7192 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
4 people	a24fc97778	fix(cli): patch missed brace-expansion dependency majors (#9360) ... Patch the remaining 1.x and 2.x copies covered by [GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr), which were not addressed by #9349. Regenerate both CLI fixture locks with their declared Yarn 1.22.22: 1.1.11/1.1.12 → 1.1.21 and 2.0.2 → 2.1.7, retaining 5.0.12 with no new packages or manifest changes. Verification: - Both fixtures: `yarn install --frozen-lockfile --ignore-scripts --non-interactive` and `yarn check --integrity --ignore-scripts` passed. - Local Node regression harness: 16 checks passed across all installed brace-expansion and real minimatch 3/9/10 consumers, including normal expansion/matching and advisory-shaped DoS payloads with a three-second subprocess deadline (direct 128k braces; minimatch 64k braces). - Every tracked text file scanned for brace-expansion; all five resolved lock entries are outside all four current advisory ranges. No additional repository copies found. - `git diff --check` passed; only three generated version/URL/integrity triplets changed. Lifecycle scripts and the full suite were intentionally not run. Existing peer-dependency warnings remain, including the checkpoint resolution mismatch in js-examples; dependency-graph ingestion and alert status were not refreshed or claimed resolved. ## References - [Plan](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846/plan) - [Slack thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846) · openai:gpt-6.1-sol (medium) Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-20 11:09:26 +01:00
Elior Nataf LackritzandGitHub	1400d25b7b	release(cli): 0.4.37 (#9351) ... Bumps the CLI to 0.4.37 to cut a release including #9333 (`langgraph deploy` defaults to serverless) and #9350 (`--verbose` no longer prints subprocess stdin), the two CLI changes merged since 0.4.36. Merging doesn't publish by itself: after it merges, run the `release` workflow with `working-directory: libs/cli`. cli==0.4.37	2026-10-19 10:03:29 -04:00
Elior Nataf LackritzandGitHub	7b23a10846	fix(cli): stop printing subprocess stdin in verbose output (#9350) ... `--verbose` printed each subprocess command followed by everything piped to its stdin, which can hold credentials. It now prints only the command line, so `langgraph up --verbose`, `langgraph build` and `langgraph deploy --verbose` no longer show the generated compose file or Dockerfile (`langgraph dockerfile` still writes the Dockerfile out).	2026-10-19 13:45:42 +00:00
4 people	8b9c1a1301	Merge PR #9349 ... Update brace-expansion from 5.0.9 to 5.0.12 in both CLI JavaScript example lockfiles to address CVE-2026-102277. Existing dependency ranges already allow the patched version; no manifests or runtime code change. Verification: generated the replacement entries with the declared Yarn 1.22.22 in an isolated dependency fixture, then checked basic brace/range expansion and `git diff --check`. Full example installs were attempted but blocked by registry.yarnpkg.com DNS/timeouts, including with npm selected as the registry; only the authentic generated package entries were transferred, preserving unrelated resolutions. Full package lint/tests were not run and CI is not claimed. ## References - [Slack thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846) · openai:gpt-6.1-sol (medium) Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-19 21:47:25 +09:00
4 people	98043c37ab	fix(cli): default deploy to serverless (#9333) ... - Default new deployments to serverless, preserving explicit deployment-type overrides. - Let the backend determine AWS serverless availability; preserve its rejection and append guidance to use --deployment-type dev. Do not detect AWS hostnames, block attempts locally, or silently fall back. - Serverless deployment on AWS works without another CLI change once the backend supports it. ## References - [Slack thread](https://langchain.slack.com/archives/C0BHM1C5R5L/p1792175194359579) Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.langchain.dev/agents/c71525bc-e760-503e-b187-6997859056c1) · openai:gpt-6.1-sol (medium) --------- Co-authored-by: Hari Dhanushkodi <hari-dhanushkodi@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-18 15:18:50 -04:00
6 people	0870f5efce	chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 9 updates (#9152) ... Bumps the minor-and-patch group in /libs/cli/js-examples with 9 updates: | Package | From | To | | --- | --- | --- | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.9` | `1.2.13` | | [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.13` | `1.4.18` | | [@eslint/eslintrc](https://github.com/eslint/eslintrc) | `3.3.6` | `3.3.7` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.68.0` | `8.70.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.68.0` | `8.70.1` | | [eslint](https://github.com/eslint/eslint) | `10.9.1` | `10.11.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.5.0` | `30.5.2` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.12` | `29.4.14` | Updates `@langchain/core` from 1.2.9 to 1.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@​langchain/core</code><a href="https://github.com/1"><code>@​1</code></a>.2.13</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11714">#11714</a> <a href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1"><code>a83dfb1</code></a> Thanks <a href="https://github.com/ccurme"><code>@​ccurme</code></a>! - Abbreviate long tool-call IDs when formatting chat messages as strings, keeping original messages unchanged.</li> </ul> <h2><code>@​langchain/core</code><a href="https://github.com/1"><code>@​1</code></a>.2.12</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11675">#11675</a> <a href="https://github.com/langchain-ai/langchainjs/commit/030a726639e0147488bc8c23c063a2e72b004c2e"><code>030a726</code></a> Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! - Preserve structured tool arguments in tracer run inputs.</li> </ul> <h2><code>@​langchain/core</code><a href="https://github.com/1"><code>@​1</code></a>.2.11</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11603">#11603</a> <a href="https://github.com/langchain-ai/langchainjs/commit/fec9cd87b01976014dd549bd2cf7849aee89a566"><code>fec9cd8</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>! - fix(core): build streaming <code>llmOutput.tokenUsage</code> from the fully-accumulated chunk instead of whichever individual chunk's <code>usage_metadata</code> arrived last</p> <p>Affects both core streaming paths — <code>.stream()</code>/<code>.streamEvents()</code> (<code>_streamIterator</code>) and <code>.invoke()</code>/<code>.generate()</code> when a streaming-preferring callback is attached (<code>_generateWithCache</code>'s <code>hasStreamingHandler</code> branch). Previously, <code>llmOutput.tokenUsage</code> was overwritten by each chunk in turn, so only the last chunk carrying <code>usage_metadata</code> won — correct for providers that emit one cumulative total on a final chunk, but wrong for providers (e.g. <code>@langchain/google</code>, <code>@langchain/anthropic</code>) that emit <code>usage_metadata</code> as a per-chunk delta across multiple chunks, where the values must be summed.</p> <p>Note for provider authors: this assumes each streamed chunk's <code>usage_metadata</code> is either a per-chunk delta or appears only on a single final chunk. A provider that instead repeats a cumulative total on every chunk will now see it summed (and inflated) in <code>llmOutput.tokenUsage</code>, matching the existing behavior of the correctly-working <code>message.usage_metadata</code> field.</p> <p>Also fixes <code>@langchain/google</code>'s <code>invoke({streaming: true})</code> path (no streaming-preferring callback attached), where <code>llmOutput</code> was never populated at all.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11590">#11590</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ffebdc2f00f3290d19f85e5afd6a297920ae584c"><code>ffebdc2</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>! - Fix OpenAI Responses API replay under Zero Data Retention when a response contains more than one reasoning item, for both v0 and v1. In v0, the default replay path now reuses <code>response_metadata.output</code> directly, preserving every reasoning item's <code>id</code>/<code>encrypted_content</code> in original order. In v1, <code>AIMessage.contentBlocks</code> (<code>outputVersion: &quot;v1&quot;</code>) is fixed the same way. <code>additional_kwargs.reasoning</code> is unchanged.</p> </li> </ul> <h2><code>@​langchain/core</code><a href="https://github.com/1"><code>@​1</code></a>.2.10</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/10047">#10047</a> <a href="https://github.com/langchain-ai/langchainjs/commit/ff1248fd49dacdb35f5da128278cd777068481d7"><code>ff1248f</code></a> Thanks <a href="https://github.com/afirstenberg"><code>@​afirstenberg</code></a>! - fix(core): BaseMessage.text use contentBlocks</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c8d12783ecc31a0816f3a47da1040fbd3c08fdbc"><code>c8d1278</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11729">#11729</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5d509ad4b8a5ed9dd4b83020b4c103ac8a69859c"><code>5d509ad</code></a> fix(openai): send in-memory prompt cache retention as in_memory (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11735">#11735</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/663b9a2076c5b274435c77524ad7730450b34f34"><code>663b9a2</code></a> feat(openai): support explicit prompt caching (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11232">#11232</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/7735b219221d6ae63eb5445fb67d26c18fce9c46"><code>7735b21</code></a> chore(infra): drop held mcp-adapters 2.0 changeset to unblock main releases (...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/34edee1153f0fa40ba6997c8ff7bd45834ca8ce8"><code>34edee1</code></a> fix(langchain): return failed returnDirect tool calls to the model (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11712">#11712</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/0fcb98b4306a771c940e78d6881d0be9f88507c1"><code>0fcb98b</code></a> fix(textsplitters): use char length for loc.lines with custom lengthFunction ...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/e4a3d1bd0c6753d4e1739a7f10064f48e6bc49ec"><code>e4a3d1b</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11683">#11683</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/a9ada857f22c4b746801e7723ffaa4c4d59db771"><code>a9ada85</code></a> fix(openai): send tool result images so the model can see them (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11690">#11690</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/485d030054ff599beea7d1070d87cac22bcef3cc"><code>485d030</code></a> chore(mcp-adapters): hold the adapter out of releases until 2.0 is ready (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11">#11</a>...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1"><code>a83dfb1</code></a> fix(core): abbreviate long tool IDs in buffer strings (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11714">#11714</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.9...@langchain/core@1.2.13">compare view</a></li> </ul> </details> <br /> Updates `@langchain/langgraph` from 1.4.13 to 1.4.18 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's releases</a>.</em></p> <blockquote> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.18</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8"><code>7a12289</code></a>]: <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.12.0</li> </ul> </li> </ul> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.18-rc.0</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8"><code>7a12289</code></a>]: <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.12.0-rc.0</li> </ul> </li> </ul> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.17</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861">#2861</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d"><code>7639085</code></a> Thanks <a href="https://github.com/casparb"><code>@​casparb</code></a>! - Add <code>GraphCallbackHandler</code> with typed <code>handleInterrupt</code> and <code>handleResume</code> events through normal callback configuration, matching Python graph lifecycle behavior. Lifecycle callbacks are awaited before terminal chain callbacks and work independently of stream mode.</li> </ul> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.16</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824">#2824</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2"><code>e75f6a0</code></a> Thanks <a href="https://github.com/eliornl"><code>@​eliornl</code></a>! - feat(langgraph): add <code>responseSchema</code> option to <code>interrupt()</code></p> <p><code>interrupt(value, { responseSchema })</code> lets a graph declare the shape of the value it expects on resume. A Zod schema validates the resume value and the parsed result is what <code>interrupt()</code> returns; a raw JSON Schema object is passed through as-is. The schema is surfaced on <code>Interrupt.response_schema</code> so clients such as Studio can render a typed form instead of a free-form JSON editor. Omitting the option keeps today's behavior.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2"><code>e75f6a0</code></a>]:</p> <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.11.1</li> </ul> </li> </ul> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.15</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794">#2794</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e"><code>83a4b62</code></a> Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! - feat(langgraph): add per-node <code>tracePolicy</code> input/output processors and <code>omitPayload</code></p> <p>Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.</p> <p>Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4"><code>3234c69</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4"><code>3234c69</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a"><code>11a4535</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105"><code>2fab6fd</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a"><code>4fc118f</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69"><code>db4bdad</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22"><code>55fa26b</code></a>]:</p> <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.11.0</li> </ul> </li> </ul> <h2><code>@​langchain/langgraph</code><a href="https://github.com/1"><code>@​1</code></a>.4.15-rc.0</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794">#2794</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e"><code>83a4b62</code></a> Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! - feat(langgraph): add per-node <code>tracePolicy</code> input/output processors and <code>omitPayload</code></p> <p>Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105"><code>2fab6fd</code></a>]:</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's changelog</a>.</em></p> <blockquote> <h2>1.4.18</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8"><code>7a12289</code></a>]: <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.12.0</li> </ul> </li> </ul> <h2>1.4.18-rc.0</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8"><code>7a12289</code></a>]: <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.12.0-rc.0</li> </ul> </li> </ul> <h2>1.4.17</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861">#2861</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d"><code>7639085</code></a> Thanks <a href="https://github.com/casparb"><code>@​casparb</code></a>! - Add <code>GraphCallbackHandler</code> with typed <code>handleInterrupt</code> and <code>handleResume</code> events through normal callback configuration, matching Python graph lifecycle behavior. Lifecycle callbacks are awaited before terminal chain callbacks and work independently of stream mode.</li> </ul> <h2>1.4.16</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824">#2824</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2"><code>e75f6a0</code></a> Thanks <a href="https://github.com/eliornl"><code>@​eliornl</code></a>! - feat(langgraph): add <code>responseSchema</code> option to <code>interrupt()</code></p> <p><code>interrupt(value, { responseSchema })</code> lets a graph declare the shape of the value it expects on resume. A Zod schema validates the resume value and the parsed result is what <code>interrupt()</code> returns; a raw JSON Schema object is passed through as-is. The schema is surfaced on <code>Interrupt.response_schema</code> so clients such as Studio can render a typed form instead of a free-form JSON editor. Omitting the option keeps today's behavior.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2"><code>e75f6a0</code></a>]:</p> <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.11.1</li> </ul> </li> </ul> <h2>1.4.15</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794">#2794</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e"><code>83a4b62</code></a> Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! - feat(langgraph): add per-node <code>tracePolicy</code> input/output processors and <code>omitPayload</code></p> <p>Transform the payloads recorded on a node's own trace run while retaining its span and timing. Processors receive raw values and fall back to the original payload if they throw. Graph state, root runs, and child runs remain unchanged when processors do not mutate their arguments.</p> <p>Matches Python's callback-level behavior: transforms also affect chain events and message streaming, so omitting outputs can suppress messages returned directly by nodes and omitting inputs can affect message deduplication.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4"><code>3234c69</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4"><code>3234c69</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a"><code>11a4535</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105"><code>2fab6fd</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a"><code>4fc118f</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69"><code>db4bdad</code></a>, <a href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22"><code>55fa26b</code></a>]:</p> <ul> <li><code>@​langchain/langgraph-sdk</code><a href="https://github.com/1"><code>@​1</code></a>.11.0</li> </ul> </li> </ul> <h2>1.4.15-rc.0</h2> <h3>Patch Changes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/ec8cb378e3c7846b2a4aea31dfc4aff8f1cbf2fb"><code>ec8cb37</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2870">#2870</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/285ed3d60c51a90c2d5698f617d6ad7ce3048ef2"><code>285ed3d</code></a> chore: version packages (rc) (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2868">#2868</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/3dd35b6d0c4d7e5d2499ce44d85ecb0c0a34e1fd"><code>3dd35b6</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2862">#2862</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d"><code>7639085</code></a> feat(langgraph): add graph lifecycle callbacks (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2861">#2861</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/ec67d5d70dc26341e92a0962d9d2f4018c310b39"><code>ec67d5d</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2852">#2852</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2"><code>e75f6a0</code></a> feat(langgraph): add responseSchema option to interrupt() (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2824">#2824</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/592fd0cab0fd9287fab1b7c7fcfd4abc44675700"><code>592fd0c</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2832">#2832</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/a3172e045b36b00244512260b041e472b915c39b"><code>a3172e0</code></a> revert(langgraph): <code>tracePolicy</code> (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2834">#2834</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/a97e6f4eaf8683cd67002bc42cf8dddf5255e29d"><code>a97e6f4</code></a> chore(deps): patch vulnerable browser and example dependencies (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2822">#2822</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/6fb9a3fe43d0e4d600fbf413392343d7242ccb63"><code>6fb9a3f</code></a> chore(deps): bump vitest from 4.1.10 to 4.1.11 (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2818">#2818</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.18/libs/langgraph-core">compare view</a></li> </ul> </details> <br /> Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslintrc/releases">@​eslint/eslintrc's releases</a>.