>var</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a> fix some typos</li> <li><a href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a> chore: fix some minor issues in comments (<a href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li> <li><a href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a> follow up: cjs evaluation fixes</li> <li><a href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, fix <a href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>: esm evaluation fixes</li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.25.12...v0.28.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for esbuild since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraphjs/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Christian Bromann
|
e7e8035fad |
fix(sdk): late-bind threadId on custom AgentServerAdapter transports (#2528)
## Summary - Add optional `setThreadId(threadId)` to `TransportAdapter` and call it from `client.threads.stream` when binding a custom adapter to the active thread (including the id minted on the first `submit()` of a `threadId: null` stream). - Make `threadId` optional at construction on `ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and `HttpAgentServerAdapter`; derive command/stream/state URLs from the currently-bound thread and allow `paths` entries to be `(threadId) => string`. - Add unit tests for lazy binding, re-binding, function paths, and `client.threads.stream` wiring. - Document lazy thread binding for custom backends in core SDK and framework docs (React, Vue, Svelte, Angular). |
||
|
Christian Bromann
|
ba31f045d1 |
fix(sdk): reconnect SSE streams when heartbeat idle is detected (#2529)
## Summary - Add heartbeat-adaptive idle reconnect for SSE streams (`idleReconnectStream`) so half-open connections (e.g. platform revision rollover) are detected when `: heartbeat` comments stop arriving and the existing reconnect path resumes with `Last-Event-ID` or `since`. - `"auto"` mode (default on built-in SSE transports) stays dormant until heartbeats are observed, sizes the idle window from their cadence (~15s on the platform's 5s heartbeat), and does not false-fire during long tool calls or HITL pauses. - Expose `streamIdleReconnect?: IdleReconnectMode` on `runs.stream`, `runs.joinStream`, and `threads.stream`; reuse `IdleReconnectMode` across public option types. |
||
|
Christian Bromann
|
9e114e55d3 |
chore(deps): remove uuid dependency in favor of embedded uuid in core (#2527)
## Summary - Remove the direct `uuid` npm dependency from `@langchain/langgraph`, `@langchain/langgraph-checkpoint`, `@langchain/langgraph-checkpoint-redis`, `@langchain/langgraph-api`, `@langchain/langgraph-supervisor`, and `@langchain/langgraph-sdk`. - Switch all UUID generation and validation to `@langchain/core/utils/uuid` (v4, v5, v6, v7, and `validate`). - Drop unused `@types/uuid` devDependencies from checkpoint backend packages that no longer reference `uuid` directly. fixes #2481 |
||
|
谕℃
|
829a32a30c |
fix(langgraph-checkpoint-redis): handle undefined pending writes (#2525)
## Summary Fix Redis checkpoint restore when a pending write document has no `value` field. RedisJSON omits `undefined` values, but `loadPendingWrites` always tried to deserialize: ```ts JSON.stringify(writeDoc.value) When value is missing, this produces undefined and can fail with: JSON Parse error: Unexpected EOF This breaks interrupt/resume checkpoint loading. ## Changes - Treat missing pending write value as undefined. - Apply the fix to both RedisSaver and ShallowRedisSaver. - Add unit tests for both. |
||
|
github-actions[bot]
|
34a01255e1 |
chore: version packages (#2524)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @langchain/langgraph-supervisor@1.1.0 ### Minor Changes - [#2521](https://github.com/langchain-ai/langgraphjs/pull/2521) [`56682a6`](https://github.com/langchain-ai/langgraphjs/commit/56682a69a24d0dfb210f1fb5187c51e3adc356bf) Thanks [@open-swe](https://github.com/apps/open-swe)! - feat(langgraph-supervisor): Add `addHandoffMessages` to `createSupervisor` and `createHandoffTool`, allowing supervisor-to-agent handoff bookkeeping messages to be omitted from the expert agent's message history. When `addHandoffBackMessages` is not provided, it now defaults to the same value as `addHandoffMessages`, matching the Python package behavior. `createHandoffTool` now also accepts `description` as the preferred option name while continuing to support the existing `agentDescription` option as deprecated for backwards compatibility. ### Patch Changes - [#2407](https://github.com/langchain-ai/langgraphjs/pull/2407) [`59d4765`](https://github.com/langchain-ai/langgraphjs/commit/59d4765870bc0cddf3ef594b128ab3280533cb6c) Thanks [@pragnyanramtha](https://github.com/pragnyanramtha)! - Normalize all whitespace in supervisor handoff