langchain-ai/langgraphjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraphjs.git synced 2026-07-21 16:45:24 -04:00
Code Issues 108 Packages Projects Releases 20 Wiki Activity
3,011 Commits 158 Branches 532 Tags
@langchain/langgraph@1.4.7
Commit Graph

3011 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot] 2174637623 chore: version packages (#2572) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph@1.4.7

### Patch Changes

- [#2571](https://github.com/langchain-ai/langgraphjs/pull/2571)
[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): drop unused zod-to-json-schema peer dependency

Remove the vestigial `zod-to-json-schema` (and its
`peerDependenciesMeta`/dev) declarations. JSON Schema generation now
flows through `@langchain/core`'s Zod v3/v4 interop (`toJsonSchema`), so
the old `zod-to-json-schema@^3.x` peer (which pins `zod@^3.24.1`) is no
longer needed and was the last source of install-time peer conflicts
with Zod v4. Closes
[#1706](https://github.com/langchain-ai/langgraphjs/issues/1706).

## @example/ai-elements@0.1.43

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

## @examples/assistant-ui-claude@0.1.43

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

## @examples/ui-angular@0.0.53

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

## @examples/ui-multimodal@0.0.29

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

## @examples/ui-react@0.0.29

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

## langgraph@1.0.47

### Patch Changes

- Updated dependencies
\[[`85ba859`](https://github.com/langchain-ai/langgraphjs/commit/85ba859b6f60f4bf193d3313fa24149efe05491b)]:
    -   @langchain/langgraph@1.4.7

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/langgraph@1.4.7 		2026-06-25 14:47:39 -07:00
Christian Bromann 82e07d06b4 docs(checkpoint): document edge runtime compatibility and persistence flush 
Clarify that checkpoint writes are awaited before invoke/stream resolve,
and document Cloudflare Workers limitations and workarounds for Postgres
and Redis checkpointers. Closes #1692.
 2026-06-25 11:30:59 -07:00
Christian Bromann 85ba859b6f fix(langgraph): drop unused zod-to-json-schema dependency (#2571) 
## Summary
- Remove the vestigial `zod-to-json-schema` peer/dev dependency from
`@langchain/langgraph` (`libs/langgraph-core`) and the `langgraph`
umbrella package. Nothing in source imports it anymore — graph JSON
Schema generation flows through `@langchain/core/utils/json_schema`'s
`toJsonSchema`, which uses Zod v4's native `toJSONSchema` with a v3
fallback.
- This was the last remaining `zod@^3.24.1` peer constraint, which is
what produced the install-time conflict with Zod v4 reported in #1706.
- Prune the unused `zod-to-json-schema` declaration from 6 example
projects (`multi_agent`, `chatbot-simulation-evaluation`, `reflection`,
`rewoo`, `plan-and-execute`, `quickstart`) that declared but never used
it. Kept it in `rag`, `how-tos`, and `chatbots`, whose notebooks
genuinely call `zodToJsonSchema`.
- Regenerate `pnpm-lock.yaml`.

Fixes #1706
 2026-06-25 11:06:46 -07:00
github-actions[bot] 86389fa3a6 chore: version packages (#2567) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.3

### Patch Changes

- [#2566](https://github.com/langchain-ai/langgraphjs/pull/2566)
[`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-checkpoint-postgres): prevent createAgent failures with
PostgresSaver

Add BaseCheckpointSaver.toJSON() so ConfigurableModel can stringify
runnable config without traversing pg Pool timers, and default missing
checkpoint maps on load/copy so resume no longer crashes on undefined
versions_seen. Closes
[#1808](https://github.com/langchain-ai/langgraphjs/issues/1808).

## @langchain/langgraph-checkpoint-postgres@1.0.4

### Patch Changes

- [#2566](https://github.com/langchain-ai/langgraphjs/pull/2566)
[`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-checkpoint-postgres): prevent createAgent failures with
PostgresSaver

Add BaseCheckpointSaver.toJSON() so ConfigurableModel can stringify
runnable config without traversing pg Pool timers, and default missing
checkpoint maps on load/copy so resume no longer crashes on undefined
versions_seen. Closes
[#1808](https://github.com/langchain-ai/langgraphjs/issues/1808).

## @langchain/langgraph-api@1.4.1

### Patch Changes

- [#2568](https://github.com/langchain-ai/langgraphjs/pull/2568)
[`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-api): support configurable TypeScript loaders in dev
server

Add `node_loader` to `langgraph.json` (and `LANGGRAPH_NODE_LOADER` env
override) so projects using reflect-metadata can use `ts-node`
(`--loader ts-node/esm`) instead of the default tsx CLI. Other loaders
default to `--import`; only registered shorthands like `ts-node` use
`--loader`. `--no-reload` now also disables tsx's internal watch mode.
Closes [#1834](https://github.com/langchain-ai/langgraphjs/issues/1834).

-   Updated dependencies \[]:
    -   @langchain/langgraph-ui@1.4.1

## @langchain/langgraph-cli@1.4.1

### Patch Changes

- [#2568](https://github.com/langchain-ai/langgraphjs/pull/2568)
[`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-api): support configurable TypeScript loaders in dev
server

Add `node_loader` to `langgraph.json` (and `LANGGRAPH_NODE_LOADER` env
override) so projects using reflect-metadata can use `ts-node`
(`--loader ts-node/esm`) instead of the default tsx CLI. Other loaders
default to `--import`; only registered shorthands like `ts-node` use
`--loader`. `--no-reload` now also disables tsx's internal watch mode.
Closes [#1834](https://github.com/langchain-ai/langgraphjs/issues/1834).

- Updated dependencies
\[[`38d15e2`](https://github.com/langchain-ai/langgraphjs/commit/38d15e2f1f9dded34665a602cd9311cbcf5fbefc)]:
    -   @langchain/langgraph-api@1.4.1

## @langchain/langgraph@1.4.6

### Patch Changes

-
[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): emit valid UUIDs for exit-mode delta task_ids

Exit-mode DeltaChannel writes used a step-prefixed synthetic task id
that produced a 6-segment string Postgres rejects for
`checkpoint_writes.task_id uuid` in LangGraph API. Embed the superstep
in the first UUID group instead, matching langchain-ai/langgraph#8165.

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457),
[`091a46f`](https://github.com/langchain-ai/langgraphjs/commit/091a46f32ddd3a85ee89e35fb9ea953dfc4cf8b4)]:
    -   @langchain/langgraph-sdk@1.9.25
    -   @langchain/langgraph-checkpoint@1.1.3

## @langchain/langgraph-sdk@1.9.25

### Patch Changes

- [#2565](https://github.com/langchain-ai/langgraphjs/pull/2565)
[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): bundle pure-ESM deps into CJS build to fix ERR_REQUIRE_ESM

Bundle the pure-ESM dependencies `p-retry` and `p-queue` (and their
transitive ESM-only deps) into the build output so the CJS artifact no
longer does a top-level `require()` of an ESM module. This fixes
`ERR_REQUIRE_ESM` for CommonJS consumers on Node versions where
`require(ESM)` is not enabled by default (&lt; 20.19 / &lt; 22.12).
Closes [#2562](https://github.com/langchain-ai/langgraphjs/issues/2562).

## @langchain/angular@1.0.26

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]:
    -   @langchain/langgraph-sdk@1.9.25

## @langchain/react@1.0.26

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]:
    -   @langchain/langgraph-sdk@1.9.25

## @langchain/svelte@1.0.26

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]:
    -   @langchain/langgraph-sdk@1.9.25

## @langchain/vue@1.0.26

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457)]:
    -   @langchain/langgraph-sdk@1.9.25

## @langchain/langgraph-ui@1.4.1



## @example/ai-elements@0.1.42

### Patch Changes

- Updated dependencies
\[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph@1.4.6
    -   @langchain/react@1.0.26

## @examples/assistant-ui-claude@0.1.42

### Patch Changes

- Updated dependencies
\[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph@1.4.6
    -   @langchain/react@1.0.26

## @examples/ui-angular@0.0.52

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457),
[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph-sdk@1.9.25
    -   @langchain/langgraph@1.4.6
    -   @langchain/angular@1.0.26

## @examples/ui-multimodal@0.0.28

### Patch Changes

- Updated dependencies
\[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph@1.4.6
    -   @langchain/react@1.0.26

## @examples/ui-react@0.0.28

### Patch Changes

- Updated dependencies
\[[`0558e47`](https://github.com/langchain-ai/langgraphjs/commit/0558e472b7697304c62cb6fe69cc3005e8e1a457),
[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph-sdk@1.9.25
    -   @langchain/langgraph@1.4.6
    -   @langchain/react@1.0.26

## langgraph@1.0.46

### Patch Changes

- Updated dependencies
\[[`03a0d8b`](https://github.com/langchain-ai/langgraphjs/commit/03a0d8b8632082e6dbf4a96fcf37f8f67151b74f)]:
    -   @langchain/langgraph@1.4.6

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.26 @langchain/langgraph-api@1.4.1 @langchain/langgraph-checkpoint-postgres@1.0.4 @langchain/langgraph-checkpoint@1.1.3 @langchain/langgraph-cli@1.4.1 @langchain/langgraph-sdk@1.9.25 @langchain/langgraph-ui@1.4.1 @langchain/langgraph@1.4.6 @langchain/react@1.0.26 @langchain/svelte@1.0.26 @langchain/vue@1.0.26 		2026-06-24 17:51:02 -07:00
Christian Bromann 03a0d8b863 fix(langgraph): emit valid UUIDs for exit-mode delta task_ids 
Exit-mode DeltaChannel writes used a step-prefixed synthetic task id that
Postgres rejects for checkpoint_writes.task_id uuid in LangGraph API. Embed
the superstep in the first UUID group instead, matching langgraph#8165.
 2026-06-23 18:31:07 -07:00
Christian Bromann 38d15e2f1f fix(langgraph-api): support configurable TypeScript loaders in dev server (#2568) 
## Summary
- Add configurable TypeScript loader support for the in-memory dev
server to fix reflect-metadata / `emitDecoratorMetadata` incompatibility
with tsx (esbuild).
- Introduce `node_loader` on Node `langgraph.json` configs and
`LANGGRAPH_NODE_LOADER` env override; default remains `tsx` CLI watch
mode.
- Generalize non-tsx loaders to `node [--watch] --import <loader>
--import preload entrypoint`, with shorthand mapping for `ts-node` →
`ts-node/esm`.
- Add `spawn-args` helper + unit tests; add `ts-node` as optional peer
dependency of `@langchain/langgraph-api`.

Fixes #1834
 2026-06-23 09:43:07 -07:00
Christian Bromann 091a46f32d fix(langgraph-checkpoint-postgres): prevent createAgent failures with PostgresSaver (#2566) 
## Summary
- Add `BaseCheckpointSaver.toJSON()` so runnable
`configurable.__pregel_checkpointer` can be JSON-stringified without
traversing backend clients (fixes the circular `Timeout` error when
using `createAgent` with `PostgresSaver`).
- Harden `copyCheckpoint()` and `PostgresSaver._loadCheckpoint()` to
default missing `channel_versions` and `versions_seen` to `{}`, fixing
resume crashes on `__input__` after a failed first run.
- Add unit and integration tests covering stringify safety and missing
`versions_seen` recovery.

Fixes #1808
 2026-06-22 15:23:18 -07:00
Christian Bromann 0558e472b7 fix(sdk): bundle pure-ESM deps into CJS build to fix ERR_REQUIRE_ESM (#2565) 
## Summary
- Fix `ERR_REQUIRE_ESM` in `@langchain/langgraph-sdk` for CommonJS
consumers on Node < 20.19 / < 22.12: the CJS build no longer does a
top-level `require()` of the pure-ESM `p-retry`/`p-queue`. They (and
their transitive ESM-only deps) are now bundled and transpiled into
relative CJS chunks.
- Add per-package build overrides via an optional `tsdown.config.ts`,
mirroring the langchainjs convention. `internal/build` discovers and
merges it (`config: false` disables tsdown's own discovery so the
config's imports resolve from the package dir), and re-exports
`defineConfig` from `@langchain/build` so packages get type-safe configs
without depending on `tsdown` directly.
- Remove the leftover `libs/checkpoint-redis/langchain.config.js` (from
the old `@langchain/scripts` build) — it was the only package still
carrying one and the current tsdown build ignores it.

Fixes #2562
 2026-06-22 14:56:09 -07:00
Christian Bromann 379bfd9a7d test(langgraph-checkpoint-validation): cover channel carry-over reconstruction across checkpoints 
Add a getTuple conformance test reproducing #2555: a node that updates
only a subset of channels must not drop the channels it left untouched.

Delta-storing savers (Postgres, Redis) persist only the channels in
`newVersions` on each `put`, so on read they must reconstruct the
carried-over channels from blobs written by ancestor checkpoints. The
existing getTuple spec only re-wrote the same channel in the child
checkpoint, so it never exercised carry-over reconstruction — which is
how the Redis saver shipped 1.0.9 without it (fixed in 1.0.10, #2336).

