first pass at data storage docs

docs/docs/cloud/reference/cli.md

@@ -50,7 +50,6 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
     | <span style="white-space: nowrap;">`python_version`</span>   | `3.11`, `3.12`, or `3.13`. Defaults to `3.11`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
     | <span style="white-space: nowrap;">`node_version`</span>     | Specify `node_version: 20` to use LangGraph.js.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
     | <span style="white-space: nowrap;">`pip_config_file`</span>  | Path to `pip` config file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-    | <span style="white-space: nowrap;">`pip_installer`</span> | _(Added in v0.3)_ Optional. Python package installer selector. It can be set to `"auto"`, `"pip"`, or `"uv"`. From version&nbsp;0.3 onward the default strategy is to run `uv pip`, which typically delivers faster builds while remaining a drop-in replacement. In the uncommon situation where `uv` cannot handle your dependency graph or the structure of your `pyproject.toml`, specify `"pip"` here to revert to the earlier behaviour. |
     | <span style="white-space: nowrap;">`dockerfile_lines`</span> | Array of additional lines to add to Dockerfile following the import from parent image.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
     | <span style="white-space: nowrap;">`checkpointer`</span>   | Configuration for the checkpointer. Contains a `ttl` field which is an object with the following keys: <ul><li>`strategy`: How to handle expired checkpoints (e.g., `"delete"`).</li><li>`sweep_interval_minutes`: How often to check for expired checkpoints (integer).</li><li>`default_ttl`: Default time-to-live for checkpoints in **minutes** (integer). Defines how long checkpoints are kept before the specified strategy is applied.</li></ul> |
     | <span style="white-space: nowrap;">`http`</span>            | HTTP server configuration with the following fields: <ul><li>`app`: Path to custom Starlette/FastAPI app (e.g., `"./src/agent/webapp.py:app"`). See [custom routes guide](../../how-tos/http/custom_routes.md).</li><li>`disable_assistants`: Disable `/assistants` routes</li><li>`disable_threads`: Disable `/threads` routes</li><li>`disable_runs`: Disable `/runs` routes</li><li>`disable_store`: Disable `/store` routes</li><li>`disable_meta`: Disable `/ok`, `/info`, `/metrics`, and `/docs` routes</li><li>`cors`: CORS configuration with fields for `allow_origins`, `allow_methods`, `allow_headers`, etc.</li><li>`configurable_headers`: Define which request headers to exclude or include as a run's configurable values.</li></ul> |
@@ -129,7 +128,7 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
         - `cohere:embed-english-v3.0`: 1024 
         - `cohere:embed-english-light-v3.0`: 384 
         - `cohere:embed-multilingual-v3.0`: 1024 
-        - `cohere:embed-multilingual-light-v3.0`: 384 
+        - `cohere:embed-multilingual-light-v3.0`: 384
 
     #### Semantic search with a custom embedding function
 
@@ -362,8 +361,8 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
 
     **Options**
 
-    | Option               | Default          | Description                                                                                                     |
-    | -------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------- |
+    | Option               | Default          | Description                                                                                                                  |
+    | -------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
     | `--platform TEXT`    |                  | Target platform(s) to build the Docker image for. Example: `langgraph build --platform linux/amd64,linux/arm64`              |
     | `-t, --tag TEXT`     |                  | **Required**. Tag for the Docker image. Example: `langgraph build -t my-image`                                               |
     | `--pull / --no-pull` | `--pull`         | Build with latest remote Docker image. Use `--no-pull` for running the LangGraph Platform API server with locally built images. |
@@ -382,8 +381,8 @@ The LangGraph CLI requires a JSON configuration file that follows this [schema](
 
     **Options**
 
-    | Option               | Default          | Description                                                                                                     |
-    | -------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------- |
+    | Option               | Default          | Description                                                                                                                  |
+    | -------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
     | `--platform TEXT`    |                  | Target platform(s) to build the Docker image for. Example: `langgraph build --platform linux/amd64,linux/arm64`              |
     | `-t, --tag TEXT`     |                  | **Required**. Tag for the Docker image. Example: `langgraph build -t my-image`                                               |
     | `--no-pull`          |                  | Use locally built images. Defaults to `false` to build with latest remote Docker image.                                      |

