Saad Farooq
f58bdf7646
fix(cli): decline root copy on patterns Docker reads differently
...
Docker treats `[!...]` and inner `**` differently from pathspec, and
tarfile skips codecs Python was built without. Decline on those patterns,
detect compressed archives by magic bytes, and pin the saved-Dockerfile
and compose paths to per-entry copies.
2026-11-02 19:15:10 -05:00
Saad Farooq
cfb0fcc435
fix(cli): only collapse the uv root copy for immediate builds
...
A saved Dockerfile can be built after the tree changes, and ADD . would
then pick up entries the generation-time check never saw (.venv, .git,
symlinks). Gate the single copy behind single_root_copy, which only
build_docker_image sets.
2026-11-02 18:51:49 -05:00
Saad Farooq
777df4d7da
refactor(cli): trim root-copy guard and its tests
2026-11-02 18:24:40 -05:00
Saad Farooq
2d4b6a6ce7
perf(cli): copy uv project root in a single layer when equivalent
...
In uv.lock mode the root package was copied with one ADD per top-level
entry. Emit a single ADD . when that provably yields the same files, and
keep the per-entry walk otherwise.
2026-11-02 18:13:47 -05:00
Elior Nataf Lackritz
9791c686ee
fix(sdk-py): rejoin a run stream that closes before the run ends ( #9554 )
...
Fixes #9016
A run stream whose response ends cleanly before the run does, say on a
proxy timeout or a server restart, looked like a finished run:
`HttpClient.stream` and `SyncHttpClient.stream` reconnect to the
`Location` only when the connection fails, so the caller got a cut
answer and no error. Servers generally send no `end` event when a run
ends, so a clean close alone cannot tell the cases apart, and
reconnecting on every clean close would end every finished run in five
empty reconnects and an error.
**The rule.** After a clean close, when the stream's `Location` is a
run's stream (`<prefix>/threads/{thread_id}/runs/{run_id}/stream`, any
query) and no `end` or `error` event arrived across reconnects, the
client sends `GET <prefix>/threads/{thread_id}/runs/{run_id}` with the
reconnect headers, but `Accept: application/json` and no
`Last-Event-ID`.
- `pending` or `running`, or a 429, 5xx or transport error (the restart
that closed the stream can fail the check too): handled like a dropped
connection, with the same `Last-Event-ID`, attempt budget, backoff and
warnings, so repeated closes with no new events end in the usual
max-attempts error.
- Any other status, a 4xx other than 429, or a body that isn't a run:
the stream ends as it does today. The check never raises and uses the
client's normal timeout.
Thread streams, streams without a `Location`, and the threadless
`/runs/{run_id}/stream` `Location` older servers send for stateless runs
are unchanged. A stateless run whose `Location` names its temporary
thread is checked like any other run: it rejoins while the run is
pending or running, and once the run ends and the thread is deleted the
check gets a 404 and the stream ends. As after a drop, runs created
without `stream_resumable=True` reconnect without a cursor and warn.
**Cost.** One extra GET at the end of every run stream that ends without
an `end` or `error` event. It returns the whole run record, `kwargs`
(the run's input) included, so a run started with a large input
downloads it again. With a server that sends neither event, that is
every run stream, so the iterator finishes about one round trip later.
**Tests.** The new tests mock the transport, and `main` stops at the
first clean close. 38 of the 50 new cases fail on `main`; the 12
no-check cases pass on both.
Thanks to @Bruce-Yii for the report and root cause, and to
@anushamukka9, whose #9023 proposed reconnecting after a clean close;
this version asks the run first.
Paired JS change: https://github.com/langchain-ai/langgraphjs/pull/3185
2026-11-02 19:57:22 +00:00
dependabot[bot]
ee3c043bdd
chore(deps): bump langgraph from 1.2.3 to 1.2.14 in /libs/cli ( #9512 )
...
Bumps [langgraph](https://github.com/langchain-ai/langgraph ) from 1.2.3
to 1.2.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph's
releases</a>.</em></p>
<blockquote>
<h2>langgraph==1.2.14</h2>
<p>Changes since 1.2.13</p>
<ul>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<h2>langgraph==1.2.13</h2>
<p>Changes since 1.2.12</p>
<ul>
<li>fix(langgraph): fork before replaying an update checkpoint the
thread moved past (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9170 ">#9170</a>)</li>
<li>fix(langgraph): keep an update_state on an older checkpoint out of
its other branches (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9165 ">#9165</a>)</li>
<li>fix(langgraph): keep DeltaChannel counters on every update_state
path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9142 ">#9142</a>)</li>
<li>release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li>fix(langgraph): don't walk history for a DeltaChannel that was never
written (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9141 ">#9141</a>)</li>
<li>fix(langgraph): don't replay an abandoned branch into a DeltaChannel
fork (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8548 ">#8548</a>)</li>
<li>chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9168 ">#9168</a>)</li>
<li>fix(langgraph): hydrate subgraph delta channels with the
caller-resolved saver (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8538 ">#8538</a>)</li>
<li>fix(langgraph): stop reporting answered interrupts in get_state (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9103 ">#9103</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group across 1 directory
with 5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9155 ">#9155</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-conformance with 2 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9145 ">#9145</a>)</li>
<li>chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5
updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9149 ">#9149</a>)</li>
<li>chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9160 ">#9160</a>)</li>
<li>chore(deps-dev): bump types-requests from 2.33.0.20260712 to
2.33.0.20260906 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9156 ">#9156</a>)</li>
<li>chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9140 ">#9140</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9138 ">#9138</a>)</li>
<li>chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9139 ">#9139</a>)</li>
<li>chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9126 ">#9126</a>)</li>
</ul>
<h2>langgraph==1.2.12</h2>
<p>Changes since 1.2.11</p>
<ul>
<li>release(langgraph): 1.2.12 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8987 ">#8987</a>)</li>
<li>chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8958 ">#8958</a>)</li>
<li>feat(langgraph): add response_schema to interrupt() (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8886 ">#8886</a>)</li>
<li>fix(langgraph): type undeclared v3 stream projections (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8596 ">#8596</a>)</li>
<li>chore(langgraph): bump mistune to 3.3.4 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8804 ">#8804</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8779 ">#8779</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
4 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8782 ">#8782</a>)</li>
<li>chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8792 ">#8792</a>)</li>
<li>chore(deps): bump the major group in /libs/langgraph with 2 updates
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8783 ">#8783</a>)</li>
<li>fix(langgraph): detect subgraphs from bytecode instead of source (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8569 ">#8569</a>)</li>