tool names. ## @langchain/langgraph@1.4.1 ### Patch Changes - [#2520](https://github.com/langchain-ai/langgraphjs/pull/2520) [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(state): validate Zod state updates from nodes Validate node return values and Command updates against Zod state schema constraints before applying them to graph state. Fixes [#2519](https://github.com/langchain-ai/langgraphjs/issues/2519) - [#2511](https://github.com/langchain-ai/langgraphjs/pull/2511) [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(ToolNode): forward graph state to tools via `runtime.state` `ToolNode` now forwards its input to each tool through the second argument as `runtime.state`. When using `ToolNode` as a node in a LangGraph graph, this gives tools access to the current graph state for workflows that need tool-call support in LangGraph proper. Tools can type the second parameter as `ToolRuntime<StateType>` from `@langchain/core/tools` and read `runtime.state` directly. This works in every runtime, including web browsers, and removes the need for `getCurrentTaskInput()` (which relies on `node:async_hooks`/`AsyncLocalStorage`). `getCurrentTaskInput(config)` continues to work for backwards compatibility. - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 ## @langchain/langgraph-sdk@1.9.21 ### Patch Changes - [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522) [`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(stream): add per-event side-effect selector Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect` (Angular), a side-effect counterpart to `useChannel` that invokes an `onEvent` callback once per raw protocol event without re-rendering. This is the idiomatic v1 replacement for the old `onLangChainEvent` / `onCustomEvent` callbacks for analytics and logging. Backed by a new framework-agnostic `acquireChannelEffect` helper in `@langchain/langgraph-sdk/stream` that shares a ref-counted subscription with matching `useChannel` consumers. - [#2523](https://github.com/langchain-ai/langgraphjs/pull/2523) [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): stop re-streaming seeded messages on idle-thread submit An idle (finished) thread defers its root SSE pump, so the first `submit()` brings it up and the transport replays the finished run from `seq=0`. The replayed `messages` channel carries no step (unlike `values`, guarded by `maxStep`), so it rebuilt each already-complete message from an empty `message-start` and re-streamed the whole turn token-by-token — a visible "messages replay" of the existing conversation. Seal the message ids seeded from the idle `getState()` snapshot so replayed deltas can't downgrade the complete tail; the seal lifts once a newer checkpoint advances the timeline or on thread rebind, and ids from the next run are never sealed. - [#2462](https://github.com/langchain-ai/langgraphjs/pull/2462) [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3) Thanks [@christian-bromann](https://github.com/christian-bromann)! - fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect Add automatic reconnect with resume (`since` for SSE) for protocol transports, wire `AsyncCaller` through `client.threads.stream`, and expose optional reconnect tuning on `ThreadStreamOptions`. Includes integration tests against an in-process mock langgraph-api server. ## @langchain/angular@1.0.22 ### Patch Changes - [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522) [`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(stream): add per-event side-effect selector Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect` (Angular), a side-effect counterpart to `useChannel` that invokes an `onEvent` callback once per raw protocol event without re-rendering. This is the idiomatic v1 replacement for the old `onLangChainEvent` / `onCustomEvent` callbacks for analytics and logging. Backed by a new framework-agnostic `acquireChannelEffect` helper in `@langchain/langgraph-sdk/stream` that shares a ref-counted subscription with matching `useChannel` consumers. - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 ## @langchain/react@1.0.22 ### Patch Changes - [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522) [`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(stream): add per-event side-effect selector Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect` (Angular), a side-effect counterpart to `useChannel` that invokes an `onEvent` callback once per raw protocol event without re-rendering. This is the idiomatic v1 replacement for the old `onLangChainEvent` / `onCustomEvent` callbacks for analytics and logging. Backed by a new framework-agnostic `acquireChannelEffect` helper in `@langchain/langgraph-sdk/stream` that shares a ref-counted subscription with matching `useChannel` consumers. - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 ## @langchain/svelte@1.0.22 ### Patch Changes - [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522) [`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(stream): add per-event side-effect selector Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect` (Angular), a side-effect counterpart to `useChannel` that invokes an `onEvent` callback once per raw protocol event without re-rendering. This is the idiomatic v1 replacement for the old `onLangChainEvent` / `onCustomEvent` callbacks for analytics and logging. Backed by a new framework-agnostic `acquireChannelEffect` helper in `@langchain/langgraph-sdk/stream` that shares a ref-counted subscription with matching `useChannel` consumers. - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 ## @langchain/vue@1.0.22 ### Patch Changes - [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522) [`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e) Thanks [@christian-bromann](https://github.com/christian-bromann)! - feat(stream): add per-event side-effect selector Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect` (Angular), a side-effect counterpart to `useChannel` that invokes an `onEvent` callback once per raw protocol event without re-rendering. This is the idiomatic v1 replacement for the old `onLangChainEvent` / `onCustomEvent` callbacks for analytics and logging. Backed by a new framework-agnostic `acquireChannelEffect` helper in `@langchain/langgraph-sdk/stream` that shares a ref-counted subscription with matching `useChannel` consumers. - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 ## @example/ai-elements@0.1.37 ### Patch Changes - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]: - @langchain/react@1.0.22 - @langchain/langgraph@1.4.1 ## @examples/assistant-ui-claude@0.1.37 ### Patch Changes - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]: - @langchain/react@1.0.22 - @langchain/langgraph@1.4.1 ## @examples/ui-angular@0.0.47 ### Patch Changes - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 - @langchain/angular@1.0.22 - @langchain/langgraph@1.4.1 ## @examples/ui-multimodal@0.0.23 ### Patch Changes - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]: - @langchain/react@1.0.22 - @langchain/langgraph@1.4.1 ## @examples/ui-react@0.0.23 ### Patch Changes - Updated dependencies \[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e), [`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b), [`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3), [`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]: - @langchain/langgraph-sdk@1.9.21 - @langchain/react@1.0.22 - @langchain/langgraph@1.4.1 ## langgraph@1.0.41 ### Patch Changes - Updated dependencies \[[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7), [`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]: - @langchain/langgraph@1.4.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>@langchain/angular@1.0.22 @langchain/langgraph-sdk@1.9.21 @langchain/langgraph-supervisor@1.1.0 @langchain/langgraph@1.4.1 @langchain/react@1.0.22 @langchain/svelte@1.0.22 @langchain/vue@1.0.22 |
||
|
open-swe[bot]
|
febba20e49 | fix(internal): update changelog | ||
|
Christian Bromann
|
17c44a38b7 |
fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect (#2462)
## Summary - Add automatic reconnect for v2 `ProtocolSseTransportAdapter` and `ProtocolWebSocketTransportAdapter` (resume via `since` on SSE, full buffer replay on WebSocket, with `MaxWebSocketReconnectAttemptsError` when the budget is exceeded). - Wire `AsyncCaller` and reconnect defaults through `client.threads.stream`, with optional `maxReconnectAttempts`, `reconnectDelayMs`, and `onReconnect` on `ThreadStreamOptions`. - Disable auto-reconnect when a custom `fetch` is passed (test/mocks), and add `pnpm test:int` integration tests using `client.threads.stream` + `run.start` against an in-process mock server. --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Pragnyan Ramtha
|
59d4765870 |
fix(langgraph-supervisor): normalize handoff tool whitespace (#2407)
## Summary - normalize all whitespace runs in supervisor handoff agent names - prevent generated handoff tool names from retaining spaces after the first normalized segment - add focused coverage for a multi-word agent name and a patch changeset for `@langchain/langgraph-supervisor` ## Validation - `git diff --check` -> passed - `pnpm --dir libs/langgraph-supervisor exec vitest run src/tests/supervisor.test.ts` -> 5 passed - `pnpm --filter @langchain/langgraph-supervisor build:internal` -> passed, including `attw` and `publint` ## Notes The sibling `langgraph-swarm` handoff helper already uses global whitespace replacement; this aligns supervisor handoff naming with that behavior. Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Christian Bromann
|
2da5c3374f |