The new test runs against every saver and fails on the buggy behavior
(returns `{ stepCount }` instead of `{ messages, stepCount }`).
 2026-06-22 14:43:05 -07:00
github-actions[bot] 31261c3be5 chore: version packages (#2558) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint-mongodb@1.4.0

### Minor Changes

- [#1928](https://github.com/langchain-ai/langgraphjs/pull/1928)
[`3d7fcea`](https://github.com/langchain-ai/langgraphjs/commit/3d7fcea7d7ea7f1203d24be9df607d5a8e8717bc)
Thanks [@Mihailoff](https://github.com/Mihailoff)! - Add TTL support for
automatic checkpoint expiration

    -   Add optional `ttl` parameter to MongoDBSaver (value in seconds)
    -   Add `setup()` method to create TTL indexes on collections
    -   Add `upserted_at` timestamp to documents when TTL is enabled
- Each write refreshes TTL (expires after inactivity, not creation)

### Patch Changes

- [#2556](https://github.com/langchain-ai/langgraphjs/pull/2556)
[`bee3c91`](https://github.com/langchain-ai/langgraphjs/commit/bee3c91d0adc315ebde0622d8c4b1fff041c1bfd)
Thanks [@mohamedkhaled4053](https://github.com/mohamedkhaled4053)! - Fix
`MongoDBSaver.putWrites` throwing `MongoServerError: Invalid
BulkOperation, Batch cannot be empty` when called with an empty `writes`
array. This is reached by human-in-the-loop / `interrupt()` flows, where
a task can complete producing zero channel writes and LangGraph calls
`putWrites(config, [], taskId)`. `putWrites` now no-ops on empty writes,
matching the behavior of the postgres and sqlite savers (which iterate
and naturally skip empty batches).

- [#2550](https://github.com/langchain-ai/langgraphjs/pull/2550)
[`2b8cc2f`](https://github.com/langchain-ai/langgraphjs/commit/2b8cc2f3fd5c9d3c33b56e013292daf5d936428e)
Thanks [@lazydiv](https://github.com/lazydiv)! -
feat(checkpoint-mongodb): add setup() to create required indexes

## @langchain/langgraph-api@1.4.0

### Minor Changes

- [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559)
[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(langgraph-cli): add `deploy` command for LangSmith Deployment

Port the Python CLI's `langgraph deploy` workflow to
`@langchain/langgraph-cli`, including local and remote build paths,
deployment lifecycle subcommands (`list`, `revisions list`, `delete`,
`logs`), and host-backend client utilities with tests.

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph-api): preserve non-empty response_metadata on protocol-v2
state messages

The protocol-v2 state normalizer stripped `response_metadata` from
messages,
dropping data that HITL flows rely on — an interrupt's card is carried
on
    `AIMessage.response_metadata` (e.g. `{ cards: ... }`). Non-empty
    `response_metadata` is now retained so the card reaches the client.

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206)]:
    -   @langchain/langgraph-ui@1.4.0

## @langchain/langgraph-cli@1.4.0

### Minor Changes

- [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559)
[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(langgraph-cli): add `deploy` command for LangSmith Deployment

Port the Python CLI's `langgraph deploy` workflow to
`@langchain/langgraph-cli`, including local and remote build paths,
deployment lifecycle subcommands (`list`, `revisions list`, `delete`,
`logs`), and host-backend client utilities with tests.

### Patch Changes

- Updated dependencies
\[[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206),
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e),
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-api@1.4.0

## @langchain/langgraph-ui@1.4.0

### Minor Changes

- [#2559](https://github.com/langchain-ai/langgraphjs/pull/2559)
[`48cbdd2`](https://github.com/langchain-ai/langgraphjs/commit/48cbdd23fdf29277530f6aa05c397c9902e81206)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(langgraph-cli): add `deploy` command for LangSmith Deployment

Port the Python CLI's `langgraph deploy` workflow to
`@langchain/langgraph-cli`, including local and remote build paths,
deployment lifecycle subcommands (`list`, `revisions list`, `delete`,
`logs`), and host-backend client utilities with tests.

## @langchain/langgraph@1.4.5

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24

## @langchain/langgraph-sdk@1.9.24

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

## @langchain/angular@1.0.25

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24

## @langchain/react@1.0.25

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24

## @langchain/svelte@1.0.25

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24

## @langchain/vue@1.0.25

### Patch Changes

- [#2557](https://github.com/langchain-ai/langgraphjs/pull/2557)
[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): apply state update and goto alongside interrupt resume

    `respond(decision, { update, goto })` now maps to LangGraph's
`Command(resume, update, goto)`, so a human-in-the-loop UI can commit a
state
update (e.g. push the interrupt card into state) in the **same
superstep** as
the resume — one checkpoint, no separate `updateState` write, no
flicker.
`@langchain/langgraph-api` forwards `update`/`goto` through
`input.respond`,
and `@langchain/core` message instances in `update` are serialized to
dicts
before transport, exactly like `submit()`. Bumps `@langchain/protocol`
to
    `^0.0.18` for the `Goto` type.

`respond`/`respondAll` also apply `update` **optimistically** (mirroring
`submit()`): the pushed messages paint immediately, with stable ids
minted so
the resumed run's echo reconciles them in place. Without this the
interrupt is
cleared the instant `respond()` dispatches while the pushed card only
reappears
a server round-trip later — so the card would flicker in that gap. The
optimistic state settles on the resumed run's terminal (pending → sent,
or
    rolled back on a failure before any echo).

User-initiated optimistic writes (`submit()` / `respond()` /
`respondAll()`) now
commit to the store **synchronously**, in the same tick as the
triggering event,
instead of being coalesced onto the next macrotask. This lets a
framework render
the pushed message in the **same commit** as any local UI state the
caller flips
alongside it (e.g. a HITL form swapping its inputs for the resolved
card), so the
card no longer blinks out for the one-macrotask window before the flush
lands.
    High-frequency streaming writes keep their macrotask coalescing.

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24

## @example/ai-elements@0.1.41

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/react@1.0.25
    -   @langchain/langgraph@1.4.5

## @examples/assistant-ui-claude@0.1.41

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/react@1.0.25
    -   @langchain/langgraph@1.4.5

## @examples/ui-angular@0.0.51

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24
    -   @langchain/angular@1.0.25
    -   @langchain/langgraph@1.4.5

## @examples/ui-multimodal@0.0.27

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/react@1.0.25
    -   @langchain/langgraph@1.4.5

## @examples/ui-react@0.0.27

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph-sdk@1.9.24
    -   @langchain/react@1.0.25
    -   @langchain/langgraph@1.4.5

## langgraph@1.0.45

### Patch Changes

- Updated dependencies
\[[`b1e856d`](https://github.com/langchain-ai/langgraphjs/commit/b1e856d987ac16148dc0872d1fecf70e659ef28e)]:
    -   @langchain/langgraph@1.4.5

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.25 @langchain/langgraph-api@1.4.0 @langchain/langgraph-checkpoint-mongodb@1.4.0 @langchain/langgraph-cli@1.4.0 @langchain/langgraph-sdk@1.9.24 @langchain/langgraph-ui@1.4.0 @langchain/langgraph@1.4.5 @langchain/react@1.0.25 @langchain/svelte@1.0.25 @langchain/vue@1.0.25 		2026-06-22 11:40:07 -07:00
Christian Bromann 5d279df5d5 chore(deps): bump langchain (#2564) 
Bump langchainjs to latest release.

---------

Signed-off-by: Christian Bromann <git@bromann.dev>
Co-authored-by: open-swe[bot] <215916821+open-swe[bot]@users.noreply.github.com>
 2026-06-22 11:38:06 -07:00
Christian Bromann 48cbdd23fd feat(langgraph-cli): add deploy command for LangSmith Deployment (#2559) 
## Summary
- Add `langgraphjs deploy` to `@langchain/langgraph-cli`, porting the
Python CLI's LangSmith Deployment workflow for JS projects.
- Support local Docker build/push and remote source-archive upload
paths, plus `deploy list`, `deploy revisions list`, `deploy delete`, and
`deploy logs`.
- Introduce host-backend client, archive/ignore/output helpers, and unit
tests; wire the command into the CLI entrypoint and add the `ignore`
dependency.

Test on our deployment cookbook:
```
pnpm run deploy

> js-langsmith@0.1.0 deploy /Users/christian.bromann/Sites/LangChain/deployment-cookbook/js-langsmith
> langgraphjs deploy

Note: 'langgraphjs deploy' is in beta. Expect frequent updates and improvements.

Skipping reserved env var: LANGSMITH_API_KEY
Skipping reserved env var: LANGSMITH_TENANT_ID
Docker is installed but not running.
Start Docker and try again.
Using remote build instead.

1. Looking up deployment 'deployment-cookbook-agent'
   No deployment found. Will create.
2. Creating deployment 'deployment-cookbook-agent'
   Deployment ID: fc41ac21-0251-4caf-9f6b-e8e381520e59
3. Creating source archive
   Archive created (0.1 MB)
4. Requesting upload URL
5. Uploading source
   Uploading (0.1 MB)... 100%
6. Triggering remote build
   View status: https://smith.langchain.com/o/d7ca4f49-e65f-4c96-8d03-e1d713acb728/host/deployments/fc41ac21-0251-4caf-9f6b-e8e381520e59
   QUEUED... (9s)
   AWAITING_BUILD... (18s)
   BUILDING... (3m 13s)
   AWAITING_DEPLOY... (3m 32s)
   DEPLOYING... (4m 50s)
   Deployment successful!
   URL: https://deployment-cookbook-agent-3569d4ef8d405f40850d56230f67258b.us.langgraph.app
   View status: https://smith.langchain.com/o/d7ca4f49-e65f-4c96-8d03-e1d713acb728/host/deployments/fc41ac21-0251-4caf-9f6b-e8e381520e59
```
 2026-06-22 09:30:50 -07:00
lazyDev 2b8cc2f3fd feat(checkpoint): add setup() to create required MongoDB indexes (#2550) 
## Summary

Fixes #2551

`MongoDBSaver` queries `checkpoints` and `checkpoint_writes` collections
by `thread_id`, `checkpoint_ns`, and `checkpoint_id`, but never creates
indexes on these fields. As the collections grow, every `getTuple()`,
`list()`, and `putWrites()` call triggers a **full collection scan**.

In production with ~450K checkpoints and ~570K checkpoint_writes, this
caused:
- `getState` taking **5-10 seconds** per request (scanning all 450K docs
each time)
- Total API response times of **30-40 seconds** instead of **3 seconds**

### Changes

- Adds a `setup()` method to `MongoDBSaver` that creates a compound
index `{ thread_id: 1, checkpoint_ns: 1, checkpoint_id: -1 }` on both
collections
- The method is idempotent (`createIndex` is a no-op when the index
already exists), safe to call on every app start
- Follows the same pattern as `MongoDBStore.start()` which already
creates indexes

### Before / After (production, 450K checkpoints)

| Metric | Before | After |
|---|---|---|
| Docs examined per query | 445,801 | 1 |
| `checkpoints` query | 5,173ms | <10ms |
| `checkpoint_writes` query | 925ms | <10ms |

### Test plan

- [x] Unit test added verifying `setup()` creates indexes on both
collections with correct key spec
- [x] Existing integration tests pass