</em></p> <blockquote> <h2>eslintrc: v3.3.7</h2> <h2><a href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7">3.3.7</a> (2026-09-01)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump js-yaml to 4.3.1 (<a href="https://redirect.github.com/eslint/eslintrc/issues/239">#239</a>) (<a href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9">f27e7c9</a>)</li> <li>update js-yaml to 4.3.2 to address security vulnerability (<a href="https://redirect.github.com/eslint/eslintrc/issues/243">#243</a>) (<a href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f">bb0d97a</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md">@​eslint/eslintrc's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7">3.3.7</a> (2026-09-01)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump js-yaml to 4.3.1 (<a href="https://redirect.github.com/eslint/eslintrc/issues/239">#239</a>) (<a href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9">f27e7c9</a>)</li> <li>update js-yaml to 4.3.2 to address security vulnerability (<a href="https://redirect.github.com/eslint/eslintrc/issues/243">#243</a>) (<a href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f">bb0d97a</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslintrc/commit/7943fa6dd55b236a539f658b88c763a4f9fbb38d"><code>7943fa6</code></a> chore: release 3.3.7 🚀 (<a href="https://redirect.github.com/eslint/eslintrc/issues/240">#240</a>)</li> <li><a href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f"><code>bb0d97a</code></a> fix: update js-yaml to 4.3.2 to address security vulnerability (<a href="https://redirect.github.com/eslint/eslintrc/issues/243">#243</a>)</li> <li><a href="https://github.com/eslint/eslintrc/commit/5b4abc9c74dd92b9eb782ca81d559a88906509e9"><code>5b4abc9</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9"><code>f27e7c9</code></a> fix: Bump js-yaml to 4.3.1 (<a href="https://redirect.github.com/eslint/eslintrc/issues/239">#239</a>)</li> <li><a href="https://github.com/eslint/eslintrc/commit/b75e1d2425deebfd1ec7f952dda7d0c4f4d65d5c"><code>b75e1d2</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/302c13310e148268f990df3edbfd10dab44f2678"><code>302c133</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/e62e7661b0d9063e42a37af5551bbcb1897e188d"><code>e62e766</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/cf27f9fd8f775d94500f2569a5bfb6a7de9cdb33"><code>cf27f9f</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/c7f4cdf1ffa86e28b5b8bf09f9e8bc7fadbf87ff"><code>c7f4cdf</code></a> docs: Update README sponsors</li> <li><a href="https://github.com/eslint/eslintrc/commit/3319822ac925e018c47fcafa351b20ea0bf6eeff"><code>3319822</code></a> docs: Update README sponsors</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7">compare view</a></li> </ul> </details> <br /> Updates `@typescript-eslint/eslint-plugin` from 8.68.0 to 8.70.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/eslint-plugin's releases</a>.</em></p> <blockquote> <h2>v8.70.1</h2> <h2>8.70.1 (2026-09-21)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>ast-spec:</strong> narrow import attribute keys to identifiers and strings (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879">#12879</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] avoid false positives on tuples with a rest element (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768">#12768</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637">#12637</a>)</li> <li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for bare any rest parameters (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818">#12818</a>)</li> <li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854">#12854</a>)</li> <li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap spread suggestions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850">#12850</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869">#12869</a>)</li> <li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow void on assignment expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873">#12873</a>)</li> <li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix from breaking code when removing <code>await</code> (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716">#12716</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-parameter-property-assignment] account for parameter reassignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880">#12880</a>)</li> <li><strong>eslint-plugin:</strong> [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845">#12845</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747">#12747</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] convert the fixer to a suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826">#12826</a>)</li> <li><strong>eslint-plugin:</strong> [no-misused-promises] handle multiple Promise constituents (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904">#12904</a>)</li> <li><strong>rule-tester:</strong> test the final autofix output instead of the first pass (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867">#12867</a>)</li> <li><strong>scope-manager:</strong> merge implicit global definitions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809">#12809</a>)</li> <li><strong>type-utils:</strong> match package specifiers on whole path components (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838">#12838</a>)</li> <li><strong>typescript-estree:</strong> resolve symlinked paths when matching files to projects (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725">#12725</a>)</li> <li><strong>typescript-estree:</strong> add missing <code>&lt;</code> token opening type arguments (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821">#12821</a>)</li> <li><strong>typescript-estree:</strong> require string literal import attribute values (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894">#12894</a>)</li> <li><strong>website:</strong> prevent playground from breaking down after opening link with the .js file type (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777">#12777</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Amin <a href="https://github.com/amiin-dev"><code>@​amiin-dev</code></a></li> <li>Brad Zacher <a href="https://github.com/bradzacher"><code>@​bradzacher</code></a></li> <li>Cameron</li> <li>Diptajoy Mistry <a href="https://github.com/diptomistry"><code>@​diptomistry</code></a></li> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li> <li>Grit <a href="https://github.com/Grit03"><code>@​Grit03</code></a></li> <li>Hugo <a href="https://github.com/hugop95"><code>@​hugop95</code></a></li> <li>Josh Goldberg ✨</li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li> <li>Mikhail Baev <a href="https://github.com/baevm"><code>@​baevm</code></a></li> <li>Om Rawat</li> <li>overlookmotel</li> <li>Sanath <a href="https://github.com/sansynx"><code>@​sansynx</code></a></li> <li>Shinji</li> <li>stoicism <a href="https://github.com/stoicism02"><code>@​stoicism02</code></a></li> <li>Vinccool96</li> <li>Younsang Na <a href="https://github.com/nayounsang"><code>@​nayounsang</code></a></li> <li>김채영 <a href="https://github.com/cchaeyoung"><code>@​cchaeyoung</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1">GitHub Releases</a> for more information.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@​typescript-eslint/eslint-plugin's changelog</a>.</em></p> <blockquote> <h2>8.70.1 (2026-09-21)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] handle multiple Promise constituents (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904">#12904</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] convert the fixer to a suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826">#12826</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747">#12747</a>)</li> <li><strong>eslint-plugin:</strong> [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845">#12845</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-parameter-property-assignment] account for parameter reassignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880">#12880</a>)</li> <li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix from breaking code when removing <code>await</code> (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716">#12716</a>)</li> <li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow void on assignment expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873">#12873</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869">#12869</a>)</li> <li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap spread suggestions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850">#12850</a>)</li> <li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854">#12854</a>)</li> <li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for bare any rest parameters (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818">#12818</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637">#12637</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] avoid false positives on tuples with a rest element (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768">#12768</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Brad Zacher <a href="https://github.com/bradzacher"><code>@​bradzacher</code></a></li> <li>Diptajoy Mistry <a href="https://github.com/diptomistry"><code>@​diptomistry</code></a></li> <li>Grit <a href="https://github.com/Grit03"><code>@​Grit03</code></a></li> <li>Hugo <a href="https://github.com/hugop95"><code>@​hugop95</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li> <li>Mikhail Baev <a href="https://github.com/baevm"><code>@​baevm</code></a></li> <li>Om Rawat</li> <li>Sanath <a href="https://github.com/sansynx"><code>@​sansynx</code></a></li> <li>Shinji</li> <li>Vinccool96</li> <li>김채영 <a href="https://github.com/cchaeyoung"><code>@​cchaeyoung</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> <h2>8.70.0 (2026-09-07)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] add rule (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12730">#12730</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated imported values used in object shorthand properties (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12780">#12780</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-condition] no false positive on RHS of a nested logical expression (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12728">#12728</a>)</li> <li><strong>eslint-plugin:</strong> [member-ordering] don't report fields that read fields declared before them (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12729">#12729</a>)</li> </ul> <h3>❤️ Thank You</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7"><code>23d38ce</code></a> chore(release): publish 8.70.1</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/9d82e4b1d9011da31d62d14387bb5a539853fafa"><code>9d82e4b</code></a> chore: expand eslint-plugin rules test files glob (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12878">#12878</a>)</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/f7482f636b89b8eab966b4191ce4a53a3f4b4d9c"><code>f7482f6</code></a> fix(eslint-plugin): [no-misused-promises] handle multiple Promise constituent...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/267304477e04538614fe72ad71e7e13082eb7a90"><code>2673044</code></a> docs(eslint-plugin): [prefer-promise-reject-errors] add option sections and e...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/8f141a2ba63d539465eb4e4604f7d79f6f50ce14"><code>8f141a2</code></a> fix(eslint-plugin): [no-useless-default-assignment] convert the fixer to a su...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/479cd85ff82b81dbec9989621681257ebc317a69"><code>479cd85</code></a> chore: enable assertion option <code>requireData</code> for all rule tests (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12816">#12816</a>)</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/f3c190c5b5cfa9edaba15fa3f944a76a7364b3ed"><code>f3c190c</code></a> fix(eslint-plugin): [no-unnecessary-condition] handle union-keyed index acces...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/b1993dfd3c45b2c2d83058627499f1dfec5d6d2c"><code>b1993df</code></a> fix(eslint-plugin): [unbound-method] treat Intl.Collator.prototype.compare as...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/da394bc9c21afe97f456040da723d2c558f99658"><code>da394bc</code></a> fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] account fo...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/4a742ff890b7cca8cbf79e78a9a3b345913094c6"><code>4a742ff</code></a> fix(eslint-plugin): [await-thenable] prevent autofix from breaking code when ...</li> <li>Additional commits viewable in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/eslint-plugin">compare view</a></li> </ul> </details> <br /> Updates `@typescript-eslint/parser` from 8.68.0 to 8.70.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">@​typescript-eslint/parser's releases</a>.</em></p> <blockquote> <h2>v8.70.1</h2> <h2>8.70.1 (2026-09-21)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>ast-spec:</strong> narrow import attribute keys to identifiers and strings (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879">#12879</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] avoid false positives on tuples with a rest element (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768">#12768</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637">#12637</a>)</li> <li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for bare any rest parameters (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818">#12818</a>)</li> <li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854">#12854</a>)</li> <li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap spread suggestions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850">#12850</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869">#12869</a>)</li> <li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow void on assignment expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873">#12873</a>)</li> <li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix from breaking code when removing <code>await</code> (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716">#12716</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-parameter-property-assignment] account for parameter reassignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880">#12880</a>)</li> <li><strong>eslint-plugin:</strong> [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845">#12845</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747">#12747</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] convert the fixer to a suggestion fixer (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826">#12826</a>)</li> <li><strong>eslint-plugin:</strong> [no-misused-promises] handle multiple Promise constituents (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904">#12904</a>)</li> <li><strong>rule-tester:</strong> test the final autofix output instead of the first pass (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867">#12867</a>)</li> <li><strong>scope-manager:</strong> merge implicit global definitions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809">#12809</a>)</li> <li><strong>type-utils:</strong> match package specifiers on whole path components (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838">#12838</a>)</li> <li><strong>typescript-estree:</strong> resolve symlinked paths when matching files to projects (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725">#12725</a>)</li> <li><strong>typescript-estree:</strong> add missing <code>&lt;</code> token opening type arguments (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821">#12821</a>)</li> <li><strong>typescript-estree:</strong> require string literal import attribute values (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894">#12894</a>)</li> <li><strong>website:</strong> prevent playground from breaking down after opening link with the .js file type (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777">#12777</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Amin <a href="https://github.com/amiin-dev"><code>@​amiin-dev</code></a></li> <li>Brad Zacher <a href="https://github.com/bradzacher"><code>@​bradzacher</code></a></li> <li>Cameron</li> <li>Diptajoy Mistry <a href="https://github.com/diptomistry"><code>@​diptomistry</code></a></li> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li> <li>Grit <a href="https://github.com/Grit03"><code>@​Grit03</code></a></li> <li>Hugo <a href="https://github.com/hugop95"><code>@​hugop95</code></a></li> <li>Josh Goldberg ✨</li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li> <li>Mikhail Baev <a href="https://github.com/baevm"><code>@​baevm</code></a></li> <li>Om Rawat</li> <li>overlookmotel</li> <li>Sanath <a href="https://github.com/sansynx"><code>@​sansynx</code></a></li> <li>Shinji</li> <li>stoicism <a href="https://github.com/stoicism02"><code>@​stoicism02</code></a></li> <li>Vinccool96</li> <li>Younsang Na <a href="https://github.com/nayounsang"><code>@​nayounsang</code></a></li> <li>김채영 <a href="https://github.com/cchaeyoung"><code>@​cchaeyoung</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1">GitHub Releases</a> for more information.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md">@​typescript-eslint/parser's changelog</a>.</em></p> <blockquote> <h2>8.70.1 (2026-09-21)</h2> <p>This was a version bump only for parser to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> <h2>8.70.0 (2026-09-07)</h2> <p>This was a version bump only for parser to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> <h2>8.69.0 (2026-08-31)</h2> <p>This was a version bump only for parser to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.69.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7"><code>23d38ce</code></a> chore(release): publish 8.70.1</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/7ee76085c22e923c0036b8e0733a3ca7dfd82b60"><code>7ee7608</code></a> chore(release): publish 8.70.0</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/9a6e546823e5d8f2dc015df2aa66c0230615e209"><code>9a6e546</code></a> chore(release): publish 8.69.