</ul>
<h2>langgraph==1.2.11</h2>
<p>Changes since 1.2.10</p>
<ul>
<li>release(langgraph): 1.2.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8595 ">#8595</a>)</li>
<li>feat(langgraph): expose <code>trace_policy</code> on
<code>add_node</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8523 ">#8523</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8533 ">#8533</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8532 ">#8532</a>)</li>
<li>release(checkpoint-postgres): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8565 ">#8565</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/70dd64065bffaa3b6ab61a33f1f020fb54db8efa "><code>70dd640</code></a>
release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/55b0e36c51d2922b11640b980fcfca1064243a96 "><code>55b0e36</code></a>
release(sdk-py): 0.4.6 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9214 ">#9214</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e "><code>d89c7e1</code></a>
fix(sdk-py): percent-encode thread_id and assistant_id in thread stream
reque...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/2d942085e214ef6b99b6f54ed4d544a7c7c5ac56 "><code>2d94208</code></a>
fix(langgraph): fork before replaying an update checkpoint the thread
moved p...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/456e2b1acc67c8c6c13bbc0e0ca8ba7e11503d17 "><code>456e2b1</code></a>
fix(langgraph): keep an update_state on an older checkpoint out of its
other ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1b84cb08733a2a0a102ed19845bf20511dcc6535 "><code>1b84cb0</code></a>
fix(langgraph): keep DeltaChannel counters on every update_state path
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9142 ">#9142</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/8e15e0d0bcffa6d3d5a776206e6e8163a3595463 "><code>8e15e0d</code></a>
release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/524b320e30a31d2660ee1a7e9b312882fe4a6c08 "><code>524b320</code></a>
fix(langgraph): don't walk history for a DeltaChannel that was never
written ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/9a0394d88b2211f299dcd69df92db3480c69ee61 "><code>9a0394d</code></a>
fix(langgraph): don't replay an abandoned branch into a DeltaChannel
fork (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8 ">#8</a>...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/7dc9195e4141c8fbd8118581b3dd61d158628aa8 "><code>7dc9195</code></a>
chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9168 ">#9168</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/1.2.3...1.2.14 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 20:33:29 -08:00
dependabot[bot]
d5b927ae4c
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 9 updates ( #9528 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.13` | `1.3.1` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.18` | `1.5.3` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.70.1` | `8.72.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.70.1` | `8.72.1` |
| [dotenv](https://github.com/motdotla/dotenv ) | `18.0.4` | `18.0.9` |
| [eslint](https://github.com/eslint/eslint ) | `10.11.0` | `10.13.0` |
|
[eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier )
| `5.5.6` | `5.5.7` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.9` | `3.9.10`
|
| [ts-jest](https://github.com/kulshekhar/ts-jest ) | `29.4.14` |
`29.4.15` |
Updates `@langchain/core` from 1.2.13 to 1.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12026 ">#12026</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- fix(core): deliver callbacks once to a handler registered twice by
merged configs</p>
<p>Merging two runnable configs that both carry the same callback
handler, as happens when an agent's <code>streamEvents()</code> runs
inside a LangGraph node with tracing on, registered that handler twice,
so it received every callback twice: every streamed chunk arrived twice.
The configured callback manager now keeps each handler once, in order,
including a handler passed as a plain object of methods that merged
configs wrapped twice.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12042 ">#12042</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): include node <code>metadata</code> in
<code>Graph.toJSON()</code> output when set, matching Python</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12048 ">#12048</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): escape <code>drawMermaid</code> node metadata labels and
leave out object values, so metadata with brackets or objects no longer
breaks Mermaid parsing</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11986 ">#11986</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2caf64da3f02730f3cd2aab0c15de6eab41a01da "><code>2caf64d</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat: stream tool-call args as <code>tool-call-delta</code> slices</p>
<p>Tool-call and server-tool-call args now stream as
<code>tool-call-delta</code> events, which carry only the new slice of
the args, instead of <code>block-delta</code> snapshots of the args so
far. A large tool call now costs about the same bytes on the wire as the
same length of text.</p>
<ul>
<li>This covers the compat bridge (any model that only implements
<code>_streamResponseChunks</code>), the OpenAI-compatible converter
(OpenAI Completions, Groq, Mistral, IBM, OpenRouter, Perplexity,
DeepSeek, Fireworks, Together AI and xAI Completions), OpenAI and xAI
Responses, Anthropic (client and server tool calls) and Bedrock
Converse. Google and Ollama still send one complete snapshot per
call.</li>
<li>A tool call's <code>id</code>, <code>name</code> and
<code>index</code> go on <code>content-block-start</code>, which carries
no args. An <code>id</code> or <code>name</code> that arrives later
reaches consumers on <code>content-block-finish</code>.</li>
<li>If you read raw events and their <code>block-delta</code>
<code>fields.args</code> mid-stream, or write agent stream transformers
that do, read <code>tool-call-delta</code> instead. <code>await
stream</code>, <code>.toolCalls</code> and the assembled message are
unchanged.</li>
<li>Upgrade your clients first. Older clients mishandle
<code>tool-call-delta</code>. You need
<code>@langchain/langgraph-sdk</code> 1.12.6 or later;
<code>@langchain/react</code>, <code>@langchain/vue</code>,
<code>@langchain/svelte</code> or <code>@langchain/angular</code> 1.2.6
or later; and <code>langchain-core</code> 1.6.13 or later for Python
clients.</li>
<li>To hold back, pin <code>@langchain/core</code> below 1.3.0. That
also keeps you on <code>@langchain/openai</code>,
<code>@langchain/anthropic</code>, <code>@langchain/aws</code> and
<code>@langchain/xai</code> versions that send snapshots.</li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.20</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11922 ">#11922</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d71c542fb1d9cd1ceb310a4759591c024cf0d57d "><code>d71c542</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): add <code>midConversationSystemMessages</code> and
<code>midConversationTools</code> to <code>ModelProfile</code>. They say
whether a chat model sends a system message after the first turn in
place, and whether it can add a tool through a message rather than the
request's tool list. Either way the prompt prefix before it stays
unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11982 ">#11982</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5af4684bd19a16bb59950801da92245733482fb3 "><code>5af4684</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): read <code>tool-call-delta</code> in