---------

Signed-off-by: Christian Bromann <git@bromann.dev>
Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-06-22 08:25:03 -07:00
dependabot[bot] 617cac92a4 chore(deps-dev): bump typeorm from 0.3.28 to 0.3.29 (#2563) 
Bumps [typeorm](https://github.com/typeorm/typeorm) from 0.3.28 to
0.3.29.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typeorm/typeorm/releases">typeorm's
releases</a>.</em></p>
<blockquote>
<h2>0.3.29</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: fix up aggregate methods ambiguous column by <a
href="https://github.com/Cprakhar"><code>@​Cprakhar</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11822">typeorm/typeorm#11822</a></li>
<li>fix: prevent eager-loaded entities from overwriting manual relations
by <a href="https://github.com/LeviHeber"><code>@​LeviHeber</code></a>
in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11267">typeorm/typeorm#11267</a></li>
<li>fix: release query runner when there is no migration to revert by <a
href="https://github.com/mjr128"><code>@​mjr128</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11232">typeorm/typeorm#11232</a></li>
<li>fix: add async to the method using setFindOptions() by <a
href="https://github.com/bindon"><code>@​bindon</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/10787">typeorm/typeorm#10787</a></li>
<li>chore: disable eslint errors for chai assertions by <a
href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11833">typeorm/typeorm#11833</a></li>
<li>ci(tests): Remove limitation of branches to run on by <a
href="https://github.com/OSA413"><code>@​OSA413</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11794">typeorm/typeorm#11794</a></li>
<li>ci: upgrade actions to v6 by <a
href="https://github.com/pkuczynski"><code>@​pkuczynski</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11844">typeorm/typeorm#11844</a></li>
<li>docs(v0.3): add version dropdown (stable/dev) by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11863">typeorm/typeorm#11863</a></li>
<li>fix(sap): <code>QueryBuilder</code> parameter of type JS
<code>Date</code> not escaped correctly by <a
href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11867">typeorm/typeorm#11867</a></li>
<li>feat(sap): add pool timeout by <a
href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11868">typeorm/typeorm#11868</a></li>
<li>feat(qodo): enable new review experience in v0.3 by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11910">typeorm/typeorm#11910</a></li>
<li>feat: add <code>returning</code> option to update/upsert operations
by <a href="https://github.com/naorpeled"><code>@​naorpeled</code></a>
in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11782">typeorm/typeorm#11782</a></li>
<li>test: enable repository-returning test by <a
href="https://github.com/gioboa"><code>@​gioboa</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11913">typeorm/typeorm#11913</a></li>
<li>chore(qodo): disable in progress notification in v0.3 by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11928">typeorm/typeorm#11928</a></li>
<li>ci(docs): add deploy Github Action to v0.3 branch by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11929">typeorm/typeorm#11929</a></li>
<li>chore(qodo): disable persistent comments and inline code suggestions
in v0.3 by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11989">typeorm/typeorm#11989</a></li>
<li>chore(deps): update all dependencies to the latest minor version by
<a href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12015">typeorm/typeorm#12015</a></li>
<li>fix(redis): redis cache version detection by <a
href="https://github.com/mguida22"><code>@​mguida22</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11936">typeorm/typeorm#11936</a></li>
<li>ci: remove summary comments location policy by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12117">typeorm/typeorm#12117</a></li>
<li>ci(qodo): remove /improve from pr and push commands by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12129">typeorm/typeorm#12129</a></li>
<li>ci: migrate from npm to pnpm by <a
href="https://github.com/pkuczynski"><code>@​pkuczynski</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12193">typeorm/typeorm#12193</a></li>
<li>ci(qodo): sync qodo pr agent config from master by <a
href="https://github.com/naorpeled"><code>@​naorpeled</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12265">typeorm/typeorm#12265</a></li>
<li>ci: remove docs indexing by <a
href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12435">typeorm/typeorm#12435</a></li>
<li>fix(security): validate limit() in Update/SoftDelete query builders
by <a href="https://github.com/smith-xyz"><code>@​smith-xyz</code></a>
in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12437">typeorm/typeorm#12437</a></li>
<li>chore(deps): update all minor by <a
href="https://github.com/alumni"><code>@​alumni</code></a> in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12443">typeorm/typeorm#12443</a></li>
<li>chore(release): release 0.3.29 by <a
href="https://github.com/michaelbromley"><code>@​michaelbromley</code></a>
in <a
href="https://redirect.github.com/typeorm/typeorm/pull/12442">typeorm/typeorm#12442</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/LeviHeber"><code>@​LeviHeber</code></a>
made their first contribution in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11267">typeorm/typeorm#11267</a></li>
<li><a href="https://github.com/mjr128"><code>@​mjr128</code></a> made
their first contribution in <a
href="https://redirect.github.com/typeorm/typeorm/pull/11232">typeorm/typeorm#11232</a></li>
<li><a href="https://github.com/bindon"><code>@​bindon</code></a> made
their first contribution in <a
href="https://redirect.github.com/typeorm/typeorm/pull/10787">typeorm/typeorm#10787</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md">typeorm's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">0.3.29</a>
(2026-05-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>add async to the method using setFindOptions() (<a
href="https://redirect.github.com/typeorm/typeorm/issues/10787">#10787</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/cc07c90f1de51bd31c0c450fae3a200f355c37f1">cc07c90</a>)</li>
<li>change import for process dependency (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11248">#11248</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/1c67c3b02632c92cac33f5cfd6895a92e93571d8">1c67c3b</a>)</li>
<li><strong>cli:</strong> init command loading non-existing package.json
(<a
href="https://redirect.github.com/typeorm/typeorm/issues/11947">#11947</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/4d9d1a61c68ecc9b8161abbd59594e69fe052a80">4d9d1a6</a>)</li>
<li>fix up aggregate methods ambiguous column (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11822">#11822</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/6e34756b9d6cc8b7b96cfeab869483ef62b2a7e6">6e34756</a>)</li>
<li>fix up limit with joins (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11987">#11987</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/3657db86b9c26cd3fcb839279ad0e2f2165305fa">3657db8</a>)</li>
<li>getPendingMigrations unnecessarily creating migrations table (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11672">#11672</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/1dbc22428bdfd0b33760afe7bcbb5456d9eab8be">1dbc224</a>)</li>
<li><strong>postgres:</strong> execute queries sequentially to avoid pg
8.19.0 deprecation warning (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12105">#12105</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/79829a0f63cb4620a95d73841a77099b988cc1be">79829a0</a>)</li>
<li>prevent columns with select false from being returned (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11944">#11944</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/6b20831bb7bc285a9accbdfca6563e73d818d435">6b20831</a>)</li>
<li>prevent eager-loaded entities from overwriting manual relations (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11267">#11267</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/2d8c5158db1aef458cd909db05059fff9129305a">2d8c515</a>)</li>
<li>propagate schema and database to closure junction table (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12110">#12110</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/58b403f04cfe1e0aae17e6064279cee5e1a33eb3">58b403f</a>)</li>
<li><strong>redis:</strong> redis cache version detection (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11936">#11936</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/f22c7a2358108c6656f15470250d937bf440f71d">f22c7a2</a>)</li>
<li>release query runner when there is no migration to revert (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11232">#11232</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/a46eb0a7e18df52a39e5f39ae2c4e67a89c945d9">a46eb0a</a>)</li>
<li><strong>sap:</strong> <code>QueryBuilder</code> parameter of type JS
<code>Date</code> not escaped correctly (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11867">#11867</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/51534362daed2f1cc9ce72ee0886e894892face7">5153436</a>)</li>
<li><strong>security:</strong> validate limit() in Update/SoftDelete
query builders (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12437">#12437</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/0d7991a27a13a9af7818505e51dddb52c8299d0a">0d7991a</a>)</li>
<li>virtual property handling in schema builder (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11000">#11000</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/5bd3255dbd992387c5b7940cb95295570ae56c86">5bd3255</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>add <code>returning</code> option to update/upsert operations (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11782">#11782</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/11d9767212e95e9e36e09af5e1eac4668c326551">11d9767</a>)</li>
<li><strong>sap:</strong> add pool timeout (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11868">#11868</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/b4e2ad2a6cbd941a8a665b5d7fde6bb28546ffef">b4e2ad2</a>)</li>
<li><strong>sap:</strong> support locking in select (<a
href="https://redirect.github.com/typeorm/typeorm/issues/11996">#11996</a>)
(<a
href="https://github.com/typeorm/typeorm/commit/86a9e3e1d8e019ef036ccd4935bdc6c25898cf75">86a9e3e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typeorm/typeorm/commit/0ed009a12867e302ecbc7cedfd442cc60d21c006"><code>0ed009a</code></a>
ci: add npm environment to publish job for trusted publishing</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/6ede38bb0e51939dee50c88ab7bfa88cd407e5e9"><code>6ede38b</code></a>
chore: enable trusted publishing in publish workflow</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/578d9e9636b5bd3beef6e1482f366126caf9d843"><code>578d9e9</code></a>
chore: fix pnpm publish for v0.3</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/253f060b3513f465638a05a27f75244148de8bf8"><code>253f060</code></a>
chore: disable git check on pnpm publish for v0.3</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/1b5476fd2936e925484fe126b8dd621f11d75021"><code>1b5476f</code></a>
chore: set pnpm publish branch for v0.3</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/17c6ec2e83e81312c0f1b2b27fa0a22551acd04f"><code>17c6ec2</code></a>
chore(release): release 0.3.29 (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12442">#12442</a>)</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/0ac80921c249b37886c131546ca01ab851abe0fe"><code>0ac8092</code></a>
chore(deps): update all minor (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12443">#12443</a>)</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/0d7991a27a13a9af7818505e51dddb52c8299d0a"><code>0d7991a</code></a>
fix(security): validate limit() in Update/SoftDelete query builders (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12437">#12437</a>)</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/c38c754a06618a69277cb5069845ae68a0af8ef0"><code>c38c754</code></a>
ci: remove docs indexing (<a
href="https://redirect.github.com/typeorm/typeorm/issues/12435">#12435</a>)</li>
<li><a
href="https://github.com/typeorm/typeorm/commit/1b66c44d0410bdc56a0dcefb46be41867ec0fffc"><code>1b66c44</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/typeorm/typeorm/compare/0.3.28...0.3.29">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for typeorm since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typeorm&package-manager=npm_and_yarn&previous-version=0.3.28&new-version=0.3.29)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 08:20:36 -07:00
Christian Bromann b1e856d987 feat(sdk): apply state update and goto alongside interrupt resume (#2557) 
## Summary
- Add `update` and `goto` options to `respond()` across the SDK so
resolving an interrupt can apply a state update and/or directed jump in
the **same superstep** — mapped to LangGraph's `Command(resume, update,
goto)`. The canonical use case is a HITL flow that pushes the interrupt
card into state at the moment it answers, committed in one checkpoint
with no flicker.
- `@langchain/langgraph-sdk`: new `update`/`goto` fields on
`StreamRespondAllOptions`, forwarded by
`StreamController.respond`/`respondAll`; `@langchain/core` `BaseMessage`
instances under the `messagesKey` are serialized to dicts before
transport, exactly like `submit()`.
- `@langchain/langgraph-api`: forward `update`/`goto` from
`input.respond` into the run `Command` in both the protocol service and
the embedded server.
- `@langchain/react`, `@langchain/vue`, `@langchain/svelte`,
`@langchain/angular`: document the new `respond({ update, goto })`
capability (incl. `BaseMessage` examples).
- Fix: the protocol-v2 state normalizer stripped `response_metadata`,
which HITL cards ride on (`AIMessage.response_metadata`); non-empty
`response_metadata` is now preserved.
- Add React browser tests (`interrupt_card_graph` fixture via
`createAgent`) covering the approve and reject paths: the FE-pushed card
lands in committed state exactly once and persists through a slow tool
execution.
 2026-06-22 08:20:15 -07:00
George Mihailov 3d7fcea7d7 feat(langgraph-checkpoint-mongodb): add TTL support for automatic checkpoint data expiration (#1928) 
Add optional TTL parameter to MongoDBSaver that enables automatic
expiration of checkpoints using MongoDB's TTL indexes.

- Add `ttl` option to MongoDBSaverParams (value in seconds)
- Add `setup()` method to create TTL indexes, returns Error[] for caller
to handle failures
- Add `upserted_at` timestamp to documents when TTL is enabled
- Each write refreshes TTL (expires after inactivity, not creation)

```js
  // Create checkpointer with 1-hour TTL (in seconds)                         
  const checkpointer = new MongoDBSaver({                                     
    client,                                                                   
    ttl: 3600,                                                                
  });                                                                         
                                                                              
  // Create TTL indexes (call on startup/deployment)                          
  const errors = await checkpointer.setup();                                  
  if (errors.length) {                                                        
    console.warn("Failed to create TTL indexes:", errors);                    
  } 
```

Fixes # (issue)

Ever growing records in database.

---------

Co-authored-by: Christian Bromann <git@bromann.dev>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-22 07:58:03 -07:00
dependabot[bot] d95ed2095d chore(deps-dev): bump uuid from 14.0.0 to 14.0.1 (#2560) 
Bumps [uuid](https://github.com/uuidjs/uuid) from 14.0.0 to 14.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/releases">uuid's
releases</a>.</em></p>
<blockquote>
<h2>v14.0.1</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">14.0.1</a>
(2026-06-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>add types condition to node export for moduleResolution bundler (<a
href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>) (<a
href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e">27ffae5</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md">uuid's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">14.0.1</a>
(2026-06-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>add types condition to node export for moduleResolution bundler (<a
href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>) (<a
href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e">27ffae5</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/uuidjs/uuid/commit/70177807e9229dfacde2038dc1e722f1828f358a"><code>7017780</code></a>
chore(main): release 14.0.1 (<a
href="https://redirect.github.com/uuidjs/uuid/issues/964">#964</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/f2c3e4b513e47968f568ad1bf96417c6924e83a7"><code>f2c3e4b</code></a>
chore: fix release-please workflow (<a
href="https://redirect.github.com/uuidjs/uuid/issues/963">#963</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e"><code>27ffae5</code></a>
fix: add types condition to node export for moduleResolution bundler (<a
href="https://redirect.github.com/uuidjs/uuid/issues/961">#961</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/664cb3163531f49d3a5125f732d38724621bfcaa"><code>664cb31</code></a>
Remove outdated security contact information (<a
href="https://redirect.github.com/uuidjs/uuid/issues/959">#959</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/d729016037c4e1b09a522f4854a96f4f4add9047"><code>d729016</code></a>
fix(ci): checkout PR head commit in browser workflow (<a
href="https://redirect.github.com/uuidjs/uuid/issues/957">#957</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/89a5ebcc56999fc25c95350f922693b71fb11d32"><code>89a5ebc</code></a>
Workflows (<a
href="https://redirect.github.com/uuidjs/uuid/issues/948">#948</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/196e208db33d568d8d43d5b549d5d0eb3d9b0fbf"><code>196e208</code></a>
chore: fix workflow (<a
href="https://redirect.github.com/uuidjs/uuid/issues/947">#947</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/95af4489be459d6ba14d137b6fcd87ffd0953e91"><code>95af448</code></a>
chore: update workflows (<a
href="https://redirect.github.com/uuidjs/uuid/issues/946">#946</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/3b57f95555ab1b8432213264b5eaa318958fb8fe"><code>3b57f95</code></a>
chore: add workflow_dispatch (<a
href="https://redirect.github.com/uuidjs/uuid/issues/944">#944</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/a433096a74e1d1815432fb1bed8115369785a1a9"><code>a433096</code></a>
chore: add 12.x and 13.x maintenance release branches (<a
href="https://redirect.github.com/uuidjs/uuid/issues/941">#941</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uuid&package-manager=npm_and_yarn&previous-version=14.0.0&new-version=14.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 07:53:38 -07:00
Mohamed Khaled bee3c91d0a fix(langgraph-checkpoint-mongodb): no-op putWrites on empty writes (#2556) 
## Summary

`MongoDBSaver.putWrites` builds a `bulkWrite` operations array from
`writes` and calls `collection.bulkWrite(operations)`. When `writes` is
empty, `operations` is empty and the MongoDB driver throws:

```
MongoServerError: Invalid BulkOperation, Batch cannot be empty
```

This is reached in normal operation by **human-in-the-loop /
`interrupt()`** flows: when a graph interrupts to wait for input, a task
can complete producing **zero channel writes**, so LangGraph calls
`putWrites(config, [], taskId)` and the saver throws.

The other first-party savers don't hit this — `checkpoint-postgres` and
`checkpoint-sqlite` iterate over `writes`, so an empty array is a
natural no-op. The sibling `store.ts` in this same package already
guards its bulk write with `if (bulkOps.length > 0)`. `putWrites` was
simply missing the equivalent guard.