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 10.9.1 to 10.11.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.11.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127"><code>d136fa4</code></a> feat: object-shorthand handle quoted properties for <code>ignoreConstructors</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21271">#21271</a>) (Pavel)</li> <li><a href="https://github.com/eslint/eslint/commit/397b3b8134b8ce1a61cbf414d4c29c945ba25690"><code>397b3b8</code></a> feat: report unsafe labeled <code>continue</code> in <code>no-unsafe-finally</code> rule (<a href="https://redirect.github.com/eslint/eslint/issues/21316">#21316</a>) (electrohyun)</li> <li><a href="https://github.com/eslint/eslint/commit/d3dd47f42e4cb5f9da27e3a2e741aa21e02ea1a4"><code>d3dd47f</code></a> feat: only exempt <code>new-cap</code> built-ins that reference the global (<a href="https://redirect.github.com/eslint/eslint/issues/21290">#21290</a>) (sethamus)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476"><code>22b09f5</code></a> fix: ignore <code>__proto__</code> properties in <code>prefer-object-spread</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21311">#21311</a>) (xbinaryx)</li> <li><a href="https://github.com/eslint/eslint/commit/b684bb1cd7e6be03ad1b7a951baead936d9c2166"><code>b684bb1</code></a> fix: make TimePass.parse optional in types and docs (<a href="https://redirect.github.com/eslint/eslint/issues/21313">#21313</a>) (ntnyq)</li> <li><a href="https://github.com/eslint/eslint/commit/26d11bce3e0e21f223613d4bb4be3423839b229e"><code>26d11bc</code></a> fix: don't report <code>__proto__</code> properties in <code>object-shorthand</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21310">#21310</a>) (xbinaryx)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa"><code>9ecfdc5</code></a> docs: note that --cache can serve stale results for cross-file rules (<a href="https://redirect.github.com/eslint/eslint/issues/21312">#21312</a>) (bytedoe)</li> <li><a href="https://github.com/eslint/eslint/commit/6c789ff39bc5420e94e8dafeb328bf2b7e3d35ab"><code>6c789ff</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/5997825635dc9c4e81434894607ef2e3887e0ea3"><code>5997825</code></a> docs: clarify preserve-caught-error known limitation (<a href="https://redirect.github.com/eslint/eslint/issues/21294">#21294</a>) (Akinyemi Toluwalase)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68"><code>520dd77</code></a> perf: Implement fast paths in critical areas (<a href="https://redirect.github.com/eslint/eslint/issues/21210">#21210</a>) (Nicholas C. Zakas)</li> <li><a href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a"><code>92086c8</code></a> test: update <code>EMFILE</code> error generation for Node.js 26.9.0 compatibility (<a href="https://redirect.github.com/eslint/eslint/issues/21330">#21330</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e"><code>9ac7eb6</code></a> chore: update github/codeql-action action to v4.38.0 (<a href="https://redirect.github.com/eslint/eslint/issues/21331">#21331</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd"><code>24310e3</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21324">#21324</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651"><code>45ad79e</code></a> ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a href="https://redirect.github.com/eslint/eslint/issues/21318">#21318</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/ac74e37322ebf122ada676f153dc55c81f3caab0"><code>ac74e37</code></a> chore: Add AGENTS.md with AI disclosure requirements (<a href="https://redirect.github.com/eslint/eslint/issues/21221">#21221</a>) (Nicholas C. Zakas)</li> <li><a href="https://github.com/eslint/eslint/commit/c8326608e710e670beaf982501aed80ea104919a"><code>c832660</code></a> chore: Upgrade Stylelint to the latest version in docs (<a href="https://redirect.github.com/eslint/eslint/issues/21245">#21245</a>) (Jung Hyeon Jun)</li> <li><a href="https://github.com/eslint/eslint/commit/f9f88fcccd965fdc162b89c4615dd4018e3cabdf"><code>f9f88fc</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21308">#21308</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/fc81076a5b8145360654d81cbc130cf7d25dca77"><code>fc81076</code></a> ci: add more types integration tests (<a href="https://redirect.github.com/eslint/eslint/issues/20395">#20395</a>) (Nitin Kumar)</li> </ul> <h2>v10.10.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/264b4346d1963701df0c398b4aeb2f6e8b2af93e"><code>264b434</code></a> feat: add <code>d</code> and <code>v</code> flags to <code>no-unexpected-multiline</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21305">#21305</a>) (Gihyeon Jeong / 정기현)</li> <li><a href="https://github.com/eslint/eslint/commit/c6cc6c592f30901345d94ef75e0d42c1894fae6c"><code>c6cc6c5</code></a> feat: check <code>Object.prototype</code> property names in <code>new-cap</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21269">#21269</a>) (crimsonjay0)</li> <li><a href="https://github.com/eslint/eslint/commit/5661fa65fde9fd4c14f0b730e3cee6a42fc657c1"><code>5661fa6</code></a> feat: no-extra-bind false negatives with class fields and static blocks (<a href="https://redirect.github.com/eslint/eslint/issues/21260">#21260</a>) (synthex-byte)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/bb47dc6da2399a8f76c0c0c3273e6bc314c480e5"><code>bb47dc6</code></a> fix: update dependency file-entry-cache to v11 (<a href="https://redirect.github.com/eslint/eslint/issues/20801">#20801</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/427ac0a014066c36aa57fa8fa9af20fd9fb591e1"><code>427ac0a</code></a> fix: use format strings in debug calls (<a href="https://redirect.github.com/eslint/eslint/issues/21247">#21247</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/9d8153223dbf47b9aecdc1474202aaee4845f146"><code>9d81532</code></a> fix: support <code>__proto__</code> in <code>/* exported */</code> comments (<a href="https://redirect.github.com/eslint/eslint/issues/21261">#21261</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/87e0a082438264ad90b87fd74165ab4fd90f63ef"><code>87e0a08</code></a> fix: prefer-object-has-own autofix breaks when Object is shadowed (<a href="https://redirect.github.com/eslint/eslint/issues/21282">#21282</a>) (김채영)</li> <li><a href="https://github.com/eslint/eslint/commit/8e2cb142217f2efee1d10dcc02bfb75145ae775d"><code>8e2cb14</code></a> fix: <code>new-cap</code> false positive for <code>UTC</code> calls with <code>properties: false</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21275">#21275</a>) (Pixel)</li> <li><a href="https://github.com/eslint/eslint/commit/9f4a364ab0ade048dfce1f37792b1d461d866e55"><code>9f4a364</code></a> fix: Ignore static imports in no-unreachable (<a href="https://redirect.github.com/eslint/eslint/issues/21276">#21276</a>) (Taha Kotil)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/2417cad57d7d1bc4cf3ecf0f0575cfb10ff2011c"><code>2417cad</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/9cecb8a0a2348070abf72321965d41919c7cc626"><code>9cecb8a</code></a> docs: document <code>\c</code> control letter escapes in no-control-regex (<a href="https://redirect.github.com/eslint/eslint/issues/21286">#21286</a>) (한국)</li> <li><a href="https://github.com/eslint/eslint/commit/8724829f69f8ed80c876e3a5a017da199ce78739"><code>8724829</code></a> docs: update compat table links (<a href="https://redirect.github.com/eslint/eslint/issues/21263">#21263</a>) (fnx)</li> <li><a href="https://github.com/eslint/eslint/commit/5634542be580750ffb1a5766470f9e9c72719696"><code>5634542</code></a> docs: Clarify eqeqeq suggestion behavior (<a href="https://redirect.github.com/eslint/eslint/issues/21256">#21256</a>) (Müslüm Yılmaz)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/b3d876b46083d67899eb1d9613118c1c583632a2"><code>b3d876b</code></a> chore: disable npm audit in ecosystem tests (<a href="https://redirect.github.com/eslint/eslint/issues/21306">#21306</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/1696682791661c13167eb905da2f38d1b8f4a3bf"><code>1696682</code></a> ci: restore EMFILE test on Node.js 26 (<a href="https://redirect.github.com/eslint/eslint/issues/21297">#21297</a>) (Marry (Subin Yang))</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/3c0b7c6e1fe2dec778b97a996018126f22d437ae"><code>3c0b7c6</code></a> 10.11.0</li> <li><a href="https://github.com/eslint/eslint/commit/321f0a70dd908ed461b11142e17fbdc0c0f1f198"><code>321f0a7</code></a> Build: changelog update for 10.11.0</li> <li><a href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68"><code>520dd77</code></a> perf: Implement fast paths in critical areas (<a href="https://redirect.github.com/eslint/eslint/issues/21210">#21210</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa"><code>9ecfdc5</code></a> docs: note that --cache can serve stale results for cross-file rules (<a href="https://redirect.github.com/eslint/eslint/issues/21312">#21312</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a"><code>92086c8</code></a> test: update <code>EMFILE</code> error generation for Node.js 26.9.0 compatibility (<a href="https://redirect.github.com/eslint/eslint/issues/21330">#21330</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e"><code>9ac7eb6</code></a> chore: update github/codeql-action action to v4.38.0 (<a href="https://redirect.github.com/eslint/eslint/issues/21331">#21331</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476"><code>22b09f5</code></a> fix: ignore <code>__proto__</code> properties in <code>prefer-object-spread</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21311">#21311</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd"><code>24310e3</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/21324">#21324</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127"><code>d136fa4</code></a> feat: object-shorthand handle quoted properties for <code>ignoreConstructors</code> (<a href="https://redirect.github.com/eslint/eslint/issues/21">#21</a>...</li> <li><a href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651"><code>45ad79e</code></a> ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a href="https://redirect.github.com/eslint/eslint/issues/21318">#21318</a>)</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.9.1...v10.11.0">compare view</a></li> </ul> </details> <br /> Updates `jest` from 30.5.0 to 30.5.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jestjs/jest/releases">jest's releases</a>.</em></p> <blockquote> <h2>v30.5.2</h2> <h2>Features</h2> <ul> <li><code>[@jest/transform]</code> Strip TypeScript types with Node when no transformer claims a <code>.ts</code>, <code>.mts</code> or <code>.cts</code> file (<a href="https://redirect.github.com/jestjs/jest/pull/16421">#16421</a>)</li> </ul> <h2>Fixes</h2> <ul> <li><code>[jest-core, jest-haste-map, jest-transform]</code> Keep <code>require('../package.json')</code> external when bundling, so <code>jest --version</code> and the transform and haste-map cache keys report the released version instead of the previous one (<a href="https://redirect.github.com/jestjs/jest/pull/16422">#16422</a>)</li> <li><code>[jest-each]</code> Escape a table row's keys before building the <code>$variable</code> interpolation <code>RegExp</code>, so a column name such as <code>count(*)</code> no longer fails the whole table with <code>Invalid regular expression</code>, and a <code>.</code> or <code>|</code> in a column name is matched literally (<a href="https://redirect.github.com/jestjs/jest/pull/16345">#16345</a>)</li> <li><code>[@jest/source-map]</code> Resolve absolute Windows paths in a source map's <code>sources</code> and <code>sourceRoot</code> again, instead of appending them to the transformed file's directory (<a href="https://redirect.github.com/jestjs/jest/pull/16439">#16439</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/winklemad"><code>@​winklemad</code></a> made their first contribution in <a href="https://redirect.github.com/jestjs/jest/pull/16345">jestjs/jest#16345</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2">https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2</a></p> <h2>v30.5.1</h2> <h2>Fixes</h2> <ul> <li><code>[jest-config]</code> Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of <code>--projects</code> when no root config is passed (<a href="https://redirect.github.com/jestjs/jest/pull/16411">#16411</a>)</li> <li><code>[jest-config, jest-types]</code> Stop accepting <code>reporters</code>, <code>coverageReporters</code>, <code>workerIdleMemoryLimit</code>, <code>cwd</code> and <code>runnerOptions</code> in a project config - they were silently ignored, and now warn like the other global-only options (<a href="https://redirect.github.com/jestjs/jest/pull/16411">#16411</a>)</li> <li><code>[jest-config, jest-validate]</code> Warn about <code>maxWorkers</code> and <code>coverageThreshold</code> in a project config instead of dropping them without a word (<a href="https://redirect.github.com/jestjs/jest/pull/16411">#16411</a>)</li> <li><code>[jest-resolve]</code> Match <code>moduleNameMapper</code> patterns against the specifier as written again (reverting <a href="https://redirect.github.com/jestjs/jest/pull/16390">#16390</a>) (<a href="https://redirect.github.com/jestjs/jest/pull/16417">#16417</a>)</li> <li><code>[jest-runtime]</code> Resolve package <code>imports</code> specifiers like <code>#dep</code> under ESM again (<a href="https://redirect.github.com/jestjs/jest/pull/16413">#16413</a>)</li> </ul> <h2>Chore &amp; Maintenance</h2> <ul> <li><code>[jest-util]</code> Name the <code>testEnvironmentOptions.globalsCleanup</code> option and link the docs from the <code>JEST-01</code> deprecation warning, and document the option's modes (<a href="https://redirect.github.com/jestjs/jest/pull/16404">#16404</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/HuzaifaChaudary"><code>@​HuzaifaChaudary</code></a> made their first contribution in <a href="https://redirect.github.com/jestjs/jest/pull/16413">jestjs/jest#16413</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1">https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md">jest's changelog</a>.</em></p> <blockquote> <h2>30.5.2</h2> <h3>Features</h3> <ul> <li><code>[@jest/transform]</code> Strip TypeScript types with Node when no transformer claims a <code>.ts</code>, <code>.mts</code> or <code>.cts... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>	2026-10-17 18:27:10 -07:00
5 people	beb6fe2ffb	chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in /libs/cli/js-examples in the major group (#9154) ... Bumps the major group in /libs/cli/js-examples with 1 update: [dotenv](https://github.com/motdotla/dotenv). Updates `dotenv` from 17.4.2 to 18.0.4 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/motdotla/dotenv/compare/v18.0.3...v18.0.4">18.0.4</a> (2026-09-25)</h2> <h3>Changed</h3> <ul> <li><code>import dotenv/config</code> should default quiet: true (<a href="https://redirect.github.com/motdotla/dotenv/pull/1063">#1063</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v18.0.2...v18.0.3">18.0.3</a> (2026-09-22)</h2> <h3>Changed</h3> <ul> <li>Patch <code>DOTENV_QUIET</code> setting when inside .env file (<a href="https://redirect.github.com/motdotla/dotenv/pull/1059">#1059</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v18.0.1...v18.0.2">18.0.2</a> (2026-09-21)</h2> <h3>Changed</h3> <ul> <li>Patch additional edge cases for the fast parser (<a href="https://redirect.github.com/motdotla/dotenv/pull/1056">#1056</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v18.0.0...v18.0.1">18.0.1</a> (2026-09-18)</h2> <h3>Changed</h3> <ul> <li>Handle file urls in config logging (<a href="https://redirect.github.com/motdotla/dotenv/pull/1054">#1054</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.0">18.0.0</a> (2026-09-17)</h2> <h3>Added</h3> <ul> <li>NEW: Dotenv now has a CLI. (<a href="https://redirect.github.com/motdotla/dotenv/pull/1022">#1022</a>)</li> </ul> <pre lang="sh"><code>$ dotenv run -- node index.js ◇ injected env (2) from .env Hello Dotenv </code></pre> <ul> <li>NEW: Dotenv now has a fast parser thanks to <a href="https://github.com/homanp"><code>@​homanp</code></a> of <a href="https://superagent.sh">superagent.sh</a>. Pass <code>config({ fast: true })</code>, flag <code>--fast</code>, or set <code>DOTENV_FAST=true</code> to opt-in to ~2x faster character-scanner parser. (<a href="https://redirect.github.com/motdotla/dotenv/pull/1010">#1010</a>)</li> </ul> <pre lang="sh"><code>$ dotenv run --fast -- node index.js ◇ injected env (2) from .env Hello Dotenv </code></pre> <p><a href="https://dotenvx.com/blog/2026/09/28/dotenv-fast.html">faster than Node native parseEnv!</a></p> <h3>Changed</h3> <ul> <li>Injecting message sent to stderr rather than stdout and tips removed (<a href="https://redirect.github.com/motdotla/dotenv/pull/1037">#1037</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motdotla/dotenv/commit/86804c0507aff98d3a82204759729af3bc2ce1a9"><code>86804c0</code></a> 18.0.4</li> <li><a href="https://github.com/motdotla/dotenv/commit/2403db57c3f8b01123d69a8b441a5f8b828fab3c"><code>2403db5</code></a> changelog</li> <li><a href="https://github.com/motdotla/dotenv/commit/75b775eda45af3085fb7a7de6ae2613eb646807e"><code>75b775e</code></a> npm audit</li> <li><a href="https://github.com/motdotla/dotenv/commit/7e1750ce8034b3c9485f1e1722587a40890449e1"><code>7e1750c</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/1064">#1064</a> from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2</li> <li><a href="https://github.com/motdotla/dotenv/commit/a6ade63b6fa94a78fdc68f815c4e88cfe8781774"><code>a6ade63</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/1063">#1063</a> from motdotla/import</li> <li><a href="https://github.com/motdotla/dotenv/commit/288b0d7cd85d8deba3f91a995abd033786626a8d"><code>288b0d7</code></a> patch test</li> <li><a href="https://github.com/motdotla/dotenv/commit/00da9125dd7633a121d169a3a55b62a686b64ef8"><code>00da912</code></a> Bump ip-address from 10.2.0 to 10.7.2</li> <li><a href="https://github.com/motdotla/dotenv/commit/e6b58161d2f2b1448c735b1f6555bde7a20443b7"><code>e6b5816</code></a> import 'dotenv/config' should still be defaulting to quiet</li> <li><a href="https://github.com/motdotla/dotenv/commit/3646ac5e5d000f5f68fe83db52399010f9cb781f"><code>3646ac5</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/1061">#1061</a> from motdotla/fast</li> <li><a href="https://github.com/motdotla/dotenv/commit/83fc961f92f6c330833da4a5f5dc7093d539501e"><code>83fc961</code></a> report dotenv vs native vs dotenv.fast</li> <li>Additional commits viewable in <a href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-18 00:49:00 +00:00
