WEBDIENSTE/langgraph
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraph.git synced 2026-09-07 18:27:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): address Git dependency review feedback

Browse Source
This commit is contained in:
John Kennedy
2026-08-11 09:40:13 -07:00
parent b51ef57707
commit 48ecb3bc81
6 changed files with 123 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/cli/README.md
+1 -1
View File
@@ -103,7 +103,7 @@ The CLI uses a `langgraph.json` configuration file with these key settings:
}
```
Git dependencies must use credential-free URLs. The CLI rejects HTTP Git URLs with userinfo because generated Dockerfiles and image layers can retain embedded usernames or tokens. For private dependencies, provide short-lived credentials through your build environment's secret-backed Git credential helper. Do not store credentials in `langgraph.json`, requirement or lock files, or a `pip_config_file` copied into the image.
Git dependencies should use credential-free URLs. The CLI conservatively scans direct `langgraph.json` dependencies, common Python package files, uv project and lock files, and common Node.js package and lock files for HTTP Git URLs with userinfo. This check is not exhaustive: generated Docker builds can copy other files, including nested requirement or constraint files, into image layers without scanning them. For private dependencies, provide short-lived credentials through your build environment's secret-backed Git credential helper. Do not store credentials in copied files such as `langgraph.json` or `pip_config_file`.
See the [full documentation](https://reference.langchain.com/python/langgraph-cli) for detailed configuration options.