## Fix

Skip the `bulkWrite` call when there are no operations, mirroring the
existing guard in `store.ts`. The guard is at the call site (not an
early return), so the existing `configurable` validation is preserved.
This aligns the MongoDB saver's empty-writes behavior with the postgres
and sqlite savers.

## Tests

- **Unit** (`checkpoints.test.ts`): asserts `putWrites(config, [],
taskId)` resolves and that `bulkWrite` is **not** called. Verified to
fail before the fix (`bulkWrite` was called with `[]`).
- **Integration** (`checkpoints.int.test.ts`): asserts `putWrites` with
empty writes resolves and persists nothing — the truest repro against
the real driver.

`pnpm build`, `pnpm lint`, `pnpm format:check`, and the unit suite all
pass locally. A changeset is included
(`@langchain/langgraph-checkpoint-mongodb` patch).

## Related

Same class of HITL / `interrupt()` + `putWrites` bug previously fixed
for the Redis saver: #1996 / #2026.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 20:25:49 -07:00
github-actions[bot] e6082e0575 chore: version packages (#2554) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph@1.4.4

### Patch Changes

- [#2552](https://github.com/langchain-ai/langgraphjs/pull/2552)
[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): isolate concurrent singleton-agent invocations by thread

`ensureLangGraphConfig` ignores the ambient `AsyncLocalStorage`
`configurable`
on root-level invokes that supply an invoke-time `thread_id` and have no
nesting
keys (ignoring graph-bound `.withConfig()` defaults). On a fresh
top-level run
the ambient `configurable` can belong to another concurrent invocation,
so its
    keys — internal scratchpad/task-input as well as user keys like
`tenant_id`/`user_id` — must not leak in; values the caller wants arrive
through
the explicit (bound + invoke-time) configs. Ambient nesting
(`__pregel_read__`)
and bound child graphs invoked from parent tasks are unaffected. This
prevents
cross-invocation leakage between concurrent `invoke()` calls on a shared
compiled
graph (e.g. BullMQ workers with `concurrency > 1`). Complements the
config-merge
fix that stopped shared graph-bound `metadata`/`configurable` objects
from being
    mutated across invocations
    ([#2040](https://github.com/langchain-ai/langgraphjs/issues/2040)).

- [#2553](https://github.com/langchain-ai/langgraphjs/pull/2553)
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): recognize JSON-erased `Overwrite` values across runtimes

`Overwrite` already survives JSON serialization in JS because
`Overwrite.toJSON()`
emits the canonical `{ "__overwrite__": value }` sentinel.
`_getOverwriteValue`
now additionally recognizes the discriminator form `{ "type":
"__overwrite__",
value }` produced when a typed `Overwrite` from another runtime (e.g. a
Python
dataclass routed through the LangGraph API server) is serialized and its
type is
erased. This keeps `Overwrite` (and `DeltaChannel`) semantics intact
across
cross-runtime JSON boundaries. These delta-channel APIs remain Beta.

## @example/ai-elements@0.1.40

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/assistant-ui-claude@0.1.40

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-angular@0.0.50

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-multimodal@0.0.26

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## @examples/ui-react@0.0.26

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

## langgraph@1.0.44

### Patch Changes

- Updated dependencies
\[[`d662cbb`](https://github.com/langchain-ai/langgraphjs/commit/d662cbbc63eebdf1312e57d41908da1b9018e783),
[`1c2aa5b`](https://github.com/langchain-ai/langgraphjs/commit/1c2aa5bfeacd8b7463e3d5b6010daee26e9217e0)]:
    -   @langchain/langgraph@1.4.4

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.24 @langchain/langgraph-checkpoint-redis@1.0.10 @langchain/langgraph-checkpoint@1.1.2 @langchain/langgraph-sdk@1.9.23 @langchain/langgraph@1.4.4 @langchain/react@1.0.24 @langchain/svelte@1.0.24 @langchain/vue@1.0.24 		2026-06-17 16:41:40 -07:00
Christian Bromann d662cbbc63 fix(langgraph): isolate concurrent singleton-agent invocations by thread (#2552) 
## Summary
- Hardens `ensureLangGraphConfig` so root-level invokes with an explicit
`thread_id` (and no nesting keys) no longer inherit langgraph-internal
`configurable` entries from `AsyncLocalStorage`, preventing
scratchpad/`currentTaskInput` leakage between concurrent `invoke()`
calls on a singleton agent.
- Adds unit tests for the new ALS-skipping behavior and an end-to-end
regression test that verifies checkpoint and tool state stay isolated
across concurrent invocations on a shared graph with `.withConfig()`.
- Complements #2531 (config merge / shared bound-config mutation fix),
which was the primary cause of cross-thread contamination reported in
#2040.

fixes #2040
 2026-06-17 16:35:38 -07:00
Christian Bromann 1c2aa5bfea fix(langgraph): recognize JSON-erased Overwrite values across runtimes (#2553) 
## Summary
- JS `Overwrite` already survives JSON serialization because
`Overwrite.toJSON()` emits the canonical `{ "__overwrite__": value }`
sentinel, which `_getOverwriteValue` recognizes.
- This adds recognition of the discriminator form `{ "type":
"__overwrite__", value }` that results when a typed `Overwrite` from
another runtime (notably a Python dataclass, post
langchain-ai/langgraph#8127) is serialized through a JSON boundary and
its type is erased.
- Brings JS to full parity with Python's three-form `_get_overwrite`
(instance, sentinel dict, discriminator dict), so `Overwrite`
round-trips both directions across the JS↔Python API boundary.
Delta-channel APIs remain Beta.
 2026-06-17 15:58:20 -07:00
github-actions[bot] 73ecaa0fb5 chore: version packages (#2536) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.2

### Patch Changes

- [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544)
[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): make concurrent DeltaChannel writes deterministic on
replay

Concurrent same-superstep writes to a `DeltaChannel` could reconstruct
from a
checkpoint differently than they were applied live, because live
execution
ordered them by task path while savers replayed them by task id. This
fixes that
    divergence in two complementary ways:

- Plain concurrent writes are now applied in the canonical `(task_id,
idx)`
order on both paths: `_applyWrites` orders them that way live, and the
`getDeltaChannelHistory` walk enforces the same order so reconstruction
matches live for every saver (Postgres, SQLite, MongoDB, Redis, and
custom).
- An `Overwrite` now wins its entire super-step: every sibling write in
the same
        step — before AND after the `Overwrite` — is discarded, matching
`BinaryOperatorAggregate`. This makes the result independent of the
(unstable)
ordering of concurrent fan-in writes; previously a plain write that
landed
        after an `Overwrite` in the same step was still folded in.

To keep reconstruction in sync with this `Overwrite` rule, any
`DeltaChannel`
that sees an `Overwrite` in a super-step is now force-snapshotted at the
next
checkpoint (and, under `"exit"` durability, in the final checkpoint).
The
post-overwrite value is materialized into `channel_values`, so a cold
read seeds
from that snapshot and never has to replay across the reset — making
live and
reconstructed state identical without changing the sparse-replay history
shape.
    These delta-channel APIs remain Beta.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): forward task metadata and name subagents via
lc_agent_name

`mapDebugTasks` now forwards filtered user-meaningful task config
metadata
(including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle
    transformer uses that metadata to set subagent `graph_name` from
`lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }`
from parent tool-dispatch tasks. Adds the shared
`EXCLUDED_METADATA_KEYS`
    constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928.

## @langchain/langgraph-checkpoint-redis@1.0.10

### Patch Changes

- [#2336](https://github.com/langchain-ai/langgraphjs/pull/2336)
[`25907eb`](https://github.com/langchain-ai/langgraphjs/commit/25907eb0be25258c26327c6c68c72bc828ee1cff)
Thanks [@MohMaherId](https://github.com/MohMaherId)! -
fix(langgraph-checkpoint-redis): persist and reconstruct full
`channel_values` across multi-node graphs.

`RedisSaver.put()` delta-filters `channel_values` to only the channels
written by the current node, but `getTuple()` had no reconstruction
logic — unlike `PostgresSaver` — so any multi-node graph whose last node
wrote a subset of channels silently lost the others. Each changed
channel is now persisted as a version-keyed `checkpoint_blob:*` entry in
`put()` and missing channels are reconstructed from those blobs on read.

`deleteThread()` now also deletes the `checkpoint_blob:*` keys. Without
this the blobs introduced above would orphan forever (memory growth) and
thread deletion would be incomplete, matching
`PostgresSaver.deleteThread()` parity.

When `ttlConfig.refreshOnRead` is enabled, reads now refresh the TTL of
the reconstructed `checkpoint_blob:*` keys alongside the checkpoint key.
Otherwise a read would keep the checkpoint alive while the blobs it
depends on expired, silently dropping reconstructed channels.

On write, `put()` now refreshes the TTL of every blob the checkpoint
references (the full `channel_versions` set), not just the channels
changed by the current node, so carried-over blobs from earlier nodes
expire in lockstep with the checkpoint doc. This write-side refresh is
independent of `refreshOnRead`. The per-channel blob writes also now run
in parallel.

Known limitation: with TTL enabled, a carried-over blob can still be
lost if it expires during an idle gap longer than `defaultTTL` (no read
or write refreshed it in time). When that happens the channel is left
cleanly absent on read rather than erroring. Fully closing this gap
(re-persisting expired blobs) is tracked as a follow-up.

## @langchain/langgraph@1.4.3

### Patch Changes

- [#2544](https://github.com/langchain-ai/langgraphjs/pull/2544)
[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): make concurrent DeltaChannel writes deterministic on
replay

Concurrent same-superstep writes to a `DeltaChannel` could reconstruct
from a
checkpoint differently than they were applied live, because live
execution
ordered them by task path while savers replayed them by task id. This
fixes that
    divergence in two complementary ways:

- Plain concurrent writes are now applied in the canonical `(task_id,
idx)`
order on both paths: `_applyWrites` orders them that way live, and the
`getDeltaChannelHistory` walk enforces the same order so reconstruction
matches live for every saver (Postgres, SQLite, MongoDB, Redis, and
custom).
- An `Overwrite` now wins its entire super-step: every sibling write in
the same
        step — before AND after the `Overwrite` — is discarded, matching
`BinaryOperatorAggregate`. This makes the result independent of the
(unstable)
ordering of concurrent fan-in writes; previously a plain write that
landed
        after an `Overwrite` in the same step was still folded in.

To keep reconstruction in sync with this `Overwrite` rule, any
`DeltaChannel`
that sees an `Overwrite` in a super-step is now force-snapshotted at the
next
checkpoint (and, under `"exit"` durability, in the final checkpoint).
The
post-overwrite value is materialized into `channel_values`, so a cold
read seeds
from that snapshot and never has to replay across the reset — making
live and
reconstructed state identical without changing the sparse-replay history
shape.
    These delta-channel APIs remain Beta.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): merge instead of overwrite in `ensureLangGraphConfig`

`ensureLangGraphConfig` now per-key merges `callbacks`, `tags`,
`metadata`,
and `configurable` across configs instead of last-write-wins, so values
bound via `.withConfig({...})` survive when a later (e.g. invoke-time)
config supplies other keys. The merged dicts are fresh objects, fixing a
by-reference mutation of shared base configs. Also drops the
now-redundant
`combineCallbacks` workaround in `streamEvents`, which double-registered
and
    double-fired graph-bound callbacks.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): preserve namespace nesting for imperative graph invokes

When a compiled graph is invoked from inside another graph's running
task
(e.g. a tool body calling `subAgent.invoke(...)`), the surrounding task
context — including the langgraph-internal nesting keys
(`__pregel_read`,
`__pregel_stream`, `checkpoint_ns`, the checkpoint map) — is propagated
    implicitly via `AsyncLocalStorage`. The base `Runnable.stream` calls
langchain-core's `ensureConfig`, which replaces the ambient
`configurable`
wholesale whenever the caller passes its own. Because `createAgent`
always
supplies a `configurable`, every tool-invoked sub-agent lost those keys,
ran
as a fresh root run, and had its streamed events flattened to the root
    namespace instead of nesting under the triggering task.

`Pregel.stream` now merges the ambient `configurable` underneath the
caller's
    (caller keys win per-key) when the ambient marks an active task
(`__pregel_read` present) but the explicit `configurable` is missing it.
Declared subgraph nodes (which already carry their own `__pregel_read`)
and
    top-level runs are unaffected.

- [#2537](https://github.com/langchain-ai/langgraphjs/pull/2537)
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): dispatch stream messages handler inline

The v3 `messages` handler (`StreamProtocolMessagesHandler`, which powers
`run.messages`) only performs a synchronous `push()` onto the run's
stream, but
its callbacks were dispatched on LangChain's background callback queue
(the
default `awaitHandlers === false`). A model or tool call inside a nested
or
parallel task could therefore flush its `messages` chunk _after_ the
Pregel
loop returned and sealed the stream, where
`IterableReadableWritableStream.push`
silently drops chunks once closed. This surfaced as empty per-message
streams
(`sub.messages`) for subagents dispatched in parallel from a single
tools step.

The handler now sets `awaitHandlers = true` so its callbacks run inline
— every
push happens during the originating model/chain call while the stream is
still
open. This avoids the global over-wait, fake-timer deadlock, and
error-path
unhandled rejections that a blanket `awaitAllCallbacks()` drain before
close
    would have introduced.

- [#2531](https://github.com/langchain-ai/langgraphjs/pull/2531)
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): forward task metadata and name subagents via
lc_agent_name

`mapDebugTasks` now forwards filtered user-meaningful task config
metadata
(including `lc_agent_name`) onto `tasks` stream payloads. The lifecycle
    transformer uses that metadata to set subagent `graph_name` from
`lc_agent_name` and recover `cause: { type: "toolCall", tool_call_id }`
from parent tool-dispatch tasks. Adds the shared
`EXCLUDED_METADATA_KEYS`
    constant to `@langchain/langgraph-checkpoint`. Ports langgraph#7928.