5 people	0eb194fe60	chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 6 updates (#9150) ... Bumps the minor-and-patch group in /libs/prebuilt with 6 updates: | Package | From | To | | --- | --- | --- | | [langchain-core](https://github.com/langchain-ai/langchain) | `1.6.1` | `1.6.5` | | [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.15.1` | `3.16.0` | | [syrupy](https://github.com/syrupy-project/syrupy) | `6.0.0` | `6.1.1` | | [psycopg-binary](https://github.com/psycopg/psycopg) | `3.3.4` | `3.3.6` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.9` | | [ty](https://github.com/astral-sh/ty) | `0.0.75` | `0.0.84` | Updates `langchain-core` from 1.6.1 to 1.6.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.6.5</h2> <p>Changes since langchain-core==1.6.4</p> <p>release(core): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40816">#40816</a>) fix(core): abbreviate long tool IDs in XML buffer strings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40792">#40792</a>)</p> <h2>langchain-core==1.6.4</h2> <p>Changes since langchain-core==1.6.3</p> <p>release(core): 1.6.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40718">#40718</a>) chore(core): deprecate chat message history (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40711">#40711</a>) chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40634">#40634</a>) chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40574">#40574</a>)</p> <h2>langchain-core==1.6.3</h2> <p>Changes since langchain-core==1.6.2</p> <p>release(core): 1.6.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40407">#40407</a>) feat(core): Allow model name and provider tracing metadata override based on gateway response (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40406">#40406</a>) test(core): cover the deprecated <code>.text()</code> access path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40243">#40243</a>) docs(core): remove stale Args/Raises entries from FileCallbackHandler._write and ChatGeneration.set_text (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40211">#40211</a>)</p> <h2>langchain-core==1.6.2</h2> <p>Changes since langchain-core==1.6.1</p> <p>release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40209">#40209</a>) feat(openai): support async tools (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40208">#40208</a>) chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40150">#40150</a>) chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40113">#40113</a>) fix(core): avoid mutation in google-genai standard content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40023">#40023</a>) fix(core): avoid mutation in bedrock converse standard content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40022">#40022</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0"><code>c5ab14d</code></a> release(core): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40816">#40816</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f"><code>5704d9d</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40804">#40804</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea"><code>7622d3d</code></a> release(openai): 1.6.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40800">#40800</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e"><code>2dd956b</code></a> docs(infra): fix AGENTS.md root setup guidance and package doc accuracy (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40794">#40794</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621"><code>49f4b40</code></a> fix(openai): raise on error events in stream path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40791">#40791</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426"><code>19cadaa</code></a> fix(core): abbreviate long tool IDs in XML buffer strings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40792">#40792</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2"><code>798441e</code></a> chore(anthropic): fix integration test cassette (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40790">#40790</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1"><code>a476942</code></a> release(openai): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40787">#40787</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291"><code>46c6bdf</code></a> release(anthropic): 1.7.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40786">#40786</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8"><code>290daba</code></a> fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40785">#40785</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5">compare view</a></li> </ul> </details> <br /> Updates `pytest-mock` from 3.15.1 to 3.16.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest-mock/releases">pytest-mock's releases</a>.</em></p> <blockquote> <h2>v3.16.0</h2> <p><em>2026-09-27</em></p> <ul> <li><a href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604">#604</a>: Fixed <code>duplicate_iterators=True</code> for async functions spied with <code>mocker.spy</code>.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611">#611</a>: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606">#606</a>: <code>mocker.resetall(return_value=True, side_effect=True)</code> now also applies to non-callable mocks, such as those returned by <code>mocker.create_autospec(SomeClass, instance=True)</code>. Previously both arguments were silently ignored for them.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547">#547</a>: Added <code>SpyType</code> for annotating <code>mocker.spy</code> results.</li> <li>Dropped support for EOL Python 3.9.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147">#147</a>: Removed handling of <code>RuntimeError: stop called on unstarted patcher</code>, which can no longer occur in the supported Python versions.</li> <li>Added support for Python 3.15.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst">pytest-mock's changelog</a>.</em></p> <blockquote> <h2>3.16.0</h2> <p><em>2026-09-27</em></p> <ul> <li><code>[#604](https://github.com/pytest-dev/pytest-mock/issues/604) &lt;https://github.com/pytest-dev/pytest-mock/pull/604&gt;</code>_: Fixed <code>duplicate_iterators=True</code> for async functions spied with <code>mocker.spy</code>.</li> <li><code>[#611](https://github.com/pytest-dev/pytest-mock/issues/611) &lt;https://github.com/pytest-dev/pytest-mock/pull/611&gt;</code>_: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.</li> <li><code>[#606](https://github.com/pytest-dev/pytest-mock/issues/606) &lt;https://github.com/pytest-dev/pytest-mock/pull/606&gt;</code>_: <code>mocker.resetall(return_value=True, side_effect=True)</code> now also applies to non-callable mocks, such as those returned by <code>mocker.create_autospec(SomeClass, instance=True)</code>. Previously both arguments were silently ignored for them.</li> <li><code>[#547](https://github.com/pytest-dev/pytest-mock/issues/547) &lt;https://github.com/pytest-dev/pytest-mock/issues/547&gt;</code>_: Added <code>SpyType</code> for annotating <code>mocker.spy</code> results.</li> <li>Dropped support for EOL Python 3.9.</li> <li><code>[#147](https://github.com/pytest-dev/pytest-mock/issues/147) &lt;https://github.com/pytest-dev/pytest-mock/issues/147&gt;</code>_: Removed handling of <code>RuntimeError: stop called on unstarted patcher</code>, which can no longer occur in the supported Python versions.</li> <li>Added support for Python 3.15.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3"><code>f3b531f</code></a> Release 3.16.0</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a"><code>71ed673</code></a> Fix duplicate_iterators for async spies (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604">#604</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0"><code>0797e3d</code></a> Fix async assertion argument introspection (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611">#611</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598"><code>e24c334</code></a> docs: import os in the opening usage example (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612">#612</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1"><code>9e7eb7b</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613">#613</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721"><code>445fd4d</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610">#610</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091"><code>a8bd0b1</code></a> Honour resetall() arguments for non-callable mocks (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606">#606</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0"><code>6559fdf</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608">#608</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf"><code>466d026</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605">#605</a>)</li> <li><a href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e"><code>164defe</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603">#603</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0">compare view</a></li> </ul> </details> <br /> Updates `syrupy` from 6.0.0 to 6.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/syrupy-project/syrupy/releases">syrupy's releases</a>.</em></p> <blockquote> <h2>v6.1.1</h2> <blockquote> <p><strong>Note:</strong> 6.1.0 was skipped due to a CI issue. Use <strong>6.1.1</strong>.</p> </blockquote> <h3>Experimental <code>--snapshot-file-lock</code> for pytest-xdist</h3> <p><code>--snapshot-update</code> under pytest-xdist can race when multiple workers rewrite the same multi-entry amber (<code>.ambr</code>) file, silently dropping snapshots (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1237">#1237</a>).</p> <p>This release adds an <strong>experimental</strong> opt-in:</p> <ul> <li><code>--snapshot-file-lock</code> — exclusive file lock + atomic replace around amber writes</li> <li><code>--snapshot-file-lock-timeout</code> — max wait for the lock (default <strong>60s</strong>)</li> </ul> <p>Same-machine workers only; not reliable across remote workers / NFS. See <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1239">#1239</a>.</p> <blockquote> <p><strong>Callout for pytest-xdist users:</strong> please try <code>--snapshot-file-lock</code> with <code>--snapshot-update</code> and <a href="https://github.com/syrupy-project/syrupy/issues">open an issue</a> if you hit problems. Locking is expected to become the default in a future minor release.</p> </blockquote> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shipbyaeron"><code>@​shipbyaeron</code></a> made their first contribution in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1236">syrupy-project/syrupy#1236</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md">syrupy's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.1">v6.1.1</a> (2026-09-13)</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): update dependency ruff to v0.16.4 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1225">syrupy-project/syrupy#1225</a></li> <li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1226">syrupy-project/syrupy#1226</a></li> <li>chore(deps): update dependency ruff to v0.16.5 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1227">syrupy-project/syrupy#1227</a></li> <li>chore(deps): update dependency pydantic to v2.13.5 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1228">syrupy-project/syrupy#1228</a></li> <li>chore(deps): update dependency coverage to v7.16.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1229">syrupy-project/syrupy#1229</a></li> <li>chore(deps): update dependency hypothesis to v6.166.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1230">syrupy-project/syrupy#1230</a></li> <li>chore(deps): update dependency hypothesis to v6.167.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1231">syrupy-project/syrupy#1231</a></li> <li>chore(deps): update dependency hypothesis to v6.167.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1232">syrupy-project/syrupy#1232</a></li> <li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1234">syrupy-project/syrupy#1234</a></li> <li>chore(deps): update dependency ruff to v0.16.6 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1235">syrupy-project/syrupy#1235</a></li> <li>test: add coverage for read_snapshot_data_from_location returning None by <a href="https://github.com/shipbyaeron"><code>@​shipbyaeron</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1236">syrupy-project/syrupy#1236</a></li> <li>chore(deps): update dependency hypothesis to v6.168.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1238">syrupy-project/syrupy#1238</a></li> <li>fix: opt-in file lock for concurrent amber writes under xdist by <a href="https://github.com/noahnu"><code>@​noahnu</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1239">syrupy-project/syrupy#1239</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shipbyaeron"><code>@​shipbyaeron</code></a> made their first contribution in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1236">syrupy-project/syrupy#1236</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1</a></p> <h2><a href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.0">v6.1.0</a> (2026-09-13)</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): update dependency ruff to v0.16.4 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1225">syrupy-project/syrupy#1225</a></li> <li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1226">syrupy-project/syrupy#1226</a></li> <li>chore(deps): update dependency ruff to v0.16.5 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1227">syrupy-project/syrupy#1227</a></li> <li>chore(deps): update dependency pydantic to v2.13.5 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1228">syrupy-project/syrupy#1228</a></li> <li>chore(deps): update dependency coverage to v7.16.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1229">syrupy-project/syrupy#1229</a></li> <li>chore(deps): update dependency hypothesis to v6.166.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1230">syrupy-project/syrupy#1230</a></li> <li>chore(deps): update dependency hypothesis to v6.167.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1231">syrupy-project/syrupy#1231</a></li> <li>chore(deps): update dependency hypothesis to v6.167.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1232">syrupy-project/syrupy#1232</a></li> <li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1234">syrupy-project/syrupy#1234</a></li> <li>chore(deps): update dependency ruff to v0.16.6 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1235">syrupy-project/syrupy#1235</a></li> <li>test: add coverage for read_snapshot_data_from_location returning None by <a href="https://github.com/shipbyaeron"><code>@​shipbyaeron</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1236">syrupy-project/syrupy#1236</a></li> <li>chore(deps): update dependency hypothesis to v6.168.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1238">syrupy-project/syrupy#1238</a></li> <li>fix: opt-in file lock for concurrent amber writes under xdist by <a href="https://github.com/noahnu"><code>@​noahnu</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1239">syrupy-project/syrupy#1239</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shipbyaeron"><code>@​shipbyaeron</code></a> made their first contribution in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1236">syrupy-project/syrupy#1236</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/syrupy-project/syrupy/commit/2d251e73f1ebe47fe83ed71d835d3ae8580e8313"><code>2d251e7</code></a> chore(release): 6.1.1 [skip ci]</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/9b64ec05752586c45d1097e9d25f9ee1d4e93219"><code>9b64ec0</code></a> chore(release): 6.1.0 [skip ci]</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/5b4256eac8720075f25b0fa8491f75948001b983"><code>5b4256e</code></a> fix: opt-in file lock for concurrent amber writes under xdist (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1239">#1239</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/d4cb1513b5d2b1b18c3b407150db22d2d8604ddd"><code>d4cb151</code></a> chore(deps): update dependency hypothesis to v6.168.0 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1238">#1238</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/16c4cb5b8785d89e49b8076a99f58d810e02fcce"><code>16c4cb5</code></a> test: add coverage for read_snapshot_data_from_location returning None (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1236">#1236</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/2e1d3ba0d39a1d87735213a32de9dd9cdb929690"><code>2e1d3ba</code></a> chore(deps): update dependency ruff to v0.16.6 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1235">#1235</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/fcc929d4deb2302f2d37e6511015ef43a0841bc2"><code>fcc929d</code></a> chore(deps): update actions/deploy-pages action to v5.0.1 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1234">#1234</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/4f1bad75777ecc9d916a648dd3669b2844d08f7d"><code>4f1bad7</code></a> chore(deps): update dependency hypothesis to v6.167.1 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1232">#1232</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/24eda28579f5761cbc64713ffcee41cc73602010"><code>24eda28</code></a> chore(deps): update dependency hypothesis to v6.167.0 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1231">#1231</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/0d7e46f9431e07810da4ef90dbe861b85fbc8469"><code>0d7e46f</code></a> chore(deps): update dependency hypothesis to v6.166.0 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1230">#1230</a>)</li> <li>Additional commits viewable in <a href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1">compare view</a></li> </ul> </details> <br /> Updates `psycopg-binary` from 3.3.4 to 3.3.6 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst">psycopg-binary's changelog</a>.</em></p> <blockquote> <p>.. currentmodule:: psycopg</p> <p>.. index:: single: Release notes single: News</p> <h1><code>psycopg</code> release notes</h1> <h2>Future releases</h2> <p>Psycopg 3.3.7 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^</p> <ul> <li>Fix segfault fetching arrays of strings or timestamps after closing the connection (🎫<code>[#1428](https://github.com/psycopg/psycopg/issues/1428)</code>).</li> </ul> <h2>Current release</h2> <p>Psycopg 3.3.6 ^^^^^^^^^^^^^</p> <ul> <li>Add support for Python 3.15 (🎫<code>[#1245](https://github.com/psycopg/psycopg/issues/1245)</code>).</li> <li>Improve performance of async queries by reducing the overhead of the <code>!wait_async()</code> function (🎫<code>[#1331](https://github.com/psycopg/psycopg/issues/1331)</code>).</li> <li>Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (🎫<code>[#1371](https://github.com/psycopg/psycopg/issues/1371)</code>).</li> <li>Cancel a running query upon receiving <code>!SystemExit</code> (🎫<code>[#1384](https://github.com/psycopg/psycopg/issues/1384)</code>).</li> <li>Report <code>!None</code> instead of <code>65535</code> as the <code>Column.precision</code> of an :sql:<code>interval</code> column declared with a fields restriction and no explicit precision, such as e.g. :sql:<code>interval day to second</code> (🎫<code>[#1397](https://github.com/psycopg/psycopg/issues/1397)</code>).</li> <li>Fix dumping of nested subclasses of lists as arrays (🎫<code>[#1398](https://github.com/psycopg/psycopg/issues/1398)</code>).</li> <li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code> (🎫<code>[#1408](https://github.com/psycopg/psycopg/issues/1408)</code>).</li> <li>Better guards dumping large Python <code>!int</code> to binary numeric (🎫<code>[#1414](https://github.com/psycopg/psycopg/issues/1414)</code>).</li> </ul> <p>Psycopg 3.3.5 ^^^^^^^^^^^^^</p> <ul> <li>Discard prepared statements upon :sql:<code>ALTER *</code> or <code>DISCARD *</code> (🎫<code>[#1307](https://github.com/psycopg/psycopg/issues/1307)</code>).