<code>ChatModelStream</code></p>
<ul>
<li><code>ChatModelStream</code> appends <code>tool-call-delta</code>
slices to a tool call's args, and still replaces them on
<code>block-delta</code></li>
<li>It ignores delta types it doesn't recognize instead of throwing
<code>Unknown delta type</code></li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11956 ">#11956</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/93d62b008e13e10f28724a5ab09ab6eda584f1cb "><code>93d62b0</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Require langsmith >=0.11.0 to include the restored NullableHeaders
type declarations.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11822 ">#11822</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e6fe66a5f902fa615f076ca71d9541f1291166 "><code>d3e6fe6</code></a>
Thanks <a href="https://github.com/dqbd "><code>@dqbd</code></a>! - Add
explicit agent address support to <code>LangChainTracer</code>, inherit
project and address destinations together, and delegate default
destination resolution to the LangSmith SDK.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11150 ">#11150</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/cea15cf9ef5216125b24f23bb5ad06b7c1a91b33 "><code>cea15cf</code></a>
Thanks <a
href="https://github.com/mdnanocom "><code>@mdnanocom</code></a>! -
fix(core): defer tool call chunk collapsing in AIMessageChunk to fix
O(n²) streaming aggregation</p>
<p><code>AIMessageChunk</code> eagerly re-ran
<code>collapseToolCallChunks</code> in its constructor on every streamed
delta <code>concat</code>, re-parsing all accumulated tool args each
time — O(n²) over a stream, which can block the event loop for seconds
on long tool-call streams. Collapsing now runs lazily, once, on first
read of <code>tool_calls</code> / <code>invalid_tool_calls</code>.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.17</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e8c5dc82ba52cff3bc08cd71f963a69596d7ea4d "><code>e8c5dc8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12047 ">#12047</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/b5135cc189adbf313f4e92c1527f96a40a546977 "><code>b5135cc</code></a>
feat(openai,langchain): support Decisions API and agent middleware (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11930 ">#11930</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/52d2ba8ea50149f2314df63b79582f8508034a3b "><code>52d2ba8</code></a>
fix(aws): use this.caller in ChatBedrockConverse to support retries (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11463 ">#11463</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
fix(core): deliver callbacks once to a handler registered twice by
merged con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
fix(core): make drawMermaid node metadata labels safe (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12048 ">#12048</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
fix(core): include node metadata in Graph.toJSON() (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12042 ">#12042</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d1d0692d8498d7e1521c854d90af0395535df4d8 "><code>d1d0692</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12044 ">#12044</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/95b191b1928ee8f4e20e51aa821f5c5fd4b8b3da "><code>95b191b</code></a>
feat(openai): refresh model profiles from models.dev (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12046 ">#12046</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/81577b3e84c3f38581e76e8335faa89511e99d74 "><code>81577b3</code></a>
fix(langchain): re-throw a drained tool from the agent's ToolNode (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12043 ">#12043</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4cbf0f5938710ce1669c679febdbea41b733a100 "><code>4cbf0f5</code></a>
chore(deps): bump the npm_and_yarn group across 2 directories with 1
update (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.13...@langchain/core@1.3.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.18 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://github.com/soarez "><code>@soarez</code></a>! -
order parallel writes by task path, like langgraph (Python) — one sort
key for live execution and every saver, instead of the task-id order <a
href="https://redirect.github.com/langchain-ai/langgraphjs/issues/2544 ">#2544</a>
added for DeltaChannel writes</p>
<p>When two or more tasks in one superstep write the same
<code>DeltaChannel</code>, their writes are now applied and replayed in
<code>(task_path, task_id, idx)</code> order — the order Python's
langgraph#8544 established — instead of task-id order. Task ids are
uuid5 hashes that include the checkpoint id, so the old order permuted
parallel writers from run to run and disagreed with Python.</p>
<ul>
<li><code>BaseCheckpointSaver.putWrites</code> takes an optional
<code>taskPath</code> (the serialized task path,
<code>taskPathStr</code>), and <code>getTuple</code>/<code>list</code>
must return <code>pendingWrites</code> in the new
<code>writesSortKey</code> order. <code>writesSortKey</code> and
<code>compareWritesSortKeys</code> are new exports of
<code>@langchain/langgraph-checkpoint</code>; every saver (memory,
SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the
path and sorts in JS — no database collation is involved.</li>
<li>SQLite and Postgres gain a <code>task_path</code> column (migrated
automatically on <code>setup()</code>; read-only pre-column SQLite
databases keep reading, with their rows keeping the old order). Redis
and MongoDB documents gain a <code>task_path</code> field. Rows written
before the upgrade keep their old order.</li>
<li>Exit-durability resumes replay delta writes in live order (port of
langgraph#9114): the resumed superstep's writes interleave with the
loaded ones by task path, later supersteps sort after every real write,
and writes loaded with the checkpoint are no longer stored twice.</li>
<li><code>bulkUpdateState</code> seals the first update superstep:
DeltaChannels touched by the base checkpoint's pending writes (and whose
version moved) snapshot on the update checkpoint, so a finished
sibling's writes and the update's can't replay in the wrong order
(partial port of langgraph#8548).</li>
<li><code>bulkUpdateState</code>/<code>updateState</code> update tasks
carry <code>(__interrupt__, i)</code> task paths, as in langgraph#9128,
so several updates in one superstep writing the same DeltaChannel replay
in the order given.</li>
<li>Send task paths become <code>[PUSH, i, false]</code> and
node-error-handler paths become <code>[*failedTask.path[:3],
"node_error_handler", false]</code> (the failed task's first
three path elements), matching Python's shapes —
<code>langgraph_path</code> task metadata changes accordingly, and task
ids of functional <code>task()</code> calls under a Send or handler task
change with them. The SDK's Send-task detection accepts both the old and
new shapes.</li>
</ul>
<p>Upgrade notes:</p>
<ul>
<li><code>PostgresSaver</code>: run <code>setup()</code> once after
upgrading, from one process, before the new version serves traffic. The
<code>task_path</code> column comes from the first new migration since
the saver shipped, and until it runs, reads and writes fail with
<code>column "task_path" does not exist</code>. Several
processes running <code>setup()</code> at once on a database that still
needs the migration can fail with a duplicate key error on
<code>checkpoint_migrations</code>.</li>
<li>Third-party checkpoint savers remain source-compatible but must now