- [#2549](https://github.com/langchain-ai/langgraphjs/pull/2549)
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(langgraph): support DeltaChannel fields in StateSchema

Add a `DeltaValue` state field (and a `MessagesDeltaValue` prebuilt) so
a
`DeltaChannel` can be declared via `StateSchema`, not just
`Annotation.Root` or
a raw channel map. `StateSchema` now maps `DeltaValue` to a
`DeltaChannel`
(forwarding `snapshotFrequency` and the value-schema default) and
validates its
    inputs/`Overwrite` updates like `ReducedValue`.

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b)]:
    -   @langchain/langgraph-checkpoint@1.1.2
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/langgraph-sdk@1.9.23

### Patch Changes

- [#2545](https://github.com/langchain-ai/langgraphjs/pull/2545)
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): avoid scoped stream resubscribe churn

Defer final projection disposal by one microtask so framework bindings
that release and immediately reacquire the same scoped projection during
reactive updates keep the existing stream subscription instead of
rotating through root-only and scoped SSE filters.

## @langchain/angular@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/react@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/svelte@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @langchain/vue@1.0.24

### Patch Changes

- Updated dependencies
\[[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236)]:
    -   @langchain/langgraph-sdk@1.9.23

## @example/ai-elements@0.1.39

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/assistant-ui-claude@0.1.39

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/ui-angular@0.0.49

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/langgraph-sdk@1.9.23
    -   @langchain/angular@1.0.24

## @examples/ui-multimodal@0.0.25

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/react@1.0.24

## @examples/ui-react@0.0.25

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`2134c8a`](https://github.com/langchain-ai/langgraphjs/commit/2134c8a2c0bc8dd2ebea33e1191c8dd0c4b83236),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3
    -   @langchain/langgraph-sdk@1.9.23
    -   @langchain/react@1.0.24

## langgraph@1.0.43

### Patch Changes

- Updated dependencies
\[[`4487214`](https://github.com/langchain-ai/langgraphjs/commit/448721449f0801009ba76b03dd2e9c16f900bbba),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`be09666`](https://github.com/langchain-ai/langgraphjs/commit/be096663f42fe7ea9355d6c0def4854e657866d8),
[`38cfe01`](https://github.com/langchain-ai/langgraphjs/commit/38cfe01ff02490ff6bcc86c66708ef671f2e0d4b),
[`bc667a9`](https://github.com/langchain-ai/langgraphjs/commit/bc667a998ae9909d15795387dad45048e8947219)]:
    -   @langchain/langgraph@1.4.3

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-06-17 15:34:21 -07:00
Christian Bromann 448721449f fix(langgraph): replay concurrent DeltaChannel writes in live order (#2544) 
## Summary
- Fix a non-deterministic divergence where a `DeltaChannel`'s
reconstructed state did not match its live state when concurrent writes
(notably a plain write + an `Overwrite`) were applied in the same
super-step. Live execution applied concurrent writes in task-**path**
order, while every checkpointer replays persisted writes in task-**id**
order, so an `Overwrite` hard reset could land at a different point on
reload.
- `_applyWrites` (`@langchain/langgraph`) now applies concurrent
`DeltaChannel` writes in the canonical `(task_id, idx)` order — the same
order checkpointers replay them in.
- The base `getDeltaChannelHistory` (`@langchain/langgraph-checkpoint`)
now stable-sorts each ancestor checkpoint's writes by `task_id`, making
reconstruction order independent of how a saver returns `pendingWrites`.
This fixes Postgres, SQLite, MongoDB, Redis, and any custom saver in one
place; MemorySaver was already correct via its override.
 2026-06-17 15:22:57 -07:00
Christian Bromann bc667a998a fix(langgraph): support DeltaChannel fields in StateSchema (#2549) 
## Summary
- Add `DeltaValue<Value, Input>` (`state/values/delta.ts`), a
`StateSchema` field backed by a `DeltaChannel`'s batch reducer +
`snapshotFrequency` — distinct from `ReducedValue`'s single-value
reducer.
- Wire `DeltaValue` into `StateSchema`: `getChannels()` maps it to a
`DeltaChannel` (forwarding `snapshotFrequency` and seeding the initial
value from the value-schema default);
`getJsonSchema()`/`getInputJsonSchema()`/`validateInput()` handle it
(incl. `Overwrite`) like `ReducedValue`; and the type helpers infer
`State`/`Update` correctly.
- Add the `MessagesDeltaValue` prebuilt (a `DeltaChannel`-backed drop-in
for `MessagesValue`); export `DeltaValue` and `MessagesDeltaValue` from
`@langchain/langgraph`.
- Previously `DeltaChannel` was only usable via `Annotation.Root` / raw
channel maps; the `StateSchema` class and Zod paths threw. This closes
the `StateSchema` gap (Zod remains a separate follow-up).
 2026-06-17 13:08:12 -07:00
Christian Bromann e73bf8a260 test(langgraph-core): add test coverage on merging tags and metadata 2026-06-17 12:45:20 -07:00
Christian Bromann 2134c8a2c0 fix(sdk): avoid scoped stream resubscribe churn (#2545) 
## Summary
- Defer final `ChannelRegistry` projection disposal by one microtask so
same-turn reacquires keep the existing projection runtime alive.
- Preserve `registry.size` as an active-consumer diagnostic while
allowing pending disposals to be cancelled.
- Add regression coverage for release-then-reacquire behavior.
 2026-06-17 12:43:03 -07:00
Christian Bromann be096663f4 fix(langgraph): dispatch stream messages handler inline (#2537) 
## Summary
- The v3 `messages` handler (`StreamProtocolMessagesHandler`) defaulted
to background callback dispatch (`awaitHandlers === false`), so its
synchronous `push()` onto the run stream could land after the Pregel
loop sealed the stream — where `IterableReadableWritableStream.push`
silently drops chunks.
- This caused empty per-message streams (`sub.messages`) for subagents
dispatched in parallel from a single tools step.
- Fix: set `awaitHandlers = true` so the handler dispatches inline and
every push happens during the originating model/chain call while the
stream is still open. This avoids the global over-wait, fake-timer
deadlock, and error-path unhandled rejections that a blanket
`awaitAllCallbacks()` drain before `stream.close()` would have
introduced.