</li> <li>Fix <code>!ProgrammingError</code> when dumping non-<code>!None</code> values with no <code>!NoneType</code> dumper registered in python implementation (🎫<code>[#1325](https://github.com/psycopg/psycopg/issues/1325)</code>).</li> <li>Fix <code>!wait_selector</code> wait function to not raise <code>!KeyError</code> (🎫<code>[#1327](https://github.com/psycopg/psycopg/issues/1327)</code>).</li> <li>Fix <code>!DataError</code> messages leaking the literal <code>{...}</code> placeholder instead</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psycopg/psycopg/commit/a67654d1e7afbf9b3a619557838f62de1c790e7c"><code>a67654d</code></a> chore: bump psycopg package version to 3.3.6</li> <li><a href="https://github.com/psycopg/psycopg/commit/443814b3b111ac678a39fd523c1a826266fb69b5"><code>443814b</code></a> Merge pull request <a href="https://redirect.github.com/psycopg/psycopg/issues/1416">#1416</a> from dvarrazzo/wait-async-perf</li> <li><a href="https://github.com/psycopg/psycopg/commit/42966e9ebbda3b9c69b15c5588543c15f2aae5dd"><code>42966e9</code></a> test: add helpful comments to some tests</li> <li><a href="https://github.com/psycopg/psycopg/commit/5e8797f0c8003d8cd12a1e5c13f05fbb94c1c1d2"><code>5e8797f</code></a> test: add reasonable connect_timeout to most tests</li> <li><a href="https://github.com/psycopg/psycopg/commit/c81ba62442dfbd69e207d6914e6ae2aa27e56886"><code>c81ba62</code></a> perf: reduce the overhead of wait_async()</li> <li><a href="https://github.com/psycopg/psycopg/commit/d2bbfe4e2b1e36a20e72a18097f35a3db27296e3"><code>d2bbfe4</code></a> refactor: use get_running_loop() in the async wait functions</li> <li><a href="https://github.com/psycopg/psycopg/commit/2b1484a550e01c88fda077099678f0abb9217ecb"><code>2b1484a</code></a> test: add a script to measure the async wait functions</li> <li><a href="https://github.com/psycopg/psycopg/commit/573cf4aa70d8fdefc9d5f3eb69d5419cd6d3cd51"><code>573cf4a</code></a> test: fix incorrect wait timing test</li> <li><a href="https://github.com/psycopg/psycopg/commit/2b68990874175b8d97269218d4963b2d5c8656f3"><code>2b68990</code></a> refactor: drop leftovers of waiting with inf interval in wait_conn_async</li> <li><a href="https://github.com/psycopg/psycopg/commit/60765dd8fc7d8df03cd75efcff485bfb3c83a0ed"><code>60765dd</code></a> Merge pull request <a href="https://redirect.github.com/psycopg/psycopg/issues/1414">#1414</a> from dvarrazzo/fix-decimal-overflow</li> <li>Additional commits viewable in <a href="https://github.com/psycopg/psycopg/compare/3.3.4...3.3.6">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.5 to 0.16.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.9</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Avoid false positives for overloaded division (<code>RUF069</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bugbear</code>] Avoid false positives for calls with keyword arguments (<code>B009</code>, <code>B010</code>, <code>B043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li> <li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in deferred annotations (<code>TID255</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Update LibCST-based fixes for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li> <li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message (<code>PYI002</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix horizontal overflow on the rules documentation page (<a href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li> <li>Update rules table with category information (<a href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li> <li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code> checks return types in addition to arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li> <li>[<code>flake8-bugbear</code>] Document type-checker interaction (<code>B010</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li> <li>[<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li> <li>[<code>ruff</code>] Mention related isort settings (<code>RUF022</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li> <li><a href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li> <li><a href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li> <li><a href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> <li><a href="https://github.com/spaceone"><code>@​spaceone</code></a></li> <li><a href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li> <li><a href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li> <li><a href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li> </ul> <h2>Install ruff 0.16.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.9</h2> <p>Released on 2026-09-24.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Avoid false positives for overloaded division (<code>RUF069</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bugbear</code>] Avoid false positives for calls with keyword arguments (<code>B009</code>, <code>B010</code>, <code>B043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li> <li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in deferred annotations (<code>TID255</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Update LibCST-based fixes for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li> <li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message (<code>PYI002</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix horizontal overflow on the rules documentation page (<a href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li> <li>Update rules table with category information (<a href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li> <li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code> checks return types in addition to arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li> <li>[<code>flake8-bugbear</code>] Document type-checker interaction (<code>B010</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li> <li>[<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li> <li>[<code>ruff</code>] Mention related isort settings (<code>RUF022</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li> <li><a href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li> <li><a href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li> <li><a href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> <li><a href="https://github.com/spaceone"><code>@​spaceone</code></a></li> <li><a href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li> <li><a href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li> <li><a href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li> </ul> <h2>0.16.8</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1"><code>0be08a2</code></a> Bump version to 0.16.9 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28882">#28882</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02"><code>b4920b7</code></a> Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28881">#28881</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18"><code>47c751b</code></a> Update dependency astral-sh/uv to v0.12.18 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28880">#28880</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c"><code>8c244e5</code></a> [<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>...</li> <li><a href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d"><code>5edf5a1</code></a> Use <code>target</code> form in <code>rooster.version_files</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28876">#28876</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b"><code>915bb2b</code></a> [ty] Prefer existing @ paths over response files in Ruff and ty (<a href="https://redirect.github.com/astral-sh/ruff/issues/28877">#28877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7"><code>4710e1a</code></a> ci(github): update version number in placeholder of issue template (<a href="https://redirect.github.com/astral-sh/ruff/issues/28871">#28871</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca"><code>eedfc62</code></a> [ty] Propagate outer type context through cast calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/28855">#28855</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1"><code>ceaa6a0</code></a> [ty] Contain rendered code within Markdown fences (<a href="https://redirect.github.com/astral-sh/ruff/issues/28869">#28869</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff"><code>dba0f30</code></a> authorize ruff-pre-commit dispatch via OIDC (<a href="https://redirect.github.com/astral-sh/ruff/issues/28867">#28867</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9">compare view</a></li> </ul> </details> <br /> Updates `ty` from 0.0.75 to 0.0.84 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/releases">ty's releases</a>.</em></p> <blockquote> <h2>0.0.84</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <p>This release addresses <a href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4">GHSA-vxvm-j4xq-q7m4</a>, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.</p> <h3>Bug fixes</h3> <ul> <li>Fix stale diagnostics from the LSP server after toggling <code>showSyntaxErrors</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28759">#28759</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Complete string keys from dictionary initializers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28820">#28820</a>)</li> <li>Support LSP requests against closed documents (<a href="https://redirect.github.com/astral-sh/ruff/pull/28595">#28595</a>)</li> <li>Select projects for external files using import search paths (<a href="https://redirect.github.com/astral-sh/ruff/pull/28594">#28594</a>)</li> <li>Use workspace editor settings for external files (<a href="https://redirect.github.com/astral-sh/ruff/pull/28639">#28639</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid repeated subtyping checks for materialized recursive protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28774">#28774</a>)</li> <li>Skip reading notebooks when discovering scripts (<a href="https://redirect.github.com/astral-sh/ruff/pull/28781">#28781</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Avoid incorrect simplification of <code>TypeIs</code> materializations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28817">#28817</a>)</li> <li>Fix disjointness of generic class types (<a href="https://redirect.github.com/astral-sh/ruff/pull/28787">#28787</a>)</li> <li>Fix staticmethod shadowing through generic receivers and unions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28766">#28766</a>)</li> <li>Infer callable signatures from bounded type variables (<a href="https://redirect.github.com/astral-sh/ruff/pull/28599">#28599</a>)</li> <li>Infer constant membership in inline list and set literals (e.g. <code>&quot;foo&quot; in [&quot;foo&quot;]</code> is now inferred as <code>Literal[True]</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28676">#28676</a>)</li> <li>Infer through optional generic containers in the legacy solver (<a href="https://redirect.github.com/astral-sh/ruff/pull/28791">#28791</a>)</li> <li>Preserve call narrowing during cyclic inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28708">#28708</a>)</li> <li>Preserve intersections of type guard return types (<a href="https://redirect.github.com/astral-sh/ruff/pull/28796">#28796</a>)</li> <li>Use subtyping for constraint-set implication (<a href="https://redirect.github.com/astral-sh/ruff/pull/28657">#28657</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Disable <code>invalid-legacy-positional-parameter</code> by default (<a href="https://redirect.github.com/astral-sh/ruff/pull/28834">#28834</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Only consider reachable definitions when determining whether a condition should be exempted from <code>redundant-condition(-strict)</code> due to the condition being defined relative to <code>sys.version_info</code>, <code>sys.platform</code>, <code>os.name</code> or <code>typing.TYPE_CHECKING</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28788">#28788</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/ibraheemdev"><code>@​ibraheemdev</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> <li><a href="https://github.com/lerebear"><code>@​lerebear</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md">ty's changelog</a>.</em></p> <blockquote> <h2>0.0.84</h2> <p>Released on 2026-09-24.</p> <p>This release addresses <a href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4">GHSA-vxvm-j4xq-q7m4</a>, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.</p> <h3>Bug fixes</h3> <ul> <li>Fix stale diagnostics from the LSP server after toggling <code>showSyntaxErrors</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28759">#28759</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Complete string keys from dictionary initializers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28820">#28820</a>)</li> <li>Support LSP requests against closed documents (<a href="https://redirect.github.com/astral-sh/ruff/pull/28595">#28595</a>)</li> <li>Select projects for external files using import search paths (<a href="https://redirect.github.com/astral-sh/ruff/pull/28594">#28594</a>)</li> <li>Use workspace editor settings for external files (<a href="https://redirect.github.com/astral-sh/ruff/pull/28639">#28639</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid repeated subtyping checks for materialized recursive protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28774">#28774</a>)</li> <li>Skip reading notebooks when discovering scripts (<a href="https://redirect.github.com/astral-sh/ruff/pull/28781">#28781</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Avoid incorrect simplification of <code>TypeIs</code> materializations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28817">#28817</a>)</li> <li>Fix disjointness of generic class types (<a href="https://redirect.github.com/astral-sh/ruff/pull/28787">#28787</a>)</li> <li>Fix staticmethod shadowing through generic receivers and unions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28766">#28766</a>)</li> <li>Infer callable signatures from bounded type variables (<a href="https://redirect.github.com/astral-sh/ruff/pull/28599">#28599</a>)</li> <li>Infer constant membership in inline list and set literals (e.g. <code>&quot;foo&quot; in [&quot;foo&quot;]</code> is now inferred as <code>Literal[True]</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28676">#28676</a>)</li> <li>Infer through optional generic containers in the legacy solver (<a href="https://redirect.github.com/astral-sh/ruff/pull/28791">#28791</a>)</li> <li>Preserve call narrowing during cyclic inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28708">#28708</a>)</li> <li>Preserve intersections of type guard return types (<a href="https://redirect.github.com/astral-sh/ruff/pull/28796">#28796</a>)</li> <li>Use subtyping for constraint-set implication (<a href="https://redirect.github.com/astral-sh/ruff/pull/28657">#28657</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Disable <code>invalid-legacy-positional-parameter</code> by default (<a href="https://redirect.github.com/astral-sh/ruff/pull/28834">#28834</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Only consider reachable definitions when determining whether a condition should be exempted from <code>redundant-condition(-strict)</code> due to the condition being defined relative to <code>sys.version_info</code>, <code>sys.platform</code>, <code>os.name</code> or <code>typing.TYPE_CHECKING</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28788">#28788</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/ibraheemdev"><code>@​ibraheemdev</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> <li><a href="https://github.com/lerebear"><code>@​lerebear</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> <li><a href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f"><code>8dd9a7f</code></a> Bump version to 0.0.84 (<a href="https://redirect.github.com/astral-sh/ty/issues/4585">#4585</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d"><code>d4e4bf9</code></a> publish to astral-sh/versions via OIDC (<a href="https://redirect.github.com/astral-sh/ty/issues/4581">#4581</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b"><code>94ce733</code></a> use oidc issued token for docs publication (<a href="https://redirect.github.com/astral-sh/ty/issues/4579">#4579</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217"><code>901eeaa</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4576">#4576</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b"><code>09bf0b1</code></a> Update docker/setup-buildx-action action to v4.3.0 (<a href="https://redirect.github.com/astral-sh/ty/issues/4575">#4575</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f"><code>89d6ffe</code></a> Update astral-sh/setup-uv action to v10.2.0 (<a href="https://redirect.github.com/astral-sh/ty/issues/4574">#4574</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774"><code>9c21479</code></a> Bump version to 0.0.83 (<a href="https://redirect.github.com/astral-sh/ty/issues/4569">#4569</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa"><code>04c6911</code></a> Sync the ty security mirror (<a href="https://redirect.github.com/astral-sh/ty/issues/4549">#4549</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a"><code>3fa57a2</code></a> Grant the versions workflow repository read access (<a href="https://redirect.github.com/astral-sh/ty/issues/4550">#4550</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e"><code>a15b353</code></a> use scoped token for release workflow (<a href="https://redirect.github.com/astral-sh/ty/issues/4506">#4506</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-17 16:17:52 +00:00
Elior Nataf LackritzandGitHub	41c9c22fdc	release(langgraph): 1.2.16 (#9334) ... Bumps langgraph from 1.2.15 to 1.2.16. Includes: - Keep a DeltaChannel's value when its field changes to a plain reducer (#9302) - Save a resumed exit run's pending writes once (#9314) - Stop a subgraph from rerunning its finished tasks on resume (#9315) - Apply a resumed `Command`'s update once (#9322) - Let other tasks finish when a resume value is invalid (#9265) 1.2.16 sdk==0.4.8	2026-10-16 18:02:08 -04:00
Elior Nataf LackritzandGitHub	51018652a6	release(sdk-py): 0.4.8 (#9335) ... Bumps the Python SDK version from 0.4.7 to 0.4.8. Thread streams now report why they ended: a server's error frame becomes the error `thread.output` raises, the sync client no longer blocks forever when the server closes the stream, and a stream the server rejects with a 4xx ends at once instead of being retried (#9317).	2026-10-16 18:01:53 -04:00