fix(langgraph): validate Zod state updates from nodes (#2520)
## Summary - Validates StateGraph node return values and Command updates against Zod state schema constraints before applying writes. - Preserves Overwrite behavior by validating reducer overwrites against stored value schemas. - Adds regression coverage for invalid Zod node returns and Command updates. Fixes #2519 --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
Christian Bromann
|
7c3e9e93f3 |
fix(sdk): stop re-streaming seeded messages on idle-thread submit (#2523)
## Summary - Fixes a visible "messages replay" where opening a finished thread and submitting re-streamed every existing message token-by-token. - Root cause: an idle thread defers its root SSE pump, so the first `submit()` replays the finished run from `seq=0`. The `messages` channel carries no step (unlike `values`, guarded by `#maxStep`), so it rebuilt each already-complete message from an empty `message-start`, clobbering the tail seeded from `getState()`. - Adds a message-id seal in `RootMessageProjection`: ids seeded from an idle thread's `getState()` snapshot drop replayed `messages` deltas in `handleMessage()`. The seal is cleared on thread rebind (`reset()`) and lifts in `applyValues()` once a strictly-newer checkpoint `step` advances the timeline past the seed. `controller.hydrate()` only seals for idle threads (`!threadActive`) — active threads keep streaming their live tail, and ids from the next run are never sealed. --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
Christian Bromann
|
3855985dd0 |
fix(sdk): add per-event channel effect selector (#2522)
## Summary - Add a side-effect counterpart to `useChannel`: `useChannelEffect` (React, Svelte, Vue) and `injectChannelEffect` (Angular). It invokes an `onEvent` callback once per raw protocol event and returns nothing, so it never re-renders — the idiomatic v1 replacement for the removed `onLangChainEvent` / `onCustomEvent` callbacks used for analytics/logging. - Back all four bindings with a new framework-agnostic `acquireChannelEffect(registry, channels, namespace, options)` helper in `@langchain/langgraph-sdk/stream`. It acquires the same ref-counted `channelProjection` as `useChannel` (so an effect consumer and a matching `useChannel` share one server subscription and survive thread swaps), diffs the shared store by event identity, skips events buffered before it attaches (no double-counting history on a late mount), and resets correctly across thread rebinds. - API matches the agreed shape with `target`, `enabled`, `replay` (defaults to `false`/live-only — opposite of `useChannel`), `bufferSize`, `onEvent`, and `onError`. Callbacks are read from a ref/lazy wrapper so fresh inline closures never re-subscribe. - Update selector docs and `v1-migration.md` in all four SDKs, noting the callback now receives v1 protocol events (`lifecycle.*`, `tools.*`, `messages.*`, `custom`) rather than legacy LangChain event names. --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
open-swe[bot]
|
56682a69a2 |
feat(supervisor): add addHandoffMessages option [closes #2499] (#2521)
## Description Adds an `addHandoffMessages` option to `createSupervisor` and `createHandoffTool` (defaulting to `true` for backward compatibility). When `false`, the supervisor-to-agent handoff bookkeeping messages (the supervisor `AIMessage` with the handoff tool call and the handoff `ToolMessage`) are omitted from the expert agent's message history, matching the Python `langgraph-supervisor` behavior. This avoids invalid tool-call sequences for providers that strictly validate them. ## Release Note Add `addHandoffMessages` option to `@langchain/langgraph-supervisor` to omit supervisor-to-agent handoff messages from expert agent history. ## Test Plan - [ ] Verify expert agent history excludes handoff `AIMessage`/`ToolMessage` when `addHandoffMessages: false` Made by [Open SWE](https://openswe.vercel.app) closes #2499 --------- Co-authored-by: Christian Bromann <731337+christian-bromann@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Christian Bromann <git@bromann.dev> |
||
|
Christian Bromann
|
ef04db316d |
docs: document first-class graph-state access for ToolNode tools (#2511)
Tools running inside a ToolNode can already read the current graph state via `getCurrentTaskInput()`, but this was not documented as a first-class option and the browser-safe variant (passing config explicitly) was not surfaced. This adds: - JSDoc on getCurrentTaskInput documenting the optional config arg and browser usage - A ToolNode JSDoc example showing how tools access graph state and runtime context - Browser-safe guidance in the agents context docs and the pass-run-time-values-to-tools how-to (`getCurrentTaskInput(config)`) - A regression test verifying a ToolNode tool can read graph state via getCurrentTaskInput(config) Closes #2506 |