docs/docs/concepts/data_storage_and_privacy.md

@@ -0,0 +1,127 @@
+# Data Storage and Privacy
+
+This document provides a comprehensive overview of what data is stored, collected, and processed when using LangGraph, particularly with the CLI tools like `langgraph dev`.
+
+## What Data is Stored
+
+### CLI Telemetry (Opt-out)
+
+By default, the LangGraph CLI collects minimal analytics data to help improve the tool:
+
+**Data Collected:**
+- CLI command used (e.g., `dev`, `up`, `build`)
+- CLI version
+- Operating system type and version
+- Python version
+- Anonymized parameter usage (boolean flags indicating non-default options were used)
+
+**Data NOT Collected:**
+- Actual parameter values
+- File contents or paths
+- Personal information
+- Code or graph implementations
+- API keys or sensitive data
+
+**How to Opt Out:**
+Set the environment variable `LANGGRAPH_CLI_NO_ANALYTICS=1` to disable all CLI analytics collection.
+
+### LangSmith Integration (Opt-in)
+
+When a `LANGSMITH_API_KEY` is provided (not required):
+- Metadata on number of runs executed
+- Current API version being run
+- Trace data (if tracing is enabled)
+
+This data is only sent when explicitly configured with LangSmith credentials.
+
+### Tracing Data (Opt-in)
+
+When tracing is enabled:
+- Execution traces are logged to the configured tracing backend
+- This requires explicit configuration and is not enabled by default
+
+## What Data is NOT Stored Remotely
+
+- **Checkpoints**: Stored locally in your development environment
+- **Memory store data**: Persisted locally, not transmitted
+- **Graph state**: Remains in your local environment
+- **Application data**: Your actual application logic and data stay local
+
+## Local Data Storage
+
+### Development Mode (`langgraph dev`)
+
+When using `langgraph dev`:
+- State is persisted to a local directory
+- Checkpoints are stored locally for debugging and development
+- No remote storage or transmission of your application data
+
+### Checkpoints and State Persistence
+
+LangGraph automatically persists:
+- **Checkpoints**: Snapshots of graph state at each execution step
+- **Thread data**: Conversation/execution history organized by thread IDs
+- **Graph state**: Node outputs, intermediate results, and execution metadata
+- **Memory/Store data**: Information that persists across multiple threads
+
+**Storage Locations:**
+- **Local development**: Local directory (configurable)
+- **Docker deployment**: Local Docker volumes
+- **LangGraph Platform**: Managed database infrastructure
+
+## Security and Encryption
+
+### Data Encryption
+
+- Checkpointers can optionally encrypt all persisted state
+- Encryption uses AES encryption via `EncryptedSerializer`
+- When `LANGGRAPH_AES_KEY` environment variable is present, encryption is automatically enabled on LangGraph Platform
+
+### Data Retention
+
+- **TTL (Time-to-Live)**: Configurable automatic cleanup of old data
+- **Default TTL**: Can be set in minutes for automatic expiration
+- **Automatic sweeping**: Expired data is automatically removed at configurable intervals
+
+## Privacy Controls
+
+### Environment Variables
+
+Key environment variables for controlling data collection and storage:
+
+- `LANGGRAPH_CLI_NO_ANALYTICS=1`: Disable CLI analytics collection
+- `LANGGRAPH_AES_KEY`: Enable automatic encryption of stored data
+- `LANGSMITH_TRACING=false`: Disable tracing to LangSmith (self-hosted deployments)
+- `LANGSMITH_API_KEY`: Enable LangSmith integration (opt-in)
+
+### Logging Controls
+
+- `LOG_LEVEL`: Control verbosity of logs
+- `LOG_JSON`: Format logs as JSON
+- Various other logging configuration options
+
+## Security Policy
+
+For security vulnerabilities:
+- Report through the huntr.com bounty program
+- LangGraph is in-scope for security bounties
+- Security contact: `security@langchain.dev`
+
+## Best Practices for Privacy
+
+1. **Review Analytics**: Set `LANGGRAPH_CLI_NO_ANALYTICS=1` if you prefer not to share usage analytics
+2. **Enable Encryption**: Use `LANGGRAPH_AES_KEY` for sensitive data
+3. **Configure TTL**: Set appropriate data retention policies
+4. **Monitor Tracing**: Only enable tracing when needed and review what data is being sent
+5. **Environment Variables**: Audit your environment variables to ensure proper privacy controls
+
+## Summary
+
+LangGraph is designed with privacy in mind:
+- Minimal data collection (analytics can be disabled)
+- Local storage by default for development
+- Optional encryption for sensitive data
+- Clear opt-in requirements for external services
+- Comprehensive privacy controls through environment variables
+
+Your application data, checkpoints, and state remain under your control and are not transmitted unless you explicitly configure external services like LangSmith.

docs/mkdocs.yml

@@ -184,6 +184,7 @@ nav:
           - cloud/how-tos/datasets_studio.md
         - LangGraph SDK: concepts/sdk.md
       - Data management:
+        - Data storage & privacy: concepts/data_storage_and_privacy.md
         - Add semantic search: cloud/deployment/semantic_search.md
         - Add TTLs: how-tos/ttl/configure_ttl.md
       - Authentication & access control:

libs/langgraph/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "langgraph"
-version = "0.4.9"
+version = "0.4.8"
 description = "Building stateful, multi-actor applications with LLMs"
 authors = []
 requires-python = ">=3.9"

libs/langgraph/uv.lock

@@ -1197,7 +1197,7 @@ wheels = [
 
 [[package]]
 name = "langgraph"
-version = "0.4.9"
+version = "0.4.8"
 source = { editable = "." }
 dependencies = [
     { name = "langchain-core" },