Elior Nataf LackritzandGitHub	9e6fc45c6f	fix(sdk-py): surface thread stream errors and stop retrying a rejected stream (#9317) ... ## Summary Thread streams in `langgraph_sdk` now report why they ended. An `id: null` error frame becomes the error `thread.output` raises, the sync client no longer blocks forever when the server closes the stream, and a stream the server rejects with a 4xx ends at once instead of being retried. ## Problem - A server sends `{"type": "error", "id": null, ...}` just before it closes a thread stream whose read failed. The SDK dropped the frame, so `thread.output` raised a generic "lifecycle stream ended before terminal event" (async) or blocked forever (sync: the lifecycle watcher returned without settling the run). - A 403 or 404 on the stream request was retried like a network error, then reported as `RuntimeError("Lifecycle transport failed: ...")` with no status. A server that rejects a WebSocket after accepting it closes with 4000 plus the HTTP status (4403, 4404, 4422), since a browser can't read a refused upgrade's status. The shared stream counted each such reconnect as a success and reconnected forever. ## Fix - The lifecycle watcher fails the run with the frame's error on a clean close (both clients). The shared stream logs the frame instead of dropping it: projections still end when the stream closes, as before, and `thread.output` carries the error. - A 4xx other than 408 and 429, as a status or as a 4000+status close code, ends the stream without retries. `thread.output` now raises that `httpx.HTTPStatusError` or `websockets.exceptions.ConnectionClosedError` instead of the generic `RuntimeError`. - For a minted `thread_id`, the lifecycle watcher starts after `run.start` creates the thread. Without this, the 4xx stop would turn a stream opened under custom auth for a not-yet-created thread from retried into failed. The sync client starts it under a lock, since `run.start` can be called from several threads. - Drops the first of two `SyncStreamController._reconnect_shared_stream` definitions. It was shadowed by the second and never ran. Not in this PR: over WebSocket the server closes with 1011 after an error frame, which is still retried, while over SSE the close is clean and fails the stream. Reconnecting after a clean close, as `langchain-ai/langgraphjs#2812` does for the JS SDK, is a separate change. ## Test plan - [x] The 10 new behavior tests (async and sync: error frame, clean close, 404, 4404 close, reconnect on 404, minted `thread_id`) fail on `main` and pass here; a race test checks that two concurrent `run.start` calls start one watcher. - [x] `make test` in `libs/sdk-py`: 541 passed. `make lint` clean, `check_sdk_methods.py` passes. - [x] `RemoteGraph` v3 tests in `libs/langgraph` (`test_remote_graph_v3.py`, `test_stream_events_v3_kwarg_forwarding.py`): 94 passed against this SDK. - [x] Against a local server with custom auth: a thread the caller can't read fails at once with 404 (SSE) or 4404 (WebSocket), and a new thread works with a 1 s pause before `run.start`, which fails on `main`.	2026-10-16 15:29:34 -04:00
Baihao WangandGitHub	b0cabd93d0	fix(langgraph): let other tasks finish when a resume value is invalid (#9265) ... Found while testing per-call human-in-the-loop (langchain-ai/langchain#41062). The code depends only on #9232, which is already on `main`. When one answer in a multi-answer resume fails `response_schema` validation, the runner cancelled the other tasks in the step, so in async runs a task cut off after its side effect kept its saved answer and ran again on the next resume. Invalid resume values (already tagged by `is_invalid_resume` from #9232) no longer stop the other tasks: the error is raised once they finish, so their results are saved. Hit by per-call human-in-the-loop: approving one tool call while giving another an invalid edit, in one resume, sent the approved call's email twice once the second answer was fixed. ## How to verify - `test_invalid_resume_lets_other_answered_tasks_finish` fails on `main` (the approved task is still pending after its side effect) and passes with this change. Like the other async interrupt tests, it is skipped before Python 3.11, where async nodes can't call `interrupt()`. - The per-call HITL reproduction against this branch: the approved async tool runs once (twice on `main` whenever it awaits after its side effect). - `make lint` passes. With `NO_DOCKER=true`, the full `libs/langgraph` suite has the same failures as `main` locally (`test_prebuilt_tool_chat` and `test_stream_mode_messages_command`, sync and async), and nothing new.	2026-10-16 11:33:53 -07:00
raghavverma-langchainandGitHub	4ac46ba186	release(cli): 0.4.36 (#9330) ... ## Summary <!-- Write the summary yourself --> ## Notes for reviewers - Includes [push through the active Docker context](https://github.com/langchain-ai/langgraph/pull/9321) and [accept serverless and dedicated deployment aliases](https://github.com/langchain-ai/langgraph/pull/9325), the two CLI changes merged since 0.4.35. - Merging doesn't publish by itself: after it merges, run the `release` workflow with `working-directory: libs/cli`, as was done for 0.4.35. ## Test Plan - [x] Only `__version__` in `libs/cli/langgraph_cli/__init__.py` changes (0.4.35 → 0.4.36), like the 0.4.35 release PR - [ ] After merge, the `release` workflow for `libs/cli` succeeds and PyPI shows `langgraph-cli` 0.4.36 - [ ] `uvx --from langgraph-cli==0.4.36 langgraph deploy` pushes on Docker Desktop without `DOCKER_HOST` set ## Demo <!-- Drag a screen recording or screenshot here --> cli==0.4.36	2026-10-16 12:29:42 -04:00
Elior Nataf LackritzandGitHub	e14f4277dc	fix(langgraph): apply a resumed Command's update once (#9322) ... `Command(resume=..., update=...)` applied its update twice once the resumed node called `interrupt()` again, with sync or async durability (`invoke`'s default). A node that asks three times, resumed with `Command(resume=str(i), update={"log": [f"u{i}"]})`, ends with `["u1", "u1", "u2", "u3", "a:123"]`. ## Cause The null task's writes are saved as one list, and savers key a regular write by its position in that list. The Command's resume came first, so its update was stored at index 1. The next Command saved the null task's earlier writes again without the resume, which put the update at index 0, so it was stored twice and every later resume applied both copies. `durability="exit"` saves after the resume is consumed, so it wasn't affected. ## Fix The null task's special writes (a resume) now go after its regular ones, so each regular write keeps its index as the list grows. `test_resume_with_update_applies_the_update_once` fails on `main` for sync and async durability. Found by @hntrl, and flagged by @soarez on #9314.	2026-10-16 12:07:59 -04:00
hari-dhanushkodiandGitHub	4e2dfe4a24	fix(cli): accept serverless and dedicated deployment aliases (#9325)	2026-10-16 08:02:43 -04:00
raghavverma-langchainandGitHub	e77a5cb08c	fix(cli): push through the active Docker context in langgraph deploy (#9321) ... ## Summary <!-- Write the summary yourself --> ## Notes for reviewers - Known gap: `--host` carries only the context's endpoint, not its TLS settings, so a remote context that uses client certificates still can't push. That case was broken before this change too, and it's rare for local builds. - A context with no Docker endpoint (Docker prints `<no value>`) or a missing `docker` binary falls back to today's behavior. ## Test Plan - [x] `make lint` and `make test` pass in `libs/cli` (556 tests) - [x] New tests: `login` and `push` get the active context's endpoint as `--host`; with `DOCKER_HOST` set there's no lookup and no `--host`; when the context lookup fails, or the context has no Docker endpoint, there's no `--host` and the deploy still succeeds. The first fails without the change. - [x] On a Mac running Docker Desktop with no `/var/run/docker.sock`: `docker --config <temp dir> version` fails with `failed to connect to the docker API at unix:///var/run/docker.sock`, and adding `--host <active context endpoint>` reaches the daemon - [x] Reproduced end to end on LangSmith AWS: `langgraph deploy` (0.4.35) failed at the push with that error, then passed with `DOCKER_HOST` set to the context's endpoint, which this change does automatically - [ ] After release, `langgraph deploy` pushes on Docker Desktop without `DOCKER_HOST` set ## Demo <!-- Drag a screen recording or screenshot here -->	2026-10-15 16:14:01 -04:00
3 people	b0482d0627	fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (#9315) ... Fixes #9106 When a subgraph pauses in several parallel interrupts and they're answered one at a time, each resume ran the nodes that were already answered again. Their saved answers carried them straight through `interrupt()`, so whatever they do after it (an API write, say) ran once more per later answer, while the final state still looked right. A `@task` that finished before an interrupt in a nested graph reran the same way, which is the rerun reported in #6792. ## Cause Every task config sets `checkpoint_id` to None, and `PregelLoop` treats a config with that key as a replay, so a nested graph replayed on every resume. A replaying loop doesn't hand saved writes back to the tasks that made them, so finished tasks ran again. ## Fix `PregelLoop` now notes whether the run points it at a checkpoint (a truthy `checkpoint_id`, its own `checkpoint_map` entry, or a parent that is replaying), the test `__enter__` already uses to pick the checkpoint to load. `_first` then decides once whether finished tasks rerun: only on time travel, or on a resume at a checkpoint the thread has moved past. A plain resume of a subgraph is neither, so it hands finished tasks their writes back the way a top-level resume does. The same rule fixes the top level, which @hntrl pointed out: a resume sent with the head's `checkpoint_id`, as Studio sends it, or with `checkpoint_id: None` reran finished siblings too. A resume at an older checkpoint still reruns them, as the checkpoint migration tests expect. Telling the two apart costs one more checkpoint read for a run sent with a `checkpoint_id`. `test_addressed_resume_keeps_a_rerun_tasks_write_to_a_new_channel` relied on a resume at the head rerunning a task, so it now resumes a checkpoint the thread has moved past. Most subgraph time travel forks first, which gives tasks new ids, so saved writes can't match them anyway. `test_subgraph_replay_reasks_answered_parallel_interrupt` replays an update checkpoint, which runs in place: it passes on `main` and fails if subgraphs never replay. The counters added to `test_parallel_interrupts_double` and the three new tests in `test_interrupt_state.py` fail on `main`. ## Not in this PR - With `durability="exit"` and three or more parallel interrupts, a subgraph now hits a bug top-level graphs already have: a finished task's output is applied twice. #9314 fixes it. - #6792 also reports the interrupt of a `@task` inside a nested `@entrypoint` coming back twice. That's a separate bug. Thanks @connorimes for the report, the root cause and the fix, which this applies as proposed. The same change was opened as #9113 by @AnvitDevadiga, and @morehardy found the root cause for #6792 in #6793. JS: langchain-ai/langgraphjs#3028 Co-authored-by: Connor Imes <5701850+connorimes@users.noreply.github.com>	2026-10-15 15:51:21 -04:00
Elior Nataf LackritzandGitHub	889a5ff16f	fix(langgraph): save a resumed exit run's pending writes once (#9314) ... With `durability="exit"`, resuming three or more parallel interrupts one at a time applied the earlier answers twice. Nodes `a`, `b` and `c` each return `{"log": [f"{name}:{interrupt(name)}"]}`, and the run ends with `{"log": ["a:yes", "a:yes", "b:yes", "c:yes"]}`. ## Cause An exit-mode run saves its pending writes when it ends, and that save took all of them, including the ones loaded with the checkpoint. Savers key a task's writes by their position in the list they're given. A task that finished in an earlier run comes back with its old interrupt next to its output, so saving its list again put the output under a new index, and the next load applied both copies. ## Fix The save at exit keeps only the writes of tasks that wrote during this run. The rest are already stored on the checkpoint, which is what sync and async durability do. `test_finished_task_output_applies_once` fails on `main` in exit mode for every saver and passes for sync and async. The #9106 fix needs this too: once a subgraph stops rerunning its finished tasks, it hits this bug in exit mode. JS: langchain-ai/langgraphjs#3027	2026-10-15 15:26:01 -04:00
Baihao WangandGitHub	5eb60aef6f	release(prebuilt): 1.1.1 (#9316) ... Bumps langgraph-prebuilt from 1.1.0 to 1.1.1. Includes: - Stop `ToolNode` from swallowing a resume value that fails an interrupt's `response_schema` (#9232). This needs langgraph 1.2.15 or later, which marks those errors; with an older langgraph, `ToolNode` keeps today's behavior. - Keep tool results out of v3 messages (#7838) Managed Deep Agents (langchain-ai/managed-deepagents-sdk#710) will raise its `langgraph-prebuilt` minimum to this release, so an invalid answer to an interrupt raised inside a tool, such as a subagent, fails the resume instead of reaching the model. After merge, run the Release workflow with `working-directory=libs/prebuilt`. --- This PR was written with help from an AI coding agent (Claude Code); a human reviewed and directed the changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) prebuilt==1.1.1	2026-10-14 18:31:09 -07:00
Elior Nataf LackritzandGitHub	d4149cc1f5	release(checkpoint-postgres): 3.2.0 (#9313) ... Version bump only. No library code changes in this PR. Unreleased since `checkpointpostgres==3.1.3`: - #9290 - add `prune` / `aprune` to `PostgresSaver` and `AsyncPostgresSaver` Minor version for the new public API. It needs nothing beyond the `langgraph-checkpoint>=4.3.0` floor 3.1.3 already set. checkpointpostgres==3.2.0	2026-10-14 15:41:43 -04:00
Elior Nataf LackritzandGitHub	36bf3887f0	feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver (#9290) ... Closes #8531. `PostgresSaver` and `AsyncPostgresSaver` inherited `prune` / `aprune` from the base class, which raises `NotImplementedError`, so long-lived threads had no supported way to drop old checkpoints. This adds both strategies. Thanks to @wangjiawei-vegetable for proposing this scope in #8531 and #9247. - **`delete`** removes every checkpoint, write and blob of the threads, in one transaction. - **`keep_latest`** keeps the latest checkpoint of each namespace (the one `get_tuple` loads), with its pending writes and the blobs it references, and deletes the rest, including blobs only the deleted checkpoints used. A kept checkpoint whose parent is deleted is left with no parent. A subgraph call's namespace goes with the root checkpoint the call started from; a `checkpointer=True` subgraph keeps its latest checkpoint, since its state outlives each call. - **Each thread is pruned on one snapshot.** Its transaction runs at `REPEATABLE READ` and deletes everything that snapshot sees except the kept checkpoints, so a run appending to the thread at the same time is safe, whatever its checkpoint IDs. - **`keep_latest` refuses threads that use a `DeltaChannel`** (`NotImplementedError` naming them, nothing pruned). A `DeltaChannel` rebuilds its latest value from older checkpoints, so deleting them would empty it. The saver can't see channel types, so it detects one by what only a `DeltaChannel` leaves: `counters_since_delta_snapshot` in metadata, a snapshot (an inline `true` with a blob behind it), or `delta_writes_versioned`, which LangGraph.js sets on threads its `DeltaChannel` graphs start. The check runs for the whole batch first and again in each thread's transaction, so a thread that starts using a `DeltaChannel` mid-batch is refused at its turn. Unlike the `prune` in #6883, `keep_latest` here deletes the blobs older checkpoints no longer share with the kept ones (most of the storage on a long thread), and guards `DeltaChannel` threads. Measured locally, with or without planner statistics: a 6,000-checkpoint thread prunes in 100 to 200 ms, and one with 1,500 finished subgraph calls in about 110 ms. ## Known limitations - Two prunes of the same thread at once can fail one of them with a serialization failure or a deadlock; retrying is safe. - Forking or replaying from a checkpoint while it's being pruned is not safe. - Threads written by older releases can escape the `DeltaChannel` check: before #9142 (Python 1.2.13) and langchain-ai/langgraphjs#2973 (JS 1.5.0), some `update_state` paths saved checkpoints with neither counters nor a snapshot. - Postgres reuses the freed space but doesn't shrink the table files; that takes `VACUUM FULL` or `pg_repack`. - `DeltaChannel`-aware pruning (keeping ancestors back to the last snapshot) is a follow-up. ## Test plan - [x] `libs/checkpoint-postgres/tests/test_prune.py`: 71 tests over the sync and async savers (single connection, pool, pipeline), including the conformance `prune` capability. Passes on Postgres 15 and 16. - [x] `libs/langgraph/tests/test_prune_postgres.py`: 39 graph tests. A pruned thread loads the same state and keeps running like an unpruned twin (sync, async and exit durability, interrupts, a failed parallel step, interrupted and `checkpointer=True` subgraphs), plus deterministic races: a turn saved mid-prune, and threads switching to a `DeltaChannel` before and after their own check. - [x] Each guard (the snapshot, the writes and blob scopes, the subgraph call rules, the parent reset, the `DeltaChannel` checks, the single-string check, the pre-v4 pending sends, the pipeline sync) broken one at a time: every break fails at least one test. - [x] A thread pruned in a loop while it runs, in each durability mode, ends identical to its twin; threads written by LangGraph.js 1.5.0 and pruned from Python behave like their twins.	2026-10-14 15:09:51 -04:00
gethin-langchainandGitHub	e5b422455d	release(cli): 0.4.35 (#9310) ... Bumping the CLI to 0.4.35 to cut a release including #9305 (--image-pull-secret). cli==0.4.35	2026-10-14 17:07:39 +01:00
gethin-langchainandGitHub	6cd26d0e21	feat(cli): add --image-pull-secret for deploying through a private registry (#9305) ... ## Summary Deployments created with `--push-to` or `--image-uri` had no way to tell the control plane which Kubernetes secret to use for pulling the image, so deploying through a private registry that requires authentication (e.g. an ECR repository gated by an imagePullSecret) wasn't possible at all. The control plane's `resource_spec` already supports `image_pull_secrets` (a list of references to `kubernetes.io/dockerconfigjson` secrets); the CLI just never exposed a way to set it. This adds a repeatable `--image-pull-secret <name>` flag that populates it. ```bash langgraph deploy --push-to 123456789.dkr.ecr.us-east-1.amazonaws.com/agents/my-agent \ --image-pull-secret regcred ``` Validation follows the same pattern already used for `--listener-id`/`--k8s-namespace`: only valid when creating a deployment with `--push-to` or `--image-uri`, and rejected on an existing `--deployment-id` (the secret list is fixed at creation, same as listener placement). ## Test plan - [x] Added unit tests for the new `_resource_spec` helper (empty list keeps today's default, secrets become the expected `{"name": ...}` list) - [x] Added CLI-level tests: secret(s) land in `source_config.resource_spec.image_pull_secrets` on create (for both `--push-to` and `--image-uri`), rejected without `--push-to`/`--image-uri`, rejected on an existing `--deployment-id` - [x] `make format && make lint` clean - [x] `make test` passes, 539 passed (9 new), no regressions	2026-10-14 16:11:04 +01:00
