mirror of
https://github.com/langchain-ai/langsmith-java.git
synced 2026-07-25 21:25:45 -04:00
John Kennedy
8b1dff9a1e
## Security Alert Patch Resolves all 6 open high-severity Dependabot alerts in the Maven dependency graph. ### Packages Updated | Package | Resolved change | Strategy | Scope | CVEs resolved | |---|---|---|---|---| | com.fasterxml.jackson.core:jackson-databind | 2.15.3 -> 2.18.8; 2.21.0 -> 2.21.4 | Parent bump for Palantir plus constrained Dokka classpaths | Build/dev only | CVE-2026-54512, CVE-2026-54513 | | org.bouncycastle:bcpg-jdk18on | 1.80 -> 1.84 | Constraint on Kotlin publishing validation | Build/dev only | CVE-2026-3505 | | org.codehaus.plexus:plexus-utils | 4.0.2 -> 4.0.3 | Constraint on Shadow plugin classpath | Test/build only | CVE-2025-67030 | ### Strategy Notes - Palantir Java Format moves from 2.89.0 to 2.93.0, the first release that declares patched Jackson 2.21.4. - Dokka 2.2.0 is the latest release and still declares Jackson 2.15.3, so its buildscript and worker configurations are constrained to 2.18.8. Remove the constraint when Dokka publishes a patched dependency graph. - Kotlin publishing validation selects Bouncy Castle 1.80 internally, so that isolated configuration is constrained to 1.84. - Shadow 8.3.8 still declares Plexus Utils 4.0.2. Shadow 9.4.3 was assessed but failed the repository R8 compatibility test, so the plugin remains at 8.3.8 with a buildscript-only Plexus constraint. ### Advisory Details - CVE-2026-54512 / GHSA-j3rv-43j4-c7qm: Jackson polymorphic type validator bypass via generic type parameters. - CVE-2026-54513 / GHSA-rmj7-2vxq-3g9f: Jackson array subtype allowlist bypass. - CVE-2026-3505 / GHSA-cj8j-37rh-8475: Bouncy Castle uncontrolled resource consumption. - CVE-2025-67030 / GHSA-6fmv-xxpf-w3cw: Plexus Utils directory traversal in extractFile. ### Linear Tickets No matching open Linear tickets found. ### Verification - [x] All project dependency reports contain no affected vulnerable versions - [x] Kotlin and Java lint pass - [x] Full Gradle test suite passes - [x] ProGuard and R8 compatibility checks pass - [x] Dokka Javadoc generation passes - [x] git diff --check passes
LangSmith Examples
This module contains runnable Kotlin examples organized by feature:
example/- SDK examples (ListRuns, Dataset, PromptManagement, RecordExperiment, E2eEval)example/otel/- OpenTelemetry tracing examples
Prerequisites
All examples require:
./gradlew :langsmith-java-example:run -Pexample=ExampleName -Dlangchain.langsmithApiKey=your_api_key
Alternatively, you can use environment variables:
export LANGSMITH_API_KEY=your_api_key
The langchain.baseUrl system property (or LANGSMITH_ENDPOINT environment variable) is optional and defaults to https://api.smith.langchain.com/ if not set.
OpenTelemetry Tracing Examples
Located in src/main/kotlin/com/langchain/smith/example/otel/
OpenAI + LangSmith (Real API Calls)
Make actual OpenAI API calls with automatic tracing to LangSmith.
./gradlew :langsmith-java-example:run -Pexample=OtelOpenAI \
-Dlangchain.langsmithApiKey=your_api_key \
-DOPENAI_API_KEY=your_openai_key \
-DLANGSMITH_PROJECT=my-project # optional, defaults to "default"
View traces at https://smith.langchain.com
LangSmith (Standalone)
Send mock traces to LangSmith without external API calls.
./gradlew :langsmith-java-example:run -Pexample=OtelLangSmith \
-Dlangchain.langsmithApiKey=your_api_key \
-DLANGSMITH_PROJECT=my-project # optional, defaults to "default"
View traces at https://smith.langchain.com
Spring Boot API to LangSmith
REST API with OpenTelemetry traces sent to LangSmith.
# Start server
./gradlew :langsmith-java-example:run -Pexample=SpringBootLangSmith \
-Dlangchain.langsmithApiKey=your_api_key \
-DLANGSMITH_PROJECT=my-project # optional
# In another terminal, test endpoints:
curl -X POST http://localhost:8080/api/chat \
-H "Content-Type: application/json" \
-d '{"message": "Hello!"}'
curl "http://localhost:8080/api/analyze?text=This%20is%20great"
Prompt Management Example
Located in src/main/kotlin/com/langchain/smith/example/
Prompt Management (Getting Started)
RECOMMENDED - Clean, simple example following the same pattern as the Dataset example.
./gradlew :langsmith-java-example:run -Pexample=PromptManagement \
-Dlangchain.langsmithApiKey=your_api_key
Features demonstrated:
- Create prompt repositories using
client.repos().create() - Add prompt content with variables using
client.commits().update() - List and filter prompts using
client.repos().list() - Retrieve prompt content using
client.commits().retrieve() - View prompts in the LangSmith UI
This example follows the LangSmith Prompt Management docs and uses the SDK directly.
**Additional features:**
- Use prompts with OpenAI to generate responses
- Update prompt metadata and descriptions
- Pull specific commit versions
- System + user message prompts