persist the <code>taskPath</code> they are given and return
<code>pendingWrites</code> in <code>writesSortKey</code> order; the
conformance suite's new base tests enforce this. A saver that ignores
the new argument replays in task-id order and can rebuild a different
DeltaChannel value than the run produced.</li>
<li>An incomplete superstep containing stored delta writes that must
interleave with resumed or retried task writes is affected by the
upgrade, whether the incompleteness came from an interrupt, a task
error, a crash, or a drain: finish such threads with the old runtime
before upgrading writers. A single interrupted node with no finished
delta-writing siblings is safe to resume. The same applies to resuming
work that includes functional <code>task()</code> calls under a Send or
error-handler task, whose child task ids change.</li>
<li><code>@langchain/langgraph-checkpoint</code> 1.2.0 must be released
before any package requiring its new exports; the consumers' minimum
ranges are raised accordingly.</li>
</ul>
</li>
<li>
<p>Updated dependencies []:</p>
<ul>
<li><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-cli</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>]:
<ul>
<li><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<p>No changes in this release.</p>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3125 ">#3125</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Change the default <code>DeltaChannel</code> snapshot frequency from
1000 to 100 updates, matching Python. Channels now persist full
snapshots more frequently to reduce replay latency at the cost of
increased storage. Set <code>snapshotFrequency: 1000</code> explicitly
to retain the previous cadence.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f3dfbb2c3f6c4ff5d30aceca027ab19fca021bde "><code>f3dfbb2</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.8</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-cli</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2887 ">#2887</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/8f8eaa8686dab8ba9d35eac9934c590ecbbe11f6 "><code>8f8eaa8</code></a>
Thanks <a
href="https://github.com/syachamaneni-lc "><code>@syachamaneni-lc</code></a>!
- add --agent-id and --agent-environment flags</li>
<li>Updated dependencies []:</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3125 ">#3125</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Change the default <code>DeltaChannel</code> snapshot frequency from
1000 to 100 updates, matching Python. Channels now persist full
snapshots more frequently to reduce replay latency at the cost of
increased storage. Set <code>snapshotFrequency: 1000</code> explicitly
to retain the previous cadence.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f3dfbb2c3f6c4ff5d30aceca027ab19fca021bde "><code>f3dfbb2</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.8</li>
</ul>
</li>
</ul>
<h2>1.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3022 ">#3022</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- Depend on <code>@langchain/protocol</code> 0.0.20, the version
<code>@langchain/langgraph-sdk</code> uses, so installs resolve a single
copy and the protocol event types stay compatible.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/6e845706b9a7d12f85e9477722908cc9f7003521 "><code>6e84570</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>]:
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.2.1</li>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.6</li>
</ul>
</li>
</ul>
<h2>1.5.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3017 ">#3017</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/61b00495dd13da035d6c92a68f3294f60ca54bd7 "><code>61b0049</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- A field that changes from a DeltaChannel to a plain reducer, for
example to <code>MessagesAnnotation</code>, keeps its value on threads
written under the DeltaChannel: reads rebuild it from the stored writes
instead of returning the empty default, and the next run adds to it
instead of replacing it.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3027 ">#3027</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/af7e421cd35766296cef05d9cdc50b12a794fbeb "><code>af7e421</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- With <code>durability: "exit"</code>, resuming parallel
interrupts one at a time no longer applies a finished task's output
twice: the save at exit keeps only the writes made during that run,
instead of storing the ones loaded with the checkpoint again under new
indexes.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2986 ">#2986</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/53cc6274ee6cdb0ad7cfbbc3cc53e6f6b1af4410 "><code>53cc627</code></a>
Thanks <a href="https://github.com/byhow "><code>@byhow</code></a>! -
When one answer in a multi-answer resume fails its interrupt's
<code>responseSchema</code>, the other tasks in the step now finish
before the <code>ZodError</code> is thrown, instead of being aborted. A
task aborted after its side effects kept its answer and ran again on the
next resume. The error is unchanged, and the new
<code>isInvalidResume(error)</code> tells it apart from other errors, as
<code>is_invalid_resume</code> does in langgraph (Python).</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3038 ">#3038</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/bc010237d9904bedf411c965d14343222e300d74 "><code>bc01023</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- <code>messagesStateReducer</code> and
<code>messagesDeltaReducer</code> store message chunks as their
non-chunk class, as Python's <code>add_messages</code> does. A graph run
with <code>streamMode: "messages"</code> or
<code>streamEvents</code> now checkpoints the same
<code>AIMessage</code> as <code>invoke</code>, without a duplicate
<code>tool_call_chunks</code> copy of every tool call, and an in-place
edit to <code>tool_calls</code> (for example a rejected call in
<code>humanInTheLoopMiddleware</code>) is no longer undone when the
thread is reloaded.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3028 ">#3028</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/ec1854a53bc5c6d88f3922a80085ca05678d4532 "><code>ec1854a</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Resuming after some parallel interrupts were answered no longer reruns
the nodes and <code>task()</code> calls that already finished, in a
subgraph or when the resume is sent with the id of the thread's latest
checkpoint. Finished tasks now rerun only on time travel, or on a resume
at a checkpoint the thread has moved past.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/2e1fe5b3fffd87b2f7ba260da3726a2c03c2f72f "><code>2e1fe5b</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/0acf88db9fdc6441c8b3a162b7a328b9b91e115e "><code>0acf88d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/9cc54cce575ae00deb0bb5946aa457f44f485427 "><code>9cc54cc</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4690a5b9a59f4f96790fdce45160f744272ca054 "><code>4690a5b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.5</li>
</ul>
</li>
</ul>
<h2>1.5.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://github.com/soarez "><code>@soarez</code></a>! -
order parallel writes by task path, like langgraph (Python) — one sort
key for live execution and every saver, instead of the task-id order <a
href="https://redirect.github.com/langchain-ai/langgraphjs/issues/2544 ">#2544</a>
added for DeltaChannel writes</p>
<p>When two or more tasks in one superstep write the same
<code>DeltaChannel</code>, their writes are now applied and replayed in