---------

Signed-off-by: Christian Bromann <git@bromann.dev>
 2026-06-17 12:39:29 -07:00
dependabot[bot] c18622faf7 chore(deps): bump @angular/compiler from 22.0.0 to 22.0.1 (#2541) 
Bumps
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/compiler's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/compiler/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4645850e24d2764313040b6711af93d3fd426825"><code>4645850</code></a>
refactor(compiler): Remove 80 char limit on AbstractEmitterVisitor</li>
<li><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a>
fix(compiler): disallow i18n event attributes</li>
<li><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a>
fix(compiler): sanitize <code>href</code>/<code>xlink:href</code>
attributes of any element of the ...</li>
<li><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><code>393b84c</code></a>
fix(compiler): sanitize two-way properties</li>
<li><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><code>3d9ca2f</code></a>
fix(compiler-cli): bind switch exhaustive check expressions</li>
<li><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><code>a56f1cd</code></a>
fix(compiler): more robust logic to check if regex can be optimized</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/compiler">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 12:38:21 -07:00
Christian Bromann 38cfe01ff0 fix(langgraph): merge instead of overwrite in ensureLangGraphConfig (#2531) 
## Summary
- Port of langgraph#7926: `ensureLangGraphConfig` now per-key merges
`callbacks`, `tags`, `metadata`, and `configurable` across configs
instead of overwriting, so values bound via `.withConfig({...})` are
preserved when a later config (e.g. invoke-time `thread_id`) only
supplies a subset of keys. Later configs still win per key on collision.
- Merged dicts are fresh objects, fixing a by-reference mutation where
`propagateConfigurableToMetadata` could mutate a shared bound config's
`metadata` across invocations.
- Removed the now-redundant `combineCallbacks` pre-combine in
`Pregel.streamEvents` (v1/v2). Because the config merge now folds in
`this.config` callbacks, pre-combining re-registered graph-bound
handlers and double-fired them; only call-time callbacks are forwarded
now.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 2026-06-17 12:38:03 -07:00
dependabot[bot] 4808541753 chore(deps): bump @angular/core from 22.0.0 to 22.0.1 (#2538) 
Bumps
[@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/core's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/core/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/4b0c3b8b8f1dbdb6ba31cb6499c393b1ccd81c6c"><code>4b0c3b8</code></a>
refactor(core): Update registerNgModuleType to support codegen
typechecking</li>
<li><a
href="https://github.com/angular/angular/commit/dbf64c8eb55ef5d2480abfbb4e362edccf79f971"><code>dbf64c8</code></a>
test(core): fix AI tools test flake</li>
<li><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><code>045bb73</code></a>
fix(core): validate lowercase SVG animation attribute names</li>
<li><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><code>1ee224c</code></a>
fix(compiler): disallow i18n event attributes</li>
<li><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><code>5946c18</code></a>
fix(compiler): sanitize <code>href</code>/<code>xlink:href</code>
attributes of any element of the ...</li>
<li><a
href="https://github.com/angular/angular/commit/b1f02eb5c5fd6c4a62cadf4ff4f04a3046a65002"><code>b1f02eb</code></a>
refactor(core): add internal utility</li>
<li><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><code>85d2d10</code></a>
fix(forms): harden FormGroup control lookups against prototype
shadowing</li>
<li><a
href="https://github.com/angular/angular/commit/6e3d51d7df3c8a4013cee7ec96c03835e0eeb9e2"><code>6e3d51d</code></a>
refactor(migrations): Improve <code>safeNavigationMigration</code>
heuristic</li>
<li><a
href="https://github.com/angular/angular/commit/01ea640539efda57e35807cef61abaf403686fe9"><code>01ea640</code></a>
refactor(core): Fix DirectiveDefinition interface to allow abstract
classes</li>
<li><a
href="https://github.com/angular/angular/commit/a704b08379e92294c59e47af7703edfefdaff6b8"><code>a704b08</code></a>
docs: add Signal Forms and v22 guidance to AI best-practices and
llms.txt</li>
<li>Additional commits viewable in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 11:31:42 -07:00
dependabot[bot] a9fce5ea1c chore(deps-dev): bump @vitest/browser from 4.1.8 to 4.1.9 (#2539) 
Bumps
[@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser)
from 4.1.8 to 4.1.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">@​vitest/browser's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.9</h2>
<h3>🐞 Bug Fixes</h3>
<ul>
<li>Fix <code>importOriginal</code> with optimizer and query import
[backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David
Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw
HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Wait for orchestrator readiness before resolving browser sessions
[backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus
O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a>
<a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw
HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li>
<li>Wait for iframe tester readiness before preparing [backport to v4] -
by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a>
<a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw
HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>mocker</strong>:
<ul>
<li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by
<strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>,
<strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a>
<a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw
HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>pool</strong>:
<ul>
<li>Prevent test run hang on worker crash [backport to v4] - by
<strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a>
<a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw
HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5><a
href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a>
chore: release v4.1.9 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10598">#10598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/fbc626c401ee9215ee07c0d19801cff820e289d6"><code>fbc626c</code></a>
fix(browser): wait for iframe tester readiness before preparing (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser/issues/10497">#10497</a>)
[bac...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a>
fix(browser): wait for orchestrator readiness before resolving browser
sessio...</li>
<li>See full diff in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/browser">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 20:54:33 -07:00
dependabot[bot] 7d8295dcca chore(deps): bump hono from 4.12.23 to 4.12.25 (#2548) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple
<code>Set-Cookie</code> response headers being joined into one
comma-separated value for ALB single-header responses and VPC Lattice
v2, where the value could not be split back into individual cookies and
clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request
header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request
headers being written with overwrite instead of append, where only the
last value of a header such as <code>X-Forwarded-For</code> reached the
application and the remaining values were silently dropped.
GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@​types/glob</code> by <a
href="https://github.com/rtritto"><code>@​rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir"><code>@​tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand &quot;::&quot; to eight zero groups by <a
href="https://github.com/youcefzemmar"><code>@​youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a>
4.12.25</li>
<li><a
href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/74c2cf8ef4f5cc29a876380df1ba230ff7128b3f"><code>74c2cf8</code></a>
test(aws-lambda): update integration tests (<a
href="https://redirect.github.com/honojs/hono/issues/5012">#5012</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1"><code>7ae7cba</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/1b1384815485f9d6590c6966e23a06fd07166cb7"><code>1b13848</code></a>
chore(ci): bump codecov-action to v7.0.0 (<a
href="https://redirect.github.com/honojs/hono/issues/5011">#5011</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/5fdde5ab5a7d7c89eba4d1ceab76f4a7c011cd3b"><code>5fdde5a</code></a>
4.12.24</li>
<li><a
href="https://github.com/honojs/hono/commit/c78932d745cdf6284ae131a156479ac930da0262"><code>c78932d</code></a>
fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; (<a
href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.25">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.23&new-version=4.12.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:33:25 -07:00
dependabot[bot] 1a42b9f21f chore(deps): bump tar from 7.5.11 to 7.5.16 (#2547) 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a>
7.5.16</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a>
do not apply PAX header fields to meta entries</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a>
update project deps</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a>
fix inconsequential typo in PENDINGLINKS symbol name</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a>
remove some uses of mutate-fs</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a>
7.5.15</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a>
fix: regression in pending links detection</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a>
7.5.14</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a>
stricter protection against hardlinks preempting their targets</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a>
update workflows and deps</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.11&new-version=7.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:33:12 -07:00
dependabot[bot] ada52690f6 chore(deps-dev): bump ws from 8.20.1 to 8.21.0 (#2546) 
Bumps [ws](https://github.com/websockets/ws) from 8.20.1 to 8.21.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.21.0</h2>
<h1>Features</h1>
<ul>
<li>Introduced the <code>maxBufferedChunks</code> and
<code>maxFragments</code> options (2b2abd45).</li>
</ul>
<h1>Bug fixes</h1>
<ul>
<li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li>
</ul>
<p>A high volume of tiny fragments and data chunks could be sent by a
peer, using
modest network traffic, to crash a <code>ws</code> server or client due
to OOM.</p>
<pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p>
<p>ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});</p>
<p>ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>client close - code: ${code} reason:
${reason.toString()}</code>);
});
});</p>
<p>wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>server close - code: ${code} reason:
${reason.toString()}</code>);
});
});
</code></pre></p>
<p>The vulnerability was responsibly disclosed and fixed by <a
href="https://github.com/Nadav0077">Nadav Magier</a>.</p>
<p>In vulnerable versions, the issue can be mitigated by lowering the
value of the
<code>maxPayload</code> option if possible.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a>
[dist] 8.21.0</li>
<li><a
href="https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a"><code>2b2abd4</code></a>
[security] Limit retained message parts</li>
<li><a
href="https://github.com/websockets/ws/commit/78eabe2a6677b231bf9c82601bde86ff91639490"><code>78eabe2</code></a>
[security] Add latest vulnerability to SECURITY.md</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=8.20.1&new-version=8.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:32:29 -07:00
dependabot[bot] 58a29a2e61 chore(deps-dev): bump vite from 8.0.5 to 8.0.16 (#2543) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 8.0.5 to 8.0.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.16</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.15</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.14</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.13</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.12</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.10</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.9</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.8</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.7</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16">8.0.16</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> reject UNC paths for launch-editor-middleware
(<a
href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>)
(<a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9">50b9512</a>)</li>
<li>reject windows alternate paths (<a
href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>)
(<a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546">dc245c7</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.14...v8.0.15">8.0.15</a>
(2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>send 408 on request timeout (<a
href="https://redirect.github.com/vitejs/vite/issues/22476">#22476</a>)
(<a
href="https://github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797">c85c9ee</a>)</li>
<li>update rolldown to 1.0.3 (<a
href="https://redirect.github.com/vitejs/vite/issues/22538">#22538</a>)
(<a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575">646dbed</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>capitalize error messages and remove spurious space in parse error
(<a
href="https://redirect.github.com/vitejs/vite/issues/22488">#22488</a>)
(<a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3">85a0eff</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22511">#22511</a>)
(<a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa">2686d7d</a>)</li>
<li><strong>dev:</strong> fix html-proxy cache key mismatch for /@fs/
HTML paths (<a
href="https://redirect.github.com/vitejs/vite/issues/21762">#21762</a>)
(<a
href="https://github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e">47c4213</a>)</li>
<li><strong>glob:</strong> error on relative glob in virtual module when
no files match (<a
href="https://redirect.github.com/vitejs/vite/issues/22497">#22497</a>)
(<a
href="https://github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c">5c8e98f</a>)</li>
<li><strong>optimizer:</strong> close the rolldown bundle when write()
rejects (<a
href="https://redirect.github.com/vitejs/vite/issues/22528">#22528</a>)
(<a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815">e3cfb9d</a>)</li>
<li><strong>resolve:</strong> provide onWarn for viteResolvePlugin in JS
plugin containers (<a
href="https://redirect.github.com/vitejs/vite/issues/22509">#22509</a>)
(<a
href="https://github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83">40985f1</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22566">#22566</a>)
(<a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd">3052a67</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>correct logic in <code>collectAllModules</code> function (<a
href="https://redirect.github.com/vitejs/vite/issues/22562">#22562</a>)
(<a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c">6978a9c</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.13...v8.0.14">8.0.14</a>
(2026-05-21)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/22484">#22484</a>)
(<a
href="https://github.com/vitejs/vite/commit/96efc88570b6a6ddf1a910f106920cbac07b3cf0">96efc88</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22471">#22471</a>)
(<a
href="https://github.com/vitejs/vite/commit/98b81632139d51820f82036e58d6fbbf122b77b3">98b8163</a>)</li>
<li><strong>dev:</strong> handle errors when sending messages to vite
server (<a
href="https://redirect.github.com/vitejs/vite/issues/22450">#22450</a>)
(<a
href="https://github.com/vitejs/vite/commit/e8e9a34dcf2540139de558a10187630884d10217">e8e9a34</a>)</li>
<li><strong>html:</strong> handle trailing slash paths in
transformIndexHtml (<a
href="https://redirect.github.com/vitejs/vite/issues/22480">#22480</a>)
(<a
href="https://github.com/vitejs/vite/commit/5d94d1bffdb2a15de9341194d89baec86ce1f693">5d94d1b</a>)</li>
<li><strong>optimizer:</strong> pass oxc jsx options to transformSync in
dependency scan (<a
href="https://redirect.github.com/vitejs/vite/issues/22342">#22342</a>)
(<a
href="https://github.com/vitejs/vite/commit/b3132dacea9c6e0cf526cd9f0f09d850f577c262">b3132da</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22470">#22470</a>)
(<a
href="https://github.com/vitejs/vite/commit/7cb728eb629cc677661f1bc52a044ffc0b87fc7f">7cb728e</a>)</li>
<li>remove irrelevant commits from changelog (<a
href="https://github.com/vitejs/vite/commit/2c69495f250edf01132d4a20128de19dbe836086">2c69495</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>glob:</strong> do not rewrite import path for absolute base
(<a
href="https://redirect.github.com/vitejs/vite/issues/22310">#22310</a>)
(<a
href="https://github.com/vitejs/vite/commit/0ae2844ab6d6d1ccf78a2975b8132769fc35b302">0ae2844</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/f94df87ff03b40b65e29bacdc04cc18c7bccaa4a"><code>f94df87</code></a>
release: v8.0.16</li>
<li><a
href="https://github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546"><code>dc245c7</code></a>
fix: reject windows alternate paths (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9"><code>50b9512</code></a>
fix(deps): reject UNC paths for launch-editor-middleware (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/8d1b0195fd186d0b3297d7cd17acff6c96797420"><code>8d1b019</code></a>
release: v8.0.15</li>
<li><a
href="https://github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa"><code>2686d7d</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22511">#22511</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd"><code>3052a67</code></a>
chore(deps): update rolldown-related dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22566">#22566</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815"><code>e3cfb9d</code></a>
fix(optimizer): close the rolldown bundle when write() rejects (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22528">#22528</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c"><code>6978a9c</code></a>
refactor: correct logic in <code>collectAllModules</code> function (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22562">#22562</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575"><code>646dbed</code></a>
feat: update rolldown to 1.0.3 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22538">#22538</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3"><code>85a0eff</code></a>
fix: capitalize error messages and remove spurious space in parse error
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22488">#22488</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.16/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:31:52 -07:00
dependabot[bot] 932d31ae84 chore(deps): bump @angular/common from 22.0.0 to 22.0.1 (#2540) 
Bumps
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common)
from 22.0.0 to 22.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/releases">@​angular/common's
releases</a>.</em></p>
<blockquote>
<h2>22.0.1</h2>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><img
src="https://img.shields.io/badge/c4b5fa3c92-fix-green" alt="fix -
c4b5fa3c92" /></a></td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><img
src="https://img.shields.io/badge/dfff57ede9-fix-green" alt="fix -
dfff57ede9" /></a></td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><img
src="https://img.shields.io/badge/3c2892c8df-fix-green" alt="fix -
3c2892c8df" /></a></td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><img
src="https://img.shields.io/badge/1d87c49f6e-fix-green" alt="fix -
1d87c49f6e" /></a></td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce"><img
src="https://img.shields.io/badge/1ee224ca30-fix-green" alt="fix -
1ee224ca30" /></a></td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136"><img
src="https://img.shields.io/badge/a56f1cdf8f-fix-green" alt="fix -
a56f1cdf8f" /></a></td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b"><img
src="https://img.shields.io/badge/5946c18275-fix-green" alt="fix -
5946c18275" /></a></td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918"><img
src="https://img.shields.io/badge/393b84caf8-fix-green" alt="fix -
393b84caf8" /></a></td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39"><img
src="https://img.shields.io/badge/3d9ca2f173-fix-green" alt="fix -
3d9ca2f173" /></a></td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8"><img
src="https://img.shields.io/badge/669146b0e7-fix-green" alt="fix -
669146b0e7" /></a></td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432"><img
src="https://img.shields.io/badge/562a566ead-fix-green" alt="fix -
562a566ead" /></a></td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328"><img
src="https://img.shields.io/badge/fa546f382d-fix-green" alt="fix -
fa546f382d" /></a></td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f"><img
src="https://img.shields.io/badge/29fdb98684-fix-green" alt="fix -
29fdb98684" /></a></td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://github.com/angular/angular/tree/HEAD/packages/common/issues/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f"><img
src="https://img.shields.io/badge/cdcea80327-fix-green" alt="fix -
cdcea80327" /></a></td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6"><img
src="https://img.shields.io/badge/4289c4c840-fix-green" alt="fix -
4289c4c840" /></a></td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa"><img
src="https://img.shields.io/badge/3dd433b39a-fix-green" alt="fix -
3dd433b39a" /></a></td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5"><img
src="https://img.shields.io/badge/045bb736b3-fix-green" alt="fix -
045bb736b3" /></a></td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014"><img
src="https://img.shields.io/badge/11836a670a-fix-green" alt="fix -
11836a670a" /></a></td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd"><img
src="https://img.shields.io/badge/85d2d100e3-fix-green" alt="fix -
85d2d100e3" /></a></td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae"><img
src="https://img.shields.io/badge/e51ad374ea-fix-green" alt="fix -
e51ad374ea" /></a></td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a"><img
src="https://img.shields.io/badge/55b7b5a6b6-fix-green" alt="fix -
55b7b5a6b6" /></a></td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><img
src="https://img.shields.io/badge/ffb06c0514-fix-green" alt="fix -
ffb06c0514" /></a></td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><img
src="https://img.shields.io/badge/2dd65d21e6-fix-green" alt="fix -
2dd65d21e6" /></a></td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><img
src="https://img.shields.io/badge/4254eb416c-fix-green" alt="fix -
4254eb416c" /></a></td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><img
src="https://img.shields.io/badge/167bd4c162-fix-green" alt="fix -
167bd4c162" /></a></td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/43a0e2872908d1a614139317e8dfeb52d9f69f75"><img
src="https://img.shields.io/badge/43a0e28729-fix-green" alt="fix -
43a0e28729" /></a></td>
<td>prevent external template inlay hints from appearing in TS
files</td>
</tr>
</tbody>
</table>
<h3>platform-server</h3>
<p>| Commit | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's
changelog</a>.</em></p>
<blockquote>
<h1>22.0.1 (2026-06-10)</h1>
<h2>Deprecations</h2>
<h3>platform-server</h3>
<ul>
<li>XHR support in <code>@angular/platform-server</code> is deprecated.
Use standard <code>fetch</code> APIs instead.
(cherry picked from commit
8446e46f8bc33bd4419fa7f6106b8d117ca2e099)</li>
</ul>
<h3>common</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8">c4b5fa3c92</a></td>
<td>fix</td>
<td>escape CSS string-terminating characters in escapeCssUrl</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5">dfff57ede9</a></td>
<td>fix</td>
<td>Limits date format string length</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c">3c2892c8df</a></td>
<td>fix</td>
<td>prevent prototype pollution in formatDateTime</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1">1d87c49f6e</a></td>
<td>fix</td>
<td>use cryptographically secure SHA-256 for transfer cache key
generation</td>
</tr>
</tbody>
</table>
<h3>compiler</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/1ee224ca30b9b5a7906b4f481135f1fb900fb3ce">1ee224ca30</a></td>
<td>fix</td>
<td>disallow i18n event attributes</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/a56f1cdf8fa24e335409250798ee804d95eae136">a56f1cdf8f</a></td>
<td>fix</td>
<td>more robust logic to check if regex can be optimized</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/5946c18275800539b2f47f80a573ee9312a45e8b">5946c18275</a></td>
<td>fix</td>
<td>sanitize <code>href</code>/<code>xlink:href</code> attributes of any
element of the MathML namespace</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/393b84caf8bda05b31cfac014751deed142eb918">393b84caf8</a></td>
<td>fix</td>
<td>sanitize two-way properties</td>
</tr>
</tbody>
</table>
<h3>compiler-cli</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3d9ca2f1730689232f0ba1d6eddbd7dcedd1da39">3d9ca2f173</a></td>
<td>fix</td>
<td>bind switch exhaustive check expressions</td>
</tr>
</tbody>
</table>
<h3>core</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/669146b0e74ab1bed4196ccebe1c3608f52fd4f8">669146b0e7</a></td>
<td>fix</td>
<td>disable WebMCP during SSR</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/562a566eadfdec3d9708f1a5e03e7dd2821d3432">562a566ead</a></td>
<td>fix</td>
<td>Handle synchronous errors in PendingTasks.run function</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/fa546f382de10af46d0508733c6630ffe4bef328">fa546f382d</a></td>
<td>fix</td>
<td>harden TransferState restoration against DOM clobbering</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/29fdb98684a57c99417efb5aac5a3b7f205e2c8f">29fdb98684</a></td>
<td>fix</td>
<td>prevent dangling prevConsumer reference from leaking destroyed views
(<a
href="https://redirect.github.com/angular/angular/pull/68681">#68681</a>)</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/cdcea80327e8984981144d99194d7b194da4889f">cdcea80327</a></td>
<td>fix</td>
<td>require WebMCP tool descriptions</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4289c4c8408056eb90cd25cdb76475d00de129d6">4289c4c840</a></td>
<td>fix</td>
<td>update comment for Default change detection</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/3dd433b39a66609412427f06162fb4ebc2b3e4aa">3dd433b39a</a></td>
<td>fix</td>
<td>use Object.hasOwn to handle null-prototype objects in
toStylingKeyValueArray</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/045bb736b373a5a0301cde3a4469194404b289c5">045bb736b3</a></td>
<td>fix</td>
<td>validate lowercase SVG animation attribute names</td>
</tr>
</tbody>
</table>
<h3>forms</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/11836a670af5c64153d57a2d47b4688605379014">11836a670a</a></td>
<td>fix</td>
<td>delay mcp reading the form model by a <code>tick</code></td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/85d2d100e38999f1342742573166c7af0f29b4bd">85d2d100e3</a></td>
<td>fix</td>
<td>harden FormGroup control lookups against prototype shadowing</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/e51ad374ea628de33843332f6798635dc8af02ae">e51ad374ea</a></td>
<td>fix</td>
<td>remove animationstart listener on component destroy to prevent
memory leak</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/55b7b5a6b6324c1886eca8dbc492e6af5fc4cd7a">55b7b5a6b6</a></td>
<td>fix</td>
<td>set <code>additionalProperties: false</code> on generated WebMCP
form</td>
</tr>
</tbody>
</table>
<h3>http</h3>
<table>
<thead>
<tr>
<th>Commit</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297">ffb06c0514</a></td>
<td>fix</td>
<td>ensure query parameters are inserted before URL fragments</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe">2dd65d21e6</a></td>
<td>fix</td>
<td>pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> on post/patch requests</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320">4254eb416c</a></td>
<td>fix</td>
<td>preserve empty referrer option in HttpRequest</td>
</tr>
<tr>
<td><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22">167bd4c162</a></td>
<td>fix</td>
<td>Rejects non-HTTP(S) URLs in JSONP requests</td>
</tr>
</tbody>
</table>
<h3>language-service</h3>
<p>| Commit | Type | Description |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/angular/angular/commit/2dd65d21e656186cd2598a11dd51a34fcab2ecfe"><code>2dd65d2</code></a>
fix(http): pass down the <code>reportUploadProgress</code> and
<code>reportDownloadProgress</code> ...</li>
<li><a
href="https://github.com/angular/angular/commit/1bd5a562f54b8ec7378e7c7f928285be59091f97"><code>1bd5a56</code></a>
docs: deprecate XHR support for server-side rendering in HTTP docs and
recomm...</li>
<li><a
href="https://github.com/angular/angular/commit/3c2892c8dffbbbe32940306b53779cc0c4e3f73c"><code>3c2892c</code></a>
fix(common): prevent prototype pollution in formatDateTime</li>
<li><a
href="https://github.com/angular/angular/commit/c4b5fa3c9263ac127f5053c5a03dd4b6313659b8"><code>c4b5fa3</code></a>
fix(common): escape CSS string-terminating characters in
escapeCssUrl</li>
<li><a
href="https://github.com/angular/angular/commit/4254eb416c81570a6d3313711aaeba7817305320"><code>4254eb4</code></a>
fix(http): preserve empty referrer option in HttpRequest</li>
<li><a
href="https://github.com/angular/angular/commit/167bd4c162d6af87cd207650bbc41d6c7a073c22"><code>167bd4c</code></a>
fix(http): Rejects non-HTTP(S) URLs in JSONP requests</li>
<li><a
href="https://github.com/angular/angular/commit/dfff57ede93dbc51a7eeac3311ff2b1279595ee5"><code>dfff57e</code></a>
fix(common): Limits date format string length</li>
<li><a
href="https://github.com/angular/angular/commit/1d87c49f6ee4aac27146f39ef370a87ba707a2c1"><code>1d87c49</code></a>
fix(common): use cryptographically secure SHA-256 for transfer cache key
gene...</li>
<li><a
href="https://github.com/angular/angular/commit/ffb06c0514ace66e83160e544dec63f36340c297"><code>ffb06c0</code></a>
fix(http): ensure query parameters are inserted before URL
fragments</li>
<li>See full diff in <a
href="https://github.com/angular/angular/commits/v22.0.1/packages/common">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@angular/common&package-manager=npm_and_yarn&previous-version=22.0.0&new-version=22.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 19:12:32 -07:00
MohMaherId 25907eb0be fix(langgraph-checkpoint-redis): add blob reconstruction for channel_values in multi-node graphs (#2336) 
## Summary