raghavverma-langchainandGitHub	53cf85bece	feat(cli): log in with the registry username the control plane returns (#9301) ... ## Summary <!-- Write the summary yourself --> ## Test Plan - [x] `make format`, `make lint` and `make test` pass in `libs/cli` (534 tests) - [x] New tests cover the opt-in request body, logging in with the returned `username`, and pushing to exactly `repository_url`; they fail without the change - [x] Backward compatible: without `username` or `repository_url` in the response, the CLI logs in as `oauth2accesstoken` and pushes to `registry_url/<name>` as before, and control planes that don't read the request body ignore it - [ ] With the LangSmith AWS change (langchain-ai/langchainplus#49248) live: `langgraph deploy` builds locally, pushes to the deployment's ECR repository, and deploys ## Demo <!-- Drag a screen recording or screenshot here -->	2026-10-14 10:31:24 -04:00
Saad FarooqandGitHub	69d98cc0d9	fix(cli): preserve failed deployment build logs (#9308)	2026-10-14 09:05:38 -04:00
3 people	ccb851effb	chore(deps): bump handlebars from 4.7.9 to 4.7.10 in /libs/cli/js-examples (#9286) ... Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/releases">handlebars's releases</a>.</em></p> <blockquote> <h2>v4.7.10</h2> <ul> <li>security: Sanitize the source map URL when minifying - f37c599</li> <li>security: Iterate lazily in #each and strip whitespace in linear time - 812c226</li> <li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li> <li>security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f</li> <li>security: Only compile partials that are template strings - c28ee7a</li> <li>security: Only dispatch known node types in the Compiler and Visitor - 7d501a5</li> <li>security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj</li> <li>Clarify that --root does not restrict filesystem access - 0fcf25c</li> <li>Bump minimist to ^1.2.8 - ea8ed82</li> <li>Fix Ruby component publishing documentation - d069c1c</li> <li>Fix Composer component definition - 6714e07</li> </ul> <p>Compatibility notes:</p> <ul> <li><code>{{#each}}</code> iterates iterables such as <code>Map</code>, <code>Set</code> and generators lazily, like <code>for...of</code>, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.</li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md">handlebars's changelog</a>.</em></p> <blockquote> <h2>v4.7.10 - October 5th, 2026</h2> <ul> <li>security: Sanitize the source map URL when minifying - f37c599</li> <li>security: Iterate lazily in #each and strip whitespace in linear time - 812c226</li> <li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li> <li>security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f</li> <li>security: Only compile partials that are template strings - c28ee7a</li> <li>security: Only dispatch known node types in the Compiler and Visitor - 7d501a5</li> <li>security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj</li> <li>Clarify that --root does not restrict filesystem access - 0fcf25c</li> <li>Bump minimist to ^1.2.8 - ea8ed82</li> <li>Fix Ruby component publishing documentation - d069c1c</li> <li>Fix Composer component definition - 6714e07</li> </ul> <p>Compatibility notes:</p> <ul> <li><code>{{#each}}</code> iterates iterables such as <code>Map</code>, <code>Set</code> and generators lazily, like <code>for...of</code>, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.</li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e"><code>45ce152</code></a> v4.7.10</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8"><code>e47b236</code></a> Update release notes</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0"><code>f37c599</code></a> Sanitize the source map URL when minifying</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca"><code>812c226</code></a> Iterate lazily in #each and strip whitespace in linear time</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725"><code>609d1b1</code></a> Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled output</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa"><code>ceec388</code></a> Don't trust special properties on context data</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98"><code>c28ee7a</code></a> Only compile partials that are template strings</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1"><code>7d501a5</code></a> Only dispatch known node types in the Compiler and Visitor</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2"><code>703fdcc</code></a> Validate AST values in the compiler instead of the parser</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d"><code>0fcf25c</code></a> Clarify that --root does not restrict filesystem access</li> <li>Additional commits viewable in <a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-14 16:39:24 +09:00
Elior Nataf LackritzandGitHub	a6731f4367	fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer (#9302) ... Changing a field from a `DeltaChannel` to a plain reducer, for example to `Annotated[list, add_messages]`, made threads written under the `DeltaChannel` read that field as empty. The next run saved its writes over the empty value, so continuing an old thread replaced its history. The writes were still stored: the read only rebuilt fields whose current annotation is a `DeltaChannel`. - A `BinaryOperatorAggregate` stores its value at every version, so one with a version and nothing stored was written as a `DeltaChannel`. It's now rebuilt from the same history walk, one `update` per write, since a single call would reject a second `Overwrite` and drop the writes after one. - `BinaryOperatorAggregate.from_checkpoint` unwraps a stored `_DeltaSnapshot`. - The next run saves the full value, so later reads are plain reads, and switching back to a `DeltaChannel` keeps everything. Threads written under a plain reducer never walk. A rebuilt read costs the walk plus one reducer call per write since the last snapshot: with `add_messages` on `InMemorySaver`, 25 ms at 2,048 messages with a snapshot every 50 writes, and 0.3 s at 1,998 or 0.9 s at 4,998 messages with the default 1000. After one run, reads take 6 to 16 ms. `test_delta_channel_to_plain.py` covers every saver; all but the plain-thread test fail on main. JS: langchain-ai/langgraphjs#3017	2026-10-13 20:47:19 -04:00
gethin-langchainandGitHub	8a77332d0d	release(cli): 0.4.34 (#9300) ... Bumping the CLI to 0.4.34 to cut a release including #9243 (--json on deploy listeners list). cli==0.4.34	2026-10-13 16:32:51 +01:00
gethin-langchainandGitHub	a1ce197234	feat(cli): add --json to deploy listeners list (#9243) ... ## Summary `deploy listeners list` only prints a human-readable table, which a deploy automation pipeline can't reliably parse to extract a listener's id for `--listener-id`. Adds `--json`, which prints the listeners as a JSON array instead of the table. An empty workspace prints `[]` rather than the "No listeners found" sentence, so callers never need to special-case the no-results path when scripting against it. ## Test plan - [x] `make format && make lint` clean in `libs/cli` - [x] `test_deploy_listeners_list_command_json` and `test_deploy_listeners_list_command_json_no_results` in `test_cli.py`, mirroring the existing table-output test pair - [x] Full `libs/cli` suite: 529 passed, no regressions	2026-10-13 15:43:03 +01:00
Elior Nataf LackritzandGitHub	afbe7e48b1	release(checkpoint-postgres): 3.1.3 (#9287) ... Version bump only. No library code changes in this PR. Unreleased since `checkpointpostgres==3.1.2`: - #8617 - widen `Store` `put` value type to `Mapping[str, Any]` - #8556 - derive the delta walk cursor once the target loads - #8544 - order delta channel replay by task path - #9217 - validate namespace labels before store dispatch - #9248 - start the delta walk at the target - #9262 - treat an empty `checkpoint_id` as the latest in delta history Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it. checkpointpostgres==3.1.3	2026-10-12 22:57:04 +00:00
Elior Nataf LackritzandGitHub	1074714c26	release(checkpoint-sqlite): 3.1.2 (#9288) ... Version bump only. No library code changes in this PR. Unreleased since `checkpointsqlite==3.1.1`: - #8617 - widen `Store` `put` value type to `Mapping[str, Any]` - #8557 - walk delta ancestors by parent pointer - #8544 - order delta channel replay by task path - #9217 - validate namespace labels before store dispatch - #9262 - treat an empty `checkpoint_id` as the latest in delta history Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it. sdk==0.4.7 checkpointsqlite==3.1.2	2026-10-12 22:47:17 +00:00
Elior Nataf LackritzandGitHub	740461ed50	release(sdk-py): 0.4.7 (#9289) ... Bumps the Python SDK version from 0.4.6 to 0.4.7. A thread stream's run now ends only on the root graph's `completed` or `failed` event, not a subgraph's, so `thread.output` no longer reads the state too early and a run that fails after a subgraph finishes is reported as failed (#9228).	2026-10-12 22:47:05 +00:00
Igor SoarezandGitHub	08a345637f	release(langgraph): 1.2.15 (#9283) ... Bumps langgraph from 1.2.14 to 1.2.15. It now requires langgraph-checkpoint 4.3.0 or later (#8544). Also includes: - Order delta channel replay by task path (#8544) - Replay a resumed exit-mode run's delta writes in live order (#9114) - Give each `bulk_update_state` update its own task id (#9128) - Stop `astream_events` dropping control/interrupts on v1/v2 (#9219) - Never store exit-mode delta writes under the null task id (#9229) - Mark a resume value that fails an interrupt's `response_schema`, so `ToolNode` can stop swallowing it once langgraph-prebuilt is released (#9232) - Don't save a checkpoint past a failed DeltaChannel write (#9235) - Keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264) - Snapshot a DeltaChannel that an `update_state` Overwrite resets (#9263) - Read a run's DeltaChannel input back only on its own checkpoints (#9260) - Store an `update_state` input's writes on the checkpoint it updates (#9258) - Keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269) - Stop at an `interrupt_before` breakpoint when a drain is requested before it (#9281) - Save a cached node's writes like a node that ran (#9259) - Give every message written to a messages DeltaChannel an id (#9275) 1.2.15	2026-10-12 18:34:01 -04:00
3 people	b7d053b256	fix(langgraph): give every message written to a messages DeltaChannel an id (#9275) ... A DeltaChannel replays its saved writes on every read, and `_messages_delta_reducer` doesn't fill in missing ids, so the loop gives messages their ids before saving them (`ensure_message_ids`). That missed several cases: - Strings and `(role, content)` tuples, alone or in a list (`[("user", "hi")]`), and messages inside an `Overwrite` were saved with no id, so nothing could target them by id, for example `RemoveMessage`. A regular messages channel gives them ids. - A raw `Pregel` graph's input to a DeltaChannel got its ids after it was applied, and none with exit durability or on a new thread; a dict given as input read back with an id its nodes never saw. A `Command(update=...)` sent to an older checkpoint got none either. Now, in a DeltaChannel whose reducer is `_messages_delta_reducer`, every message-like the reducer accepts becomes a message with an id before the writes are saved or applied: in `put_writes`, before input is applied, for a forked `Command`, and in `update_state`. Anything that can't become a message is left as it is, so it fails where it always has. Other DeltaChannels keep the rule they had (message objects, and message dicts in a list, get ids), since they may hold other data and deepagents' messages channel, which uses its own copy of the reducer, relies on it; the dicts in an `Overwrite` there are left as they are. Lists and dicts the caller passed in are never changed: a write that changes is replaced. So the id step can recognize the reducer without an import cycle, `_messages_delta_reducer` now lives in `langgraph.pregel._messages`; `langgraph.graph.message` re-exports it. Visible changes: in a messages DeltaChannel, a node's update streams as messages with ids, and a string is stored as a message (about 170 bytes more each). JS twin: langchain-ai/langgraphjs#2992. Thanks to @HarshShroff for testing every `Overwrite` form and for the tuple fix. ## Tests `test_delta_channel_id_stability.py` and `test_delta_channel_update_state.py`: a write of every shape the reducer accepts gets an id that every read keeps, as input, from a node and through `update_state` (sync, async and as input); a list written twice adds its messages twice and stays as it was; a forked `Command` gets an id; a message dict the reducer rejects in a list still fails the run before it's saved; a raw `Pregel` input gets an id on a new thread with every durability, and its nodes see the ids that are saved; another DeltaChannel keeps the dicts in an `Overwrite`. 36 of the 87 tests in these files fail on main. The langgraph and prebuilt suites pass, and lint is clean. --------- Co-authored-by: Harsh Shroff <29751900+HarshShroff@users.noreply.github.com> checkpoint==4.3.0	2026-10-12 20:33:45 +00:00
Elior Nataf LackritzandGitHub	395c145c04	fix(langgraph): save a cached node's writes like a node that ran (#9259) ... A node served from the node cache had its writes applied but never saved: the loop only streamed them. Plain channels didn't notice, since the next checkpoint stores their value, but a `DeltaChannel` is rebuilt from the saved writes, so its saved state lost the cached node's write for good, under every durability. With `a -> b -> c` and `b` cached, a second thread read back `log` as `a, c` next to `plain` as `a, b, c`. The loop now saves a cache hit with `put_writes`, like a node that ran, in all six places it matches cached writes. A new `cached` flag keeps the hit streamed as cached and stops `put_writes` from writing it back to the cache, which would also restart its TTL. A hit now costs the saver write the node makes when it runs, and a cached `@task` call's result is saved the same way. The sync loop also stops caching a node that failed or was interrupted, as the async loop already did: a cached error made the next run with the same input skip the node without raising. Found in review of langchain-ai/langgraphjs#2969. JS twin: langchain-ai/langgraphjs#2980 ## Tests - `test_delta_channel_node_cache.py`: `b` runs on the first thread and is a cache hit on the second, under every durability, with `invoke` and `ainvoke`. Every checkpoint of the second thread reads the same in the DeltaChannel and a plain channel, and the cache is written once. All 6 cases fail on main; without the `cached` check in `put_writes`, they fail on the cache count. - `test_a_node_that_fails_is_not_cached`, with `invoke` and `ainvoke`: a cached node that raises raises again on the next thread. The sync case fails on main. - The two tests that spy on `PregelLoop.put_writes` pass the new keyword through. - `make format`, `make lint_package`, `make lint_tests`, and the `langgraph`, `prebuilt` and `cli` suites pass (without Redis).	2026-10-12 14:24:38 -04:00
Igor SoarezandGitHub	10f1fabb3b	fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it (#9281) ... When a drain is requested during the step right before an interrupt_before breakpoint, the run stops with GraphDrained and the breakpoint is lost: resuming the run skips it unintentionally. The fix moves the drain check in tick() after the breakpoint check, so breakpoints win over draining. JS twin: langchain-ai/langgraphjs#3009	2026-10-12 18:29:56 +03:00
Elior Nataf LackritzandGitHub	799c2f04fd	fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269) ... An exit-durability run that starts from a checkpoint the thread has moved past, addressed by `checkpoint_id`, stores its DeltaChannel writes on that checkpoint. The branch that already grew from it reads the writes stored there, so its checkpoints picked up this run's writes too: ```python graph.invoke({"log": ["in1"]}, config) # nodes a and b add "a1", "b1" turn_1 = graph.get_state(config).config graph.invoke({"log": ["in2"]}, config) turn_2 = graph.get_state(config).config graph.invoke({"log": ["in3"]}, turn_1, durability="exit") graph.get_state(turn_2).values["log"] # ["in1", "a1", "b1", "in3", "a3", "b3", "in2", "a2", "b2"], was ["in1", "a1", "b1", "in2", "a2", "b2"] ``` Sync and async durability store each step's writes on the run's own checkpoints, so they weren't affected. The run now snapshots the DeltaChannels it wrote instead, as a run's input already does on a checkpoint a `checkpoint_id` addressed (#9260). That costs one snapshot of each channel the run wrote, even when the addressed checkpoint is the latest one. Threads that already hit this keep the wrong values on the existing branch. Found by @hntrl in review of langchain-ai/langgraphjs#2974 ([repro](https://gist.github.com/hntrl/2185e489abe22147b3f6f77010c18264)). JS twin: langchain-ai/langgraphjs#2989 ## Tests `test_delta_channel_exit_mode.py`: one and two exit runs from the end of turn 1, after turn 2, leave every checkpoint's DeltaChannel equal to a plain reducer channel. Both fail on main on every saver in the fixture. The `langgraph` suite passes (without Redis), and lint is clean.	2026-10-11 08:51:09 -04:00
Elior Nataf LackritzandGitHub	b4991f1ba3	fix(langgraph): store an update_state input's writes on the checkpoint it updates (#9258) ... `update_state(..., as_node="__input__")` stored its writes on the checkpoint it saved. A DeltaChannel reads the writes stored on a checkpoint's ancestors, not its own, so that checkpoint read back without the input unless the channel snapshotted there, and once a later checkpoint snapshotted, the input was gone for good. Only a raw `Pregel` graph whose input channel is a DeltaChannel hits it, since a `StateGraph`'s input goes to its start channel. The input's writes now go on the checkpoint the update builds on, as a node update's do. An update on a checkpoint the thread has moved past stores nothing there and snapshots the DeltaChannels it writes on its own checkpoint instead, the rule a node update already follows (#9165). Both kinds of update now go through one helper, which also gives a message an id before saving it, as the loop's `put_writes` does with `ensure_message_ids`. Before, a message saved through `update_state` without an id read back with id `None`, on the node path too, while the same message from a node got one. JS twin: langchain-ai/langgraphjs#2973, where review found it. ## Tests `test_delta_channel_update_state.py`, sync and async: an update as input reads back on its checkpoint and after the next run, with `snapshot_frequency` 1 and 2, and an update as input to an older checkpoint stays out of its other branch. The frequency 2 and older-checkpoint cases fail on main. Five more check that a message saved through `update_state` gets an id every read keeps, on the node path (latest and older checkpoint) and the input path, sync and async; they fail on main. The langgraph suite passes, and `lint_package` and `lint_tests` are clean.	2026-10-10 11:57:46 +00:00
Elior Nataf LackritzandGitHub	6aa0afba68	fix(checkpoint): default InMemorySaver delta history to the latest checkpoint (#9257) ... `InMemorySaver.get_delta_channel_history` looked its target up by `config["configurable"].get("checkpoint_id", "")`, so a config without a `checkpoint_id` matched no checkpoint, and every channel came back with no seed and no writes, which a `DeltaChannel` reads as empty. The base implementation, `PostgresSaver` and `SqliteSaver` read from the thread's latest checkpoint instead, as `get_tuple` does. A missing id now resolves to the namespace's newest checkpoint id, with the same `max` that `InMemorySaver.get_tuple` uses. Graphs always pass a checkpoint id here, so only direct callers of the saver API were affected, and a call with an id does the same work as before. Thanks @Hotragn, who pinned this down on #8242, where @longquanzheng's branch had already fixed it. JS twin: langchain-ai/langgraphjs#2979 ## Tests - `test_get_channel_writes_without_checkpoint_id_reads_the_latest` fails on main (`{'messages': {'writes': []}}`). - The `checkpoint`, `checkpoint-conformance`, `checkpoint-sqlite`, `checkpoint-postgres` (Postgres 16), `prebuilt` and `langgraph` suites pass, the last two without their Redis cases. The DeltaChannel conformance suite also passes against `InMemorySaver`; CI skips that run in `libs/checkpoint`, where the conformance package isn't installed, so the new test lives in `test_memory.py`.	2026-10-10 00:59:20 +00:00