<code>(task_path, task_id, idx)</code> order — the order Python's
langgraph#8544 established — instead of task-id order. Task ids are
uuid5 hashes that include the checkpoint id, so the old order permuted
parallel writers from run to run and disagreed with Python.</p>
<ul>
<li><code>BaseCheckpointSaver.putWrites</code> takes an optional
<code>taskPath</code> (the serialized task path,
<code>taskPathStr</code>), and <code>getTuple</code>/<code>list</code>
must return <code>pendingWrites</code> in the new
<code>writesSortKey</code> order. <code>writesSortKey</code> and
<code>compareWritesSortKeys</code> are new exports of
<code>@langchain/langgraph-checkpoint</code>; every saver (memory,
SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the
path and sorts in JS — no database collation is involved.</li>
<li>SQLite and Postgres gain a <code>task_path</code> column (migrated
automatically on <code>setup()</code>; read-only pre-column SQLite
databases keep reading, with their rows keeping the old order). Redis
and MongoDB documents gain a <code>task_path</code> field. Rows written
before the upgrade keep their old order.</li>
<li>Exit-durability resumes replay delta writes in live order (port of
langgraph#9114): the resumed superstep's writes interleave with the
loaded ones by task path, later supersteps sort after every real write,
and writes loaded with the checkpoint are no longer stored twice.</li>
<li><code>bulkUpdateState</code> seals the first update superstep:
DeltaChannels touched by the base checkpoint's pending writes (and whose
version moved) snapshot on the update checkpoint, so a finished
sibling's writes and the update's can't replay in the wrong order
(partial port of langgraph#8548).</li>
<li><code>bulkUpdateState</code>/<code>updateState</code> update tasks
carry <code>(__interrupt__, i)</code> task paths, as in langgraph#9128,
so several updates in one superstep writing the same DeltaChannel replay
in the order given.</li>
<li>Send task paths become <code>[PUSH, i, false]</code> and
node-error-handler paths become <code>[*failedTask.path[:3],
"node_error_handler", false]</code> (the failed task's first
three path elements), matching Python's shapes —
<code>langgraph_path</code> task metadata changes accordingly, and task
ids of functional <code>task()</code> calls under a Send or handler task
change with them. The SDK's Send-task detection accepts both the old and
new shapes.</li>
</ul>
<p>Upgrade notes:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/b09eb0662358457955131fe0bfec1d7c11e7d7c5 "><code>b09eb06</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3117 ">#3117</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
fix(langgraph): default delta snapshots to 100 updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3125 ">#3125</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/10e72bc10a7f1f98b4e115e0617ae7bc8162718d "><code>10e72bc</code></a>
chore(deps): bump vite, vitest, and launch-editor security fixes (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3091 ">#3091</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/0c12d5c429c97dc69d6f72cceb269a4dc920f9a5 "><code>0c12d5c</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3059 ">#3059</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>
feat(sdk): read <code>tool-call-delta</code> and ignore unknown delta
variants (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3022 ">#3022</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cc29753d529caa5eed97a65e765ba26c0f88c631 "><code>cc29753</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3018 ">#3018</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/53cc6274ee6cdb0ad7cfbbc3cc53e6f6b1af4410 "><code>53cc627</code></a>
fix(langgraph): let other tasks finish when a resume value is invalid
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2986 ">#2986</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec1854a53bc5c6d88f3922a80085ca05678d4532 "><code>ec1854a</code></a>
fix(langgraph): stop a subgraph from rerunning its finished tasks on
resume (...</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/af7e421cd35766296cef05d9cdc50b12a794fbeb "><code>af7e421</code></a>
fix(langgraph): save a resumed exit run's pending writes once (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3027 ">#3027</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/bc010237d9904bedf411c965d14343222e300d74 "><code>bc01023</code></a>
fix(langgraph): store message chunks as messages in the messages
reducers (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3 ">#3</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.5.3/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-optional-chain] safe fix
when the chain ends with a strict null comparison (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12805 ">#12805</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
parenthesize constraint in optional tuple elements (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12995 ">#12995</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unused-vars] ignore type-only
refs for after-used (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12977 ">#12977</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1166ba20e9e484167ebfe216fdb38e605e3f7598 "><code>1166ba2</code></a>
chore(type-utils): detect methods in isTypeReadonly without reading the
inter...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2f0343a694bee1ba9815e4a0f946295452deb082 "><code>2f0343a</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] bound recursive type
trav...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c49d287f046c794133b12fa94207e5ee3b846ddd "><code>c49d287</code></a>
chore: [ci] test on oldest supported TS version (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13024 ">#13024</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/594fe286ec518c6899a9b89141cf3220bcfb9f72 "><code>594fe28</code></a>
fix(eslint-plugin): [no-unnecessary-condition] false positives on
unresolved ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c6eb98c17cbeee540d3c48d1406098430b2f0660 "><code>c6eb98c</code></a>
feat(eslint-plugin): [await-thenable] add
<code>allowMixedPromiseArrays</code> option (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b382b74579e5514c247ed54d0dfc428f3a173f3a "><code>b382b74</code></a>
fix(type-utils): discriminateAnyType crashes when calling getAwaitedType
on a...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79edd896790b031457fc0ca6f81c732b29921c9d "><code>79edd89</code></a>
fix(eslint-plugin): [require-array-sort-compare] ignore extra this type
argum...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.1 (2026-10-05)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.0 (2026-09-28)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7488d681f6e0e96c2aaa1eee9c3d1b9b1ef077cb "><code>7488d68</code></a>
chore(release): publish 8.71.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d57b8da272375b6a45270639894a793933208a91 "><code>d57b8da</code></a>
chore(release): publish 8.71.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8695664c5ee3fbb8fd76907fc45e148579cc3162 "><code>8695664</code></a>
chore(release): publish 8.71.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `dotenv` from 18.0.4 to 18.0.9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md ">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.8...v18.0.9 ">18.0.9</a>
(2026-10-14)</h2>
<h3>Changed</h3>
<ul>
<li>Permit DOTENV_PATH being empty string with the CLI (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1076 ">#1076</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.7...v18.0.8 ">18.0.8</a>