Fixes #2334

`RedisSaver.put()` delta-filters `channel_values` based on
`newVersions`, storing only channels written by the current node. Unlike
`PostgresSaver` (which stores channel blobs separately and reconstructs
in `getTuple()`), `RedisSaver` had no reconstruction logic — channels
not written by the last node were silently lost.

This PR completes the blob storage layer:

- **`put()`**: writes each changed channel as a version-keyed Redis JSON
key (`checkpoint_blob:{thread_id}:{ns}:{channel}:{version}`)
- **`loadCheckpointWithWrites()`**: for each channel in
`channel_versions` missing from `channel_values`, looks up the blob at
the recorded version and reconstructs full state

The `checkpoint_blobs` RediSearch index already existed with the correct
schema (`thread_id`, `checkpoint_ns`, `channel`, `version`, `type`) — it
just wasn't wired up.

### Reproduction

```json
{
  "name": "redis-checkpoint-bug",
  "private": true,
  "type": "module",
  "scripts": {
    "dev": "tsx redis-bug.ts",
    "dev:redis": "REDIS_URL=redis://localhost:6379 tsx redis-bug.ts"
  },
  "dependencies": {
    "@langchain/core": "^1.1.40",
    "@langchain/langgraph": "^1.2.9",
    "@langchain/langgraph-checkpoint": "^1.0.1",
    "@langchain/langgraph-checkpoint-redis": "1.0.4"
  },
  "devDependencies": {
    "tsx": "^4.19.0"
  }
}
```

Save the reproduction code from #2334 as `redis-bug.ts`, then:
```bash
docker run -d --name redis-test -p 6379:6379 redis:7-alpine
pnpm install && pnpm dev:redis
```

### Test plan

- [x] Added integration test: multi-channel state where node B writes
only `{status, category}` (not `messages`), verifying `messages`
survives in `getTuple()` result
- [x] Passes `oxfmt --check` and `oxlint`
- [x] Includes changeset
- [x] CI: unit tests
- [x] CI: lint + format
- [x] CI: build
 2026-06-14 17:41:13 -07:00
Mason Daugherty fa45cd95b1 ci(infra): align pinned action SHAs in setup-and-build composite action (#2535) 
The `setup-and-build` composite action pinned older SHAs for
`pnpm/action-setup`, `actions/setup-node`, and
`actions/download-artifact` than the workflows that consume it
(`ci.yml`, `release.yml`, etc.). Standardizing on the workflows' SHAs
leaves one pinned commit per action across the repo — same major
versions, just the newer (gh-verified) SHAs already running in CI.

## Changes
- Repoint the composite action's three `uses:` lines to the SHAs the
workflows already use: `pnpm/action-setup` v4 → `0e279bb9`,
`actions/setup-node` v6 → `48b55a01`, `actions/download-artifact` v4 →
`3e5f45b2`.
 2026-06-12 21:29:58 -04:00
github-actions[bot] 957cac4ea4 chore: version packages (#2526) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-checkpoint@1.1.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-checkpoint-redis@1.0.9

### Patch Changes

- [#2525](https://github.com/langchain-ai/langgraphjs/pull/2525)
[`829a32a`](https://github.com/langchain-ai/langgraphjs/commit/829a32a30cc22103b1cb0aba6a027b7ccdb68447)
Thanks [@lhlyu](https://github.com/lhlyu)! - Fix Redis checkpoint
pending write deserialization when a write document has no `value`
field. RedisJSON omits `undefined` values, so `loadPendingWrites` now
restores a missing `value` as `undefined` instead of passing it through
JSON parsing.

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-api@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-ui@1.3.1

## @langchain/langgraph-cli@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-api@1.3.1

## @langchain/langgraph@1.4.2

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph-checkpoint@1.1.1

## @langchain/langgraph-supervisor@1.1.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-ui@1.3.1

### Patch Changes

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/langgraph-sdk@1.9.22

### Patch Changes

- [#2529](https://github.com/langchain-ai/langgraphjs/pull/2529)
[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): reconnect SSE streams when heartbeat idle is detected

Detect half-open SSE connections by watching for server keep-alive
heartbeats (`: heartbeat`) and reconnecting with Last-Event-ID or
`since` when they stop. `"auto"` mode arms only after heartbeats are
observed, so long tool calls and HITL pauses do not false-fire on
heartbeat-emitting servers.

- [#2528](https://github.com/langchain-ai/langgraphjs/pull/2528)
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
Allow custom `AgentServerAdapter`s to be late-bound and re-bound to a
thread. Adapters can now implement an optional `setThreadId(threadId)`,
which `client.threads.stream(threadId, { transport })` calls when
binding the active thread — including the lazily-minted id from the
first `submit()` on a `threadId: null` controller. The built-in
`ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and
`HttpAgentServerAdapter` implement it: `threadId` is now optional at
construction, request URLs derive from the currently-bound thread, and
`paths` entries may be functions of the thread id (`(threadId) =>
string`). This lets a single custom transport back a lazy
thread-creation flow instead of being pinned to one thread at
construction.

- [#2527](https://github.com/langchain-ai/langgraphjs/pull/2527)
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
chore(deps): remove uuid dependency in favor of embedded uuid in core

Replace direct `uuid` package imports with `@langchain/core/utils/uuid`
across
langgraph packages to deduplicate dependencies and align with
@langchain/core's
    embedded UUID utilities.

## @langchain/angular@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/react@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/svelte@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @langchain/vue@1.0.23

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22

## @example/ai-elements@0.1.38

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/assistant-ui-claude@0.1.38

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/ui-angular@0.0.48

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph@1.4.2
    -   @langchain/angular@1.0.23

## @examples/ui-multimodal@0.0.24

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## @examples/ui-react@0.0.24

### Patch Changes

- Updated dependencies
\[[`ba31f04`](https://github.com/langchain-ai/langgraphjs/commit/ba31f045d1d458a456c6f6441e8ee81d32c5c700),
[`e7e8035`](https://github.com/langchain-ai/langgraphjs/commit/e7e8035fadca5f0d4cbc55bbbb77e65878ab2952),
[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph-sdk@1.9.22
    -   @langchain/langgraph@1.4.2
    -   @langchain/react@1.0.23

## langgraph@1.0.42

### Patch Changes

- Updated dependencies
\[[`9e114e5`](https://github.com/langchain-ai/langgraphjs/commit/9e114e55d362a874878a817740de42fd62ae9db7)]:
    -   @langchain/langgraph@1.4.2