Elior Nataf LackritzandGitHub	12aeb0fddb	fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints (#9260) ... A raw `Pregel` graph whose input channel is a DeltaChannel saved a run's input to it as a `NULL_TASK_ID` write on the checkpoint the run started from, under `"sync"` and `"async"` durability. Readers apply a checkpoint's `NULL_TASK_ID` writes as its own state, so: - on a new thread that checkpoint is never saved, and the first run's input was lost for good: after `{"log": [0], "plain": [0], ...}`, `log` read `[2]` next to `plain` `[0, 2]`; - the last checkpoint of a run read the next run's input; - a run with input from an older checkpoint (`checkpoint_id`) leaked its input into the branch that already grew from it, and read that branch's input when it had one. The input's writes now go on the checkpoint the run starts from under a task id of their own, `uuid5(checkpoint_id, INPUT)`, the one `update_state` uses for an input update. On a new thread, or a checkpoint a `checkpoint_id` addressed, which may already have children that would read them, nothing is stored there and the input checkpoint snapshots the channel instead. A normal run stores the same write as before, and `durability="exit"`, which already kept the input right, is unchanged. Threads saved before this keep the input writes already stored on their checkpoints. A `StateGraph` routes its input through its start channel, so only raw `Pregel` graphs hit this. JS twin: langchain-ai/langgraphjs#2981 ## Tests `test_delta_channel_run_input.py`, under every durability, with `invoke` and `ainvoke`: two runs on a new thread, and a run with input from an older checkpoint whose other branch had DeltaChannel input or none. Every checkpoint reads the same in the DeltaChannel and a plain channel. The 12 sync and async cases fail on main, and dropping the task id, the new-thread snapshot or the addressed-checkpoint snapshot each fails its own cases. The `langgraph` and `prebuilt` suites pass (without Redis), and `lint_package` and `lint_tests` are clean.	2026-10-09 15:59:10 -04:00
Elior Nataf LackritzandGitHub	d05236f805	fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets (#9263) ... A node that writes an `Overwrite` to a DeltaChannel makes the loop snapshot the channel on the checkpoint that superstep saves, so no read replays across the reset. The same write through `update_state`, as a node or as input, didn't snapshot: the value read back right, but reads of the update's checkpoint and the ones after it walked back past the reset to the last snapshot. `update_state` now snapshots a DeltaChannel an `Overwrite` resets, as the loop does. Raised in review of langchain-ai/langgraphjs#2973. JS twin: langchain-ai/langgraphjs#2982 ## Tests `test_delta_channel_update_overwrite.py`, sync and async: an `Overwrite` through `update_state` as a node, and as input to a raw `Pregel` graph, snapshots the channel on the checkpoint the update saves, and the value reads back as the overwrite. All four fail on main. The `langgraph` suite passes (without Redis), and `lint_package` and `lint_tests` are clean.	2026-10-09 15:26:16 -04:00
Elior Nataf LackritzandGitHub	9d92f33cca	fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264) ... A fork from a checkpoint with pending writes to a DeltaChannel snapshots the channel on the fork's first checkpoint, so the fork doesn't replay the other branch's writes. If the channel had never been written there, the snapshot also gives it its first version, and `_mark_bumps_seen` only marked the bump seen for nodes that already have a `versions_seen` entry. A node subscribed to the channel that never ran has none, so the bump started it, and it read the empty value before the node that writes the channel had run: ```python graph.invoke("go", config) # writer writes [1] to d, reader reads [1] fork = graph.update_state(first_checkpoint, {"a": "go"}, as_node="__input__") graph.get_state(fork).next # ("writer", "reader"): resuming runs reader on [] first ``` A replay from that checkpoint saves the same kind of fork from the loop. A channel bumped from no version was never written, so `create_checkpoint` now also marks the bump seen for the nodes the channel triggers, from the graph's `trigger_to_nodes`, at every call that can bump. Only raw `Pregel` graphs hit this: `StateGraph` nodes trigger on their `branch:to:*` channels, not on state keys. An `as_node="__copy__"` fork still starts such a node, with a plain list channel as well, so that case isn't DeltaChannel-specific and isn't changed here. Raised in review of langchain-ai/langgraphjs#2974. JS twin: langchain-ai/langgraphjs#2983 ## Tests `test_delta_channel_seal_subscribers.py`: an update as input (sync and async) and a replay from the checkpoint before a DeltaChannel's first write leave only the writer next, and the reader then reads the written value once. All three fail on main. The `langgraph` suite passes (without Redis), and `lint_package` and `lint_tests` are clean.	2026-10-09 14:36:27 -04:00
Elior Nataf LackritzandGitHub	26356227c4	test(checkpoint): run the delta conformance suite against InMemorySaver in CI (#9261) ... The conformance self-test in `libs/checkpoint-conformance` ran every capability against `InMemorySaver` but asserted only the base ones. `libs/checkpoint/tests/test_conformance_delta.py`, which ran the delta conformance tests against it, always skips in CI: `libs/checkpoint` can't depend on the conformance package, which depends on it. So no CI job checked `InMemorySaver.get_delta_channel_history` against the delta conformance tests. The self-test now asserts every capability `InMemorySaver` implements, and the skipped copy is gone. ## Tests - With `InMemorySaver.get_delta_channel_history` broken to return no history, the self-test now fails on 7 of the 10 delta conformance tests; on main it still passes. - `make format`, `make lint` and `make test` pass in `libs/checkpoint-conformance`.	2026-10-09 13:44:55 -04:00
Elior Nataf LackritzandGitHub	a5dbacae0d	fix(checkpoint-postgres,checkpoint-sqlite): treat an empty checkpoint_id as the latest in delta history (#9262) ... `PostgresSaver` and `SqliteSaver`, sync and async, read a DeltaChannel's history from the latest checkpoint only when the config's `checkpoint_id` was missing or `None`. An empty one was looked up as an id, matched nothing, and came back with no seed and no writes, while their own `get_tuple` treats an empty id as the latest checkpoint, as the default implementation does. They now check for a missing or empty id the way `get_tuple` does. The in-memory saver gets the same in #9257. Graphs always pass the id of a saved checkpoint, so only direct callers of the saver API hit this. ## Tests - `test_{sync,async}_empty_checkpoint_id_reads_from_the_latest_checkpoint` in `checkpoint-postgres/tests/test_delta_pagination.py` and `checkpoint-sqlite/tests/test_delta_parent_walk.py`: all four fail on main. - The `checkpoint-postgres` (Postgres 16) and `checkpoint-sqlite` suites pass, and `lint_package` and `lint_tests` are clean in both.	2026-10-09 13:44:51 -04:00
3 people	cba111d8d6	fix(langgraph): don't save a checkpoint past a failed DeltaChannel write (#9235) ... A DeltaChannel is rebuilt from its writes along the parent chain, so a checkpoint saved without one of them reads back short for good. If saving a DeltaChannel write failed (a database blip, say), the next checkpoints were saved anyway and the channel lost that write, while plain channels kept it. Three things let that happen: - the sync loop waited for the delta writes before saving a checkpoint, but never checked that they succeeded; - both loops saved a checkpoint even when the previous save had failed, so it pointed at a parent that was never saved; - each save took the pending write list only when it started in the background, and saves can start out of order, so a save could take a later checkpoint's writes and not wait for its own. Waiting on writes queued behind it, a save could also hang a sync run with `durability="async"` (the default) once every worker was such a save: on a 15-core machine a loop of 100 fast steps hung every time with default settings, and with `max_concurrency=1` three steps are enough. Now `_put_checkpoint` hands each save the writes submitted before it, and a save fails if one of them or the previous save failed. The run raises the write's error as before, the thread stays at its last checkpoint that has all its writes, and running it again reruns the task. For graphs without a DeltaChannel, a failed save now also stops the later saves of that run, as JS already does, instead of saving checkpoints whose parent is missing. Thanks @shivangsharma01 for reproducing this in #8234, and @iroiro147, whose #8299 had the first two changes before the issue-assignment check closed it. Thanks also to @HarshShroff for the failed-save test case. JS twin: langchain-ai/langgraphjs#2969 ## Tests `test_delta_channel_write_failures.py`: - a saver fails one delta write once; on every durability, with `invoke` and `ainvoke`, every saved checkpoint matches a plain channel and a retry gets the write back. The `invoke` cases and `ainvoke` with `durability="async"` fail on main. - a saver fails the save of the checkpoint after `a` once; with `invoke` and `ainvoke`, every saved checkpoint matches a plain channel and a retry finishes the run. The `durability="async"` cases fail on main, which saves the later checkpoints on top of the missing one. - a delta graph run with `max_concurrency=1` finishes. It hangs on main. Reverting any one of the three changes fails at least one of these. `make format`, `make lint` and the langgraph suite pass. A 100-step benchmark (delta and plain channels, every durability, with and without 1 ms of saver latency) makes the same saver calls and runs in the same time as main, except for the case that hangs on main. --------- Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com>	2026-10-09 12:48:24 +00:00
Elior Nataf LackritzandGitHub	93a5a28008	perf(checkpoint-postgres): start the delta walk at the target (#9248) ... Reading a DeltaChannel at an older checkpoint (the state at a past checkpoint, each entry of `get_state_history`, a fork or replay from one) walked `checkpoints` down from the newest row, so every newer row was read before the target's chain. A checkpoint's ancestors have smaller ids, the order `get_tuple` already relies on to find the latest checkpoint, so the walk now starts at the target: the first page is `checkpoint_id <= target`, later pages stay `< cursor`. The cursor is never NULL anymore, so the `(cursor IS NULL OR checkpoint_id < cursor)` predicate goes too. Once Postgres caches a generic plan for the prepared statement (`from_conn_string` sets `prepare_threshold=0`), that predicate is a filter rather than an index condition, and each later page re-read every newer row. `get_delta_channel_history` on a 6,000-checkpoint thread with a snapshot every 200 checkpoints, median of three runs of 60 reads each, same results before and after: | target | main | this PR | |---|---|---| | newest | 3.1 ms | 2.7 ms | | 1,000 back | 4.5 ms | 2.9 ms | | 3,000 back | 8.9 ms | 2.8 ms | | 5,000 back | 15.7 ms | 2.8 ms | The target is now always the first row read, so the pagination tests from #8556 can no longer leave it off the first page; they are renamed for what they still cover, a walk that continues across pages. ## Test plan - [x] `test_{sync,async}_walk_reads_nothing_newer_than_the_target` record the rows the walk reads; both fail on main, which also reads the three newer checkpoints. - [x] `checkpoint-postgres` suite on Postgres 16: 281 passed, 3 skipped. - [x] `langgraph` DeltaChannel tests against this saver (`-k "delta and not redis"`): 1,154 passed, 1 skipped.	2026-10-09 08:31:15 -04:00
4 people	bfcfea554e	fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate namespace labels before store dispatch (#9217) ... The SQLite and Postgres stores save a namespace as its labels joined with `.`, so a label containing `.` could resolve to a different namespace: `("foo.bar",)` and `("foo", "bar")` share the same row. This rejects those labels at every entry point. - `BaseStore` and `AsyncBatchedBaseStore`: `get`, `search`, `delete`, and `list_namespaces` (sync and async) reject labels that are empty, not strings, or contain `.`. The check runs before an op is queued, so one caller's bad label can't fail other callers' concurrent requests. - New `langgraph.store.base.validate_op_namespace(op)` applies the same label checks to a single op. `SqliteStore`/`AsyncSqliteStore` and `PostgresStore`/`AsyncPostgresStore` call it from `_group_ops` before any SQL runs, which covers direct `batch`/`abatch` calls. Other stores that serialize namespaces as delimited text can call it too. - Unchanged: hierarchical prefix search, empty-prefix `search(())`, `*` wildcards in `list_namespaces`, and the existing `put` rules. ## Release note `get`, `search`, `delete`, and `list_namespaces` now raise `InvalidNamespaceError` for labels that are empty, not strings, or contain `.`, where they previously returned `None` or `[]` (or, on the SQLite and Postgres stores, matched a different namespace). `put` already rejected these labels, so nothing written through `put` becomes unreachable. ## Release order Release `langgraph-checkpoint` first. `langgraph-checkpoint-sqlite` and `langgraph-checkpoint-postgres` import `validate_op_namespace`, so they need the `langgraph-checkpoint` release that ships it. `main` already has `libs/checkpoint` at 4.3.0 and requires `langgraph-checkpoint>=4.3.0` in both stores (from #8544), so this must merge before 4.3.0 is released; if 4.3.0 ships first, bump to the next version and raise both requirements to it. That also guarantees the pre-queue checks are installed: with an older `langgraph-checkpoint`, an invalid op would fail inside the shared `abatch` and reject the calls batched with it. --------- Co-authored-by: Baihao Wang <byhow@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-10-08 16:10:55 -07:00
Elior Nataf LackritzandGitHub	93f5eaff21	fix(checkpoint): keep serialized data when an object can't be rebuilt (#9251) ... Fixes #6970 If a checkpointed object can't be rebuilt on load (its module was removed or renamed, or its constructor now rejects the stored fields), `JsonPlusSerializer` returned `None` for it, so the value silently disappeared from restored state. The constructor and method ext codes now return the serialized payload instead, the same thing the pydantic and blocked-type paths already do, and log a one-time warning per type. The warning names the exception type only, since exception messages can echo the stored value. Thanks @yangbaechu for the report and repro. This takes the same direction as #6972 by @pandego and #7152 by @SinzoL.	2026-10-08 16:01:46 -04:00
Baihao WangandGitHub	5965d72ff7	fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values (#9232) ... **Problem.** `interrupt(response_schema=...)` checks a human's answer when the graph resumes. If the answer doesn't match the schema, the resume fails, nothing is saved, and the human can answer again (#8886). That works when the interrupt runs in a graph node, but not when it runs inside a tool: either the tool calls `interrupt()` itself, or it starts a graph that does, such as a subagent called as a tool. There, the resume returns normally and the interrupt disappears. **Why.** `interrupt()` raises a `pydantic.ValidationError` for an invalid answer. When one comes out of a tool, `ToolNode` assumes the model passed bad arguments, so it hands the error to the model ("Error invoking tool … Please fix the error and try again") and the run carries on. The human never sees the error, the model is blamed for it, and the interrupt is no longer pending. **Fix.** `interrupt()` still raises the same `ValidationError`, but marks it so a new helper, `langgraph.errors.is_invalid_resume(error)`, can recognize it. `ToolNode` re-raises these errors instead of handing them to the model, whatever `handle_tool_errors` is set to, so a bad answer fails the resume the same way inside a tool as outside one: nothing is saved and the interrupt can be answered again. Every other `ValidationError` from a tool is handled as before. **Also fixed, in the same error handling.** With `wrap_tool_call` set and a `handle_tool_errors` other than the default (for example `True`), `ToolNode` turned any exception from the wrapper into an error `ToolMessage`, including `GraphInterrupt`. So an interrupt in that setup never paused: the model got `Error: GraphInterrupt(...)` instead. Interrupts now propagate there too, as they already do without a wrapper. `create_agent` uses the default handler, so it was not affected. **Compatibility.** Not a breaking change: the error type is unchanged. Worth a careful look: a wrapped `ToolNode` with a non-default `handle_tool_errors` now pauses on interrupts instead of returning them to the model as errors. With an older `langgraph` that doesn't have `is_invalid_resume`, `ToolNode` keeps today's behavior.	2026-10-08 12:59:25 -07:00
Elior Nataf LackritzandGitHub	40a2e6d845	fix(langgraph): never store exit-mode delta writes under the null task id (#9229) ... In exit mode, a run stores its DeltaChannel writes on the checkpoint it started from, under synthetic task ids that put the superstep first. For a `Command`'s writes in a run whose first superstep is 0, that id came out as `NULL_TASK_ID` itself. Readers take writes under `NULL_TASK_ID` for the checkpoint's own pending writes, so after `invoke(Command(update=...), durability="exit")`: - on a new thread, `get_state` on the empty first checkpoint showed the update in the DeltaChannel but not in a plain channel; - on a thread whose first checkpoint came from `update_state(..., as_node="__input__")`, `get_state` on that checkpoint showed the update the same way, and a replay or fork from it applied the update to the DeltaChannel only. `exit_delta_task_id` now never returns `NULL_TASK_ID`. Threads already saved this way stay as they are. ## Tests - `test_command_update_on_an_input_checkpoint_matches_a_plain_channel` compares every checkpoint in the history, and a replay from the input checkpoint, with a plain channel, on every checkpointer and durability. The exit cases fail without the fix. - `test_exit_command_update_on_a_new_thread_matches_a_plain_channel` compares every checkpoint in a new thread's history with a plain channel, on every checkpointer, and fails without the fix. It runs in exit mode only: in sync and async the two channels already differ on `main`, because of a separate bug that applies a new thread's `Command` update twice. `make format`, `make lint` and the langgraph suite pass.	2026-10-07 19:17:02 -04:00