(2026-10-14)</h2>
<h3>Changed</h3>
<ul>
<li>Fast parser should strip appended extra quotes (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1073 ">#1073</a>)</li>
<li>Type detail improvement (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1074 ">#1074</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.6...v18.0.7 ">18.0.7</a>
(2026-10-09)</h2>
<h3>Changed</h3>
<ul>
<li>Treat undefined settings like <code>quiet: true</code> as null
rather than falsey (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1070 ">#1070</a>)</li>
<li>CLI should honor <code>DOTENV_QUIET</code> setting in
<code>.env</code> file (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1071 ">#1071</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.5...v18.0.6 ">18.0.6</a>
(2026-10-06)</h2>
<h3>Changed</h3>
<ul>
<li>Use smarter <code>parseBoolean</code> not Boolean() to fix override
(<a
href="https://redirect.github.com/motdotla/dotenv/pull/1069 ">#1069</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.4...v18.0.5 ">18.0.5</a>
(2026-09-30)</h2>
<h3>Changed</h3>
<ul>
<li>Fix missing typescript module declaration (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1068 ">#1068</a>)</li>
<li>Improve performance for large .env files (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1066 ">#1066</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/8d1ab850aa628781929f08bfd0d71ba1d1bf0a23 "><code>8d1ab85</code></a>
18.0.9</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/59a40ce5876a661d3964cc0269208267174ea39b "><code>59a40ce</code></a>
changelog</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/88228bd02b9ce98a79442ddcd619e4c31199474c "><code>88228bd</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1076 ">#1076</a>
from Enesuygurs/fix/cli-empty-dotenv-path</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/bc6ef941200c2015ffcc17d40c4f8f76ffe24026 "><code>bc6ef94</code></a>
fix(cli): load the default .env when DOTENV_PATH is empty</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/6d6e6c58074adc12131ec6ab6eac92fb92484dbc "><code>6d6e6c5</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1075 ">#1075</a>
from kory-kaai/test/fast-parser-branch-coverage</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/10218f1b0fa1f83f0714dc3c8133d0daa54752ff "><code>10218f1</code></a>
test(parse-fast): cover the size-dependent and export-prefix
branches</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/e2fe95e8e952e881787d8207b654c80326f821d8 "><code>e2fe95e</code></a>
18.0.8</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/7aa712ab2914c0cf128ea8ccdaf5e918a867db59 "><code>7aa712a</code></a>
type detail improvement</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/53405b0b140debc002e41c5abb671d5da5f3e8f9 "><code>53405b0</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1074 ">#1074</a>
from himanshu748/codex/fix-dotenv-populate-undefined...</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/0b4843a90d6d70b110d1f1a309f209c3d8d7cb6e "><code>0b4843a</code></a>
changelog</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v18.0.4...v18.0.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.11.0 to 10.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.13.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)
(Irfan fandi)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e "><code>66ac583</code></a>
feat: check <code>yield*</code> expressions in
<code>no-unsafe-optional-chaining</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21399 ">#21399</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3 "><code>87bd2ce</code></a>
fix: avoid redeclared <code>let</code> when <code>no-var</code> and
<code>one-var</code> fix together (<a
href="https://redirect.github.com/eslint/eslint/issues/21389 ">#21389</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)
(lumir)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24 "><code>47b7063</code></a>
chore: update dependency <code>@eslint/json</code> to ^2.1.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21398 ">#21398</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6 "><code>e5aea41</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21390 ">#21390</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.12.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5 "><code>4618052</code></a>
feat: handle astral letters in <code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21357 ">#21357</a>)
(sary)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa "><code>4ec5168</code></a>
feat: allow <code>SourceCode#getText()</code> to accept tokens and
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21340 ">#21340</a>)
(electrohyun)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7 "><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373 ">#21373</a>)
(Daniel Pinto)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038 "><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332 ">#21332</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a "><code>efc4d6b</code></a>
fix: astral letters in <code>consistent-return</code>,
<code>no-eval</code>, <code>no-invalid-this</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21360 ">#21360</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba "><code>93de066</code></a>
fix: prefer-exponentiation-operator autofix for async function base (<a
href="https://redirect.github.com/eslint/eslint/issues/21322 ">#21322</a>)
(Vladimir Babin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5 "><code>02e34ff</code></a>
fix: add missing space after <code>else</code> in <code>curly</code>
autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21355 ">#21355</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160 "><code>b14b8bc</code></a>
fix: correct <code>id-length</code> message for long private names (<a
href="https://redirect.github.com/eslint/eslint/issues/21348 ">#21348</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8 "><code>69aac01</code></a>
fix: support <code>TSFunctionType</code> in
<code>getFunctionHeadLoc</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21335 ">#21335</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532 "><code>686630e</code></a>
fix: <code>no-loss-of-precision</code> false positive with
<code>0.e5</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21337 ">#21337</a>)
(sethamus)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f "><code>67eb586</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21 "><code>5370d7e</code></a>
docs: clarify <code>one-var</code> <code>separateRequires</code> matches
any <code>require()</code> call (<a
href="https://redirect.github.com/eslint/eslint/issues/21192 ">#21192</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f "><code>8816c1d</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e "><code>3d2e7ce</code></a>
docs: fix typo in no-unused-expressions documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21346 ">#21346</a>)
(bytedoe)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6 "><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362 ">#21362</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e "><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376 ">#21376</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177 "><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364 ">#21364</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc8 ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:52 -08:00
dependabot[bot]
937d4027bf
chore(deps): bump the minor-and-patch group with 6 updates ( #9522 )
...