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.23 @langchain/langgraph-api@1.3.1 @langchain/langgraph-checkpoint-redis@1.0.9 @langchain/langgraph-checkpoint@1.1.1 @langchain/langgraph-cli@1.3.1 @langchain/langgraph-sdk@1.9.22 @langchain/langgraph-supervisor@1.1.1 @langchain/langgraph-ui@1.3.1 @langchain/langgraph@1.4.2 @langchain/react@1.0.23 @langchain/svelte@1.0.23 @langchain/vue@1.0.23 		2026-06-12 14:33:35 -07:00
dependabot[bot] 696ed53e02 chore(deps): bump esbuild from 0.25.12 to 0.28.1 (#2532) 
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.12 to
0.28.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's
local development server could traverse outside of the serve directory
on Windows using a <code>\</code> backslash character. It happened due
to the use of Go's <code>path.Clean()</code> function, which only
handles Unix-style <code>/</code> characters. HTTP requests with paths
containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a
href="https://github.com/dellalibera"><code>@​dellalibera</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's
npm install script. This release also adds integrity checks to esbuild's
Deno install script. Now esbuild's Deno API will also fail with an error
if the downloaded esbuild binary contains something other than the
expected content.</p>
<p>Note that esbuild's Deno API installs from
<code>registry.npmjs.org</code> by default, but allows the
<code>NPM_CONFIG_REGISTRY</code> environment variable to override this
with a custom package registry. This change means that the esbuild
executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the
expected content.</p>
<p>Thanks to <a
href="https://github.com/sondt99"><code>@​sondt99</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code>
declarations (<a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined
<code>using</code> and <code>await using</code> declarations into
subsequent uses of that declaration, which then fails to dispose of the
resource correctly. This bug happened because inlining was done for
<code>let</code> and <code>const</code> declarations by avoiding doing
it for <code>var</code> declarations, which no longer worked when more
declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
  using x = new Resource()
  x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously
didn't preserve the state of the module for subsequent module
references. This was observable if <code>import()</code> or
<code>require()</code> is used to import a module multiple times. The
thrown error is supposed to be thrown by every call to
<code>import()</code> or <code>require()</code>, not just the first.
With this release, esbuild will now throw the same error every time you
call <code>import()</code> or <code>require()</code> on a module that
throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a
href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving
complex expressions inside the target of a <code>new</code> expression
(specifically an optional chain and/or a tagged template literal). The
generated code for the <code>new</code> target was not correctly wrapped
with parentheses, and either contained a syntax error or had different
semantics. These edge cases have been fixed so that they now correctly
wrap the <code>new</code> target in parentheses. Here is an example of
some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog: 2025</h1>
<p>This changelog documents all esbuild versions published in the year
2025 (versions 0.25.0 through 0.27.2).</p>
<h2>0.27.2</h2>
<ul>
<li>
<p>Allow import path specifiers starting with <code>#/</code> (<a
href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p>
<p>Previously the specification for <code>package.json</code> disallowed
import path specifiers starting with <code>#/</code>, but this
restriction <a
href="https://redirect.github.com/nodejs/node/pull/60864">has recently
been relaxed</a> and support for it is being added across the JavaScript
ecosystem. One use case is using it for a wildcard pattern such as
mapping <code>#/*</code> to <code>./src/*</code> (previously you had to
use another character such as <code>#_*</code> instead, which was more
confusing). There is some more context in <a
href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p>
<p>This change was contributed by <a
href="https://github.com/hybrist"><code>@​hybrist</code></a>.</p>
</li>
<li>
<p>Automatically add the <code>-webkit-mask</code> prefix (<a
href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p>
<p>This release automatically adds the <code>-webkit-</code> vendor
prefix for the <a
href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a>
CSS shorthand property:</p>
<pre lang="css"><code>/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
<p>/* Old output (with --target=chrome110) */<br />
main {<br />
mask: url(x.png) center/5rem no-repeat;<br />
}</p>
<p>/* New output (with --target=chrome110) */<br />
main {<br />
-webkit-mask: url(x.png) center/5rem no-repeat;<br />
mask: url(x.png) center/5rem no-repeat;<br />
}<br />
</code></pre></p>
<p>This change was contributed by <a
href="https://github.com/BPJEnnova"><code>@​BPJEnnova</code></a>.</p>
</li>
<li>
<p>Additional minification of <code>switch</code> statements (<a
href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p>
<p>This release contains additional minification patterns for reducing
<code>switch</code> statements. Here is an example:</p>
<pre lang="js"><code>// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a>
publish 0.28.1 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a>
security: add integrity checks to the Deno API</li>
<li><a
href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a>
enforce non-negative size in gzip parser</li>
<li><a
href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a>
security: forbid <code>\\</code> in local dev server requests</li>
<li><a
href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>:
don't inline <code>using</code> declarations</li>
<li><a
href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>:
renaming of nested <code>var</code> declarations</li>
<li><a
href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a>
fix some typos</li>
<li><a
href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a>
chore: fix some minor issues in comments (<a
href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a>
follow up: cjs evaluation fixes</li>
<li><a
href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>,
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>:
esm evaluation fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.25.12...v0.28.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for esbuild since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.25.12&new-version=0.28.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraphjs/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-12 14:32:55 -07:00
Christian Bromann e7e8035fad fix(sdk): late-bind threadId on custom AgentServerAdapter transports (#2528) 
## Summary
- Add optional `setThreadId(threadId)` to `TransportAdapter` and call it
from `client.threads.stream` when binding a custom adapter to the active
thread (including the id minted on the first `submit()` of a `threadId:
null` stream).
- Make `threadId` optional at construction on
`ProtocolSseTransportAdapter`, `ProtocolWebSocketTransportAdapter`, and
`HttpAgentServerAdapter`; derive command/stream/state URLs from the
currently-bound thread and allow `paths` entries to be `(threadId) =>
string`.
- Add unit tests for lazy binding, re-binding, function paths, and
`client.threads.stream` wiring.
- Document lazy thread binding for custom backends in core SDK and
framework docs (React, Vue, Svelte, Angular).
 2026-06-12 13:24:41 -07:00
Christian Bromann ba31f045d1 fix(sdk): reconnect SSE streams when heartbeat idle is detected (#2529) 
## Summary
- Add heartbeat-adaptive idle reconnect for SSE streams
(`idleReconnectStream`) so half-open connections (e.g. platform revision
rollover) are detected when `: heartbeat` comments stop arriving and the
existing reconnect path resumes with `Last-Event-ID` or `since`.
- `"auto"` mode (default on built-in SSE transports) stays dormant until
heartbeats are observed, sizes the idle window from their cadence (~15s
on the platform's 5s heartbeat), and does not false-fire during long
tool calls or HITL pauses.
- Expose `streamIdleReconnect?: IdleReconnectMode` on `runs.stream`,
`runs.joinStream`, and `threads.stream`; reuse `IdleReconnectMode`
across public option types.
 2026-06-12 13:21:51 -07:00
Christian Bromann 9e114e55d3 chore(deps): remove uuid dependency in favor of embedded uuid in core (#2527) 
## Summary
- Remove the direct `uuid` npm dependency from `@langchain/langgraph`,
`@langchain/langgraph-checkpoint`,
`@langchain/langgraph-checkpoint-redis`, `@langchain/langgraph-api`,
`@langchain/langgraph-supervisor`, and `@langchain/langgraph-sdk`.
- Switch all UUID generation and validation to
`@langchain/core/utils/uuid` (v4, v5, v6, v7, and `validate`).
- Drop unused `@types/uuid` devDependencies from checkpoint backend
packages that no longer reference `uuid` directly.

fixes #2481
 2026-06-12 10:54:29 -07:00
谕℃ 829a32a30c fix(langgraph-checkpoint-redis): handle undefined pending writes (#2525) 
## Summary

Fix Redis checkpoint restore when a pending write document has no
`value` field.

RedisJSON omits `undefined` values, but `loadPendingWrites` always tried
to deserialize:

```ts
JSON.stringify(writeDoc.value)

When value is missing, this produces undefined and can fail with:

JSON Parse error: Unexpected EOF

This breaks interrupt/resume checkpoint loading.

## Changes

- Treat missing pending write value as undefined.
- Apply the fix to both RedisSaver and ShallowRedisSaver.
- Add unit tests for both.
 2026-06-11 10:06:49 -07:00
github-actions[bot] 34a01255e1 chore: version packages (#2524) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-supervisor@1.1.0

### Minor Changes

- [#2521](https://github.com/langchain-ai/langgraphjs/pull/2521)
[`56682a6`](https://github.com/langchain-ai/langgraphjs/commit/56682a69a24d0dfb210f1fb5187c51e3adc356bf)
Thanks [@open-swe](https://github.com/apps/open-swe)! -
feat(langgraph-supervisor): Add `addHandoffMessages` to
`createSupervisor` and `createHandoffTool`, allowing supervisor-to-agent
handoff bookkeeping messages to be omitted from the expert agent's
message history. When `addHandoffBackMessages` is not provided, it now
defaults to the same value as `addHandoffMessages`, matching the Python
package behavior.

`createHandoffTool` now also accepts `description` as the preferred
option name while continuing to support the existing `agentDescription`
option as deprecated for backwards compatibility.

### Patch Changes

- [#2407](https://github.com/langchain-ai/langgraphjs/pull/2407)
[`59d4765`](https://github.com/langchain-ai/langgraphjs/commit/59d4765870bc0cddf3ef594b128ab3280533cb6c)
Thanks [@pragnyanramtha](https://github.com/pragnyanramtha)! - Normalize
all whitespace in supervisor handoff tool names.

## @langchain/langgraph@1.4.1

### Patch Changes

- [#2520](https://github.com/langchain-ai/langgraphjs/pull/2520)
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(state): validate Zod state updates from nodes

Validate node return values and Command updates against Zod state schema
    constraints before applying them to graph state.

Fixes [#2519](https://github.com/langchain-ai/langgraphjs/issues/2519)

- [#2511](https://github.com/langchain-ai/langgraphjs/pull/2511)
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(ToolNode): forward graph state to tools via `runtime.state`

`ToolNode` now forwards its input to each tool through the second
argument as `runtime.state`. When using `ToolNode` as a node in a
LangGraph graph, this gives tools access to the current graph state for
workflows that need tool-call support in LangGraph proper. Tools can
type the second parameter as `ToolRuntime<StateType>` from
`@langchain/core/tools` and read `runtime.state` directly. This works in
every runtime, including web browsers, and removes the need for
`getCurrentTaskInput()` (which relies on
`node:async_hooks`/`AsyncLocalStorage`). `getCurrentTaskInput(config)`
continues to work for backwards compatibility.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/langgraph-sdk@1.9.21

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- [#2523](https://github.com/langchain-ai/langgraphjs/pull/2523)
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): stop re-streaming seeded messages on idle-thread submit

An idle (finished) thread defers its root SSE pump, so the first
`submit()` brings it up and the transport replays the finished run from
`seq=0`. The replayed `messages` channel carries no step (unlike
`values`, guarded by `maxStep`), so it rebuilt each already-complete
message from an empty `message-start` and re-streamed the whole turn
token-by-token — a visible "messages replay" of the existing
conversation. Seal the message ids seeded from the idle `getState()`
snapshot so replayed deltas can't downgrade the complete tail; the seal
lifts once a newer checkpoint advances the timeline or on thread rebind,
and ids from the next run are never sealed.

- [#2462](https://github.com/langchain-ai/langgraphjs/pull/2462)
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect

Add automatic reconnect with resume (`since` for SSE) for protocol
transports,
wire `AsyncCaller` through `client.threads.stream`, and expose optional
reconnect tuning on `ThreadStreamOptions`. Includes integration tests
against
    an in-process mock langgraph-api server.

## @langchain/angular@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/react@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/svelte@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/vue@1.0.22

### Patch Changes

- [#2522](https://github.com/langchain-ai/langgraphjs/pull/2522)
[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @example/ai-elements@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/assistant-ui-claude@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-angular@0.0.47

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/angular@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-multimodal@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-react@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](https://github.com/langchain-ai/langgraphjs/commit/3855985dd049739f145295d236ce6aa02ae2fb0e),
[`7c3e9e9`](https://github.com/langchain-ai/langgraphjs/commit/7c3e9e93f3c7ec1dc654dac8ee8c03562ee8337b),
[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3),
[`17c44a3`](https://github.com/langchain-ai/langgraphjs/commit/17c44a38b7478e2bc4fe908a54c78ef33fb68ba3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## langgraph@1.0.41

### Patch Changes

- Updated dependencies
\[[`2da5c33`](https://github.com/langchain-ai/langgraphjs/commit/2da5c3374f7b91ba0afa607c507e2ff1591baca7),
[`ef04db3`](https://github.com/langchain-ai/langgraphjs/commit/ef04db316d680ab32b812c88cadda75638294dd3)]:
    -   @langchain/langgraph@1.4.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@langchain/angular@1.0.22 @langchain/langgraph-sdk@1.9.21 @langchain/langgraph-supervisor@1.1.0 @langchain/langgraph@1.4.1 @langchain/react@1.0.22 @langchain/svelte@1.0.22 @langchain/vue@1.0.22 		2026-06-10 17:09:31 -07:00
open-swe[bot] febba20e49 fix(internal): update changelog 2026-06-10 17:06:23 -07:00
Christian Bromann 17c44a38b7 fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect (#2462) 
## Summary
- Add automatic reconnect for v2 `ProtocolSseTransportAdapter` and
`ProtocolWebSocketTransportAdapter` (resume via `since` on SSE, full
buffer replay on WebSocket, with `MaxWebSocketReconnectAttemptsError`
when the budget is exceeded).
- Wire `AsyncCaller` and reconnect defaults through
`client.threads.stream`, with optional `maxReconnectAttempts`,
`reconnectDelayMs`, and `onReconnect` on `ThreadStreamOptions`.
- Disable auto-reconnect when a custom `fetch` is passed (test/mocks),
and add `pnpm test:int` integration tests using `client.threads.stream`
+ `run.start` against an in-process mock server.

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-10 17:05:35 -07:00
Pragnyan Ramtha 59d4765870 fix(langgraph-supervisor): normalize handoff tool whitespace (#2407) 
## Summary

- normalize all whitespace runs in supervisor handoff agent names
- prevent generated handoff tool names from retaining spaces after the
first normalized segment
- add focused coverage for a multi-word agent name and a patch changeset
for `@langchain/langgraph-supervisor`

## Validation

- `git diff --check` -> passed
- `pnpm --dir libs/langgraph-supervisor exec vitest run
src/tests/supervisor.test.ts` -> 5 passed
- `pnpm --filter @langchain/langgraph-supervisor build:internal` ->
passed, including `attw` and `publint`

## Notes

The sibling `langgraph-swarm` handoff helper already uses global
whitespace replacement; this aligns supervisor handoff naming with that
behavior.

Co-authored-by: Christian Bromann <git@bromann.dev>
 2026-06-10 16:27:18 -07:00
Christian Bromann 2da5c3374f fix(langgraph): validate Zod state updates from nodes (#2520) 
## Summary
- Validates StateGraph node return values and Command updates against
Zod state schema constraints before applying writes.
- Preserves Overwrite behavior by validating reducer overwrites against
stored value schemas.
- Adds regression coverage for invalid Zod node returns and Command
updates.

Fixes #2519

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
 2026-06-10 15:56:53 -07:00
Christian Bromann 7c3e9e93f3 fix(sdk): stop re-streaming seeded messages on idle-thread submit (#2523) 
## Summary
- Fixes a visible "messages replay" where opening a finished thread and
submitting re-streamed every existing message token-by-token.
- Root cause: an idle thread defers its root SSE pump, so the first
`submit()` replays the finished run from `seq=0`. The `messages` channel
carries no step (unlike `values`, guarded by `#maxStep`), so it rebuilt
each already-complete message from an empty `message-start`, clobbering
the tail seeded from `getState()`.
- Adds a message-id seal in `RootMessageProjection`: ids seeded from an
idle thread's `getState()` snapshot drop replayed `messages` deltas in
`handleMessage()`. The seal is cleared on thread rebind (`reset()`) and
lifts in `applyValues()` once a strictly-newer checkpoint `step`
advances the timeline past the seed. `controller.hydrate()` only seals
for idle threads (`!threadActive`) — active threads keep streaming their
live tail, and ids from the next run are never sealed.

---------

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
 2026-06-10 15:31:26 -07:00