Bumps the minor-and-patch group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [docker/login-action](https://github.com/docker/login-action ) |
`4.6.0` | `4.7.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact )
| `7.0.1` | `7.0.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact )
| `8.0.1` | `8.0.2` |
|
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish )
| `1.14.2` | `1.14.3` |
| [actions/setup-python](https://github.com/actions/setup-python ) |
`7.0.0` | `7.1.0` |
|
[actions/create-github-app-token](https://github.com/actions/create-github-app-token )
| `3.2.0` | `3.3.0` |
Updates `docker/login-action` from 4.6.0 to 4.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.0</h2>
<ul>
<li>Preserve explicit ECR settings in <code>registry-auth</code> by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1089 ">docker/login-action#1089</a></li>
<li>Use registry hosts for scoped credentials by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1088 ">docker/login-action#1088</a></li>
<li>Raise Docker Hub OIDC max expiry to 6 hours by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1068 ">docker/login-action#1068</a></li>
<li>Log Docker Hub OIDC token exchange progress by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1061 ">docker/login-action#1061</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1154.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1093 ">docker/login-action#1093</a></li>
<li>Bump <code>@docker/actions-toolkit</code> from 0.94.0 to 0.107.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1100 ">docker/login-action#1100</a></li>
<li>Bump <code>@humanfs/node</code> from 0.16.7 to 0.16.8 in <a
href="https://redirect.github.com/docker/login-action/pull/1077 ">docker/login-action#1077</a></li>
<li>Bump csv-parse from 7.0.1 to 7.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1078 ">docker/login-action#1078</a></li>
<li>Bump handlebars from 4.7.9 to 4.7.10 in <a
href="https://redirect.github.com/docker/login-action/pull/1091 ">docker/login-action#1091</a></li>
<li>Bump js-yaml from 5.2.2 to 5.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1066 ">docker/login-action#1066</a></li>
<li>Bump postcss from 8.5.22 to 8.5.26 in <a
href="https://redirect.github.com/docker/login-action/pull/1071 ">docker/login-action#1071</a></li>
<li>Bump postcss-selector-parser from 7.1.1 to 7.1.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1092 ">docker/login-action#1092</a></li>
<li>Bump source-map-js from 1.2.1 to 1.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1090 ">docker/login-action#1090</a></li>
<li>Bump undici from 6.27.0 to 6.29.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1085 ">docker/login-action#1085</a></li>
<li>Bump uuid from 14.0.1 to 14.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1096 ">docker/login-action#1096</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.6.0...v4.7.0 ">https://github.com/docker/login-action/compare/v4.6.0...v4.7.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/81c6f93d4bc991e510b342a00b419b3bb4efc5c6 "><code>81c6f93</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1100 ">#1100</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b16c8d1815e1d951d87a3522ff48a76d073735a "><code>1b16c8d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1096 ">#1096</a>
from docker/dependabot/npm_and_yarn/uuid-14.0.3</li>
<li><a
href="https://github.com/docker/login-action/commit/ac86b5e9e9d2db43b12b2d3afb9140a427d69d65 "><code>ac86b5e</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/1476d845f08dd8309a938959a280f2e23c0cba14 "><code>1476d84</code></a>
build(deps): bump <code>@docker/actions-toolkit</code> from 0.94.0 to
0.107.0</li>
<li><a
href="https://github.com/docker/login-action/commit/503cee68d85e94275776fcc6f5315f19207f7567 "><code>503cee6</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1095 ">#1095</a>
from docker/dependabot/github_actions/actions/create...</li>
<li><a
href="https://github.com/docker/login-action/commit/f0935357f5c539aeb7ff6b886ba5434ab76e9de3 "><code>f093535</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1099 ">#1099</a>
from docker/dependabot/github_actions/codecov/codeco...</li>
<li><a
href="https://github.com/docker/login-action/commit/d5ae7f188776587b12b77b45e29ea21332462da9 "><code>d5ae7f1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1098 ">#1098</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/6f9750797f6e7186f18c069a7e97abc1dcf1006b "><code>6f97507</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1097 ">#1097</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/006d61fa598847d65f6670d1569545fa2af9cf02 "><code>006d61f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1094 ">#1094</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/93f5f522eea5eacabf35cc89b9d19ec23e742471 "><code>93f5f52</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1093 ">#1093</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases ">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Updates <code>@actions/artifact</code> to v6.3.1.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d "><code>@tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/821 ">actions/upload-artifact#821</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2 ">https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9 "><code>cf430e0</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/822 ">#822</a>
from actions/tunc-d-prepare-upload-v7-0-2</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469 "><code>c2acded</code></a>
chore: prepare v7.0.2 release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a "><code>4687c1b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/821 ">#821</a>
from actions/tunc-d-upload-artifact-package-bump</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719 "><code>8cbe1be</code></a>
Bump <code>@actions/artifact</code> to 6.3.1</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/download-artifact` from 8.0.1 to 8.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases ">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme by <a
href="https://github.com/danwkennedy "><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/473 ">actions/download-artifact#473</a></li>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Update <code>@actions/artifact</code> to 6.3.1 by <a
href="https://github.com/tunc-d "><code>@tunc-d</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/492 ">actions/download-artifact#492</a></li>
<li>Prepare download-artifact v8.0.2 by <a
href="https://github.com/tunc-d "><code>@tunc-d</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/493 ">actions/download-artifact#493</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d "><code>@tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/492 ">actions/download-artifact#492</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2 ">https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333 "><code>9000827</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/493 ">#493</a>
from actions/tunc-d-prepare-download-v8-0-2</li>
<li><a
href="https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5 "><code>e455989</code></a>
Prepare download-artifact v8.0.2</li>
<li><a
href="https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137 "><code>a00b90c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/492 ">#492</a>
from actions/tunc-d-download-artifact-package-bump</li>
<li><a
href="https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f "><code>29bb7ce</code></a>
Update <code>@actions/artifact</code> to 6.3.1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317 "><code>484a0b5</code></a>
Update the readme (<a
href="https://redirect.github.com/actions/download-artifact/issues/473 ">#473</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/gh-action-pypi-publish/releases ">pypa/gh-action-pypi-publish's
releases</a>.</em></p>
<blockquote>
<h2>v1.14.3</h2>
<!-- raw HTML omitted -->
<blockquote>
<p>[!important]
🚨 This release includes fixes for <a
href="https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9 ">GHSA-5xjx-3w67-w9x9</a>
patched up by <a
href="https://github.com/sethmlarson "><code>@sethmlarson</code></a><a
href="https://github.com/sponsors/sethmlarson ">💰 </a> in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427 ">#427</a>
and in other places across the ecosystem.</p>
<p>Additional ecosystem and related mitigations beyond you might want to
watch out for:</p>
<ul>
<li><a
href="https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 ">https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 </a></li>
<li><a
href="https://emudhra.we-have-a-problem.com ">https://emudhra.we-have-a-problem.com </a></li>
</ul>
</blockquote>
<h2>🛠️ Security Tightening</h2>
<p><a href="https://github.com/webknjaz "><code>@webknjaz</code></a><a
href="https://github.com/sponsors/webknjaz ">💰 </a> made sure the
dependency tree within the action runtime uses hash-checking from now on
via <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/420 ">pypa/gh-action-pypi-publish#420</a>.</p>
<p><strong>🪞 Full Diff</strong>: <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3 ">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3 </a></p>
<p><strong>🧔♂️ Release Manager:</strong> <a
href="https://github.com/sponsors/webknjaz "><code>@webknjaz</code></a>
<a href="https://stand-with-ukraine.pp.ua ">🇺🇦 </a></p>
<p><strong>💬 Discuss</strong> <a
href="https://bsky.app/profile/webknjaz.me/post/3mydcjweyak2f ">on
Bluesky 🦋 </a>, <a
href="https://mastodon.social/@webknjaz/117474743338290807 ">on Mastodon
🐘 </a> and <a
href="https://github.com/pypa/gh-action-pypi-publish/discussions/429 ">on
GitHub</a>.</p>
<p><a href="https://github.com/sponsors/webknjaz "><img
src="https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c "
alt="GH Sponsors badge" /></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/7245906fb61fa33a13554f9d5fb856fe61758086 "><code>7245906</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427 ">#427</a>
from sethmlarson/certifi-sigstore</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/331eccb0e13a5c1124ed9f414a079ef2bef1095f "><code>331eccb</code></a>
Upgrade certifi and sigstore</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/f68fee44f9faa979857cda34894b750df5f571ca "><code>f68fee4</code></a>
💰 Sync the FUNDING config</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/c0d6f8e4af2ad8247a7da213b199ea78dac8395e "><code>c0d6f8e</code></a>
Merge branch 'integrity/runtime/deptree' into unstable/v1</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/909009990f9cf7e7c6a64e602638cf9e91af47f8 "><code>9090099</code></a>
🧪 Make smoke test deps hash-pinned in CI</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/34e40c24acd7b4a9150956d646c8c7ba667a14f3 "><code>34e40c2</code></a>
📌 Bump pip-tools managed transitive deptrees</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/e800ed547ac29cbc9324311809e2f36fe82148f9 "><code>e800ed5</code></a>
👷 Enable hash-checking in the runtime deptree 🔗 </li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/dd8c5f4f1f65ddf01533969008446145facc7b02 "><code>dd8c5f4</code></a>
🔧 Make pip-tools config available in container</li>
<li>See full diff in <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/setup-python` from 7.0.0 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases ">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Add <code>mirror</code> and <code>mirror-token</code> inputs for
custom Python distribution sources by <a
href="https://github.com/luhenry "><code>@luhenry</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1302 ">actions/setup-python#1302</a></li>
<li>Improve error message clarity by <a
href="https://github.com/v-lmvysakh "><code>@v-lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1351 ">actions/setup-python#1351</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Upgrade browserslist from 4.28.2 to 4.28.9 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1353 ">actions/setup-python#1353</a></li>
<li>Upgrade <code>@typescript-eslint/parser</code> from 8.62.0 to
8.70.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1343 ">actions/setup-python#1343</a></li>
<li>Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1342 ">actions/setup-python#1342</a></li>
<li>Upgrade <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1357 ">actions/setup-python#1357</a></li>
<li>Upgrade <code>@types/semver</code> from 7.7.1 to 7.8.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1359 ">actions/setup-python#1359</a></li>
<li>Upgrade undici from 6.28.0 to 6.29.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1364 ">actions/setup-python#1364</a></li>
<li>Upgrade ts-jest from 29.4.11 to 29.4.14 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1361 ">actions/setup-python#1361</a></li>
<li>Upgrade brace-expansion from 5.0.9 to 5.0.12 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1365 ">actions/setup-python#1365</a></li>
<li>Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to
7.1.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1363 ">actions/setup-python#1363</a></li>
<li>Upgrade <code>@typescript-eslint/eslint-plugin</code> from 8.62.0
to 8.71.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1369 ">actions/setup-python#1369</a></li>
<li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1345 ">actions/setup-python#1345</a></li>
<li>Upgrade cache to 6.3.0 by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1370 ">actions/setup-python#1370</a></li>
<li>Resolve Basic Validation audit failures by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1347 ">actions/setup-python#1347</a></li>
<li>Resolve npm audit failures by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1350 ">actions/setup-python#1350</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/luhenry "><code>@luhenry</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1302 ">actions/setup-python#1302</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0 ">https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 "><code>6d4fd22</code></a>
Cache upgrade to 6.3.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1370 ">#1370</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ec52d0af729a7c50ced4261d17a07916f43f5b8e "><code>ec52d0a</code></a>
Bump <code>@typescript-eslint/eslint-plugin</code> from 8.62.0 to
8.71.1 (<a
href="https://redirect.github.com/actions/setup-python/issues/1369 ">#1369</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ff73b2463e2f3baa703f830da214b8dfeeaeccf8 "><code>ff73b24</code></a>
Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0
(<a
href="https://redirect.github.com/actions/setup-python/issues/1363 ">#1363</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0e40890053525508c059c61932a6b8614f9e95db "><code>0e40890</code></a>
Bump brace-expansion from 5.0.9 to 5.0.12 (<a
href="https://redirect.github.com/actions/setup-python/issues/1365 ">#1365</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/3892123fbe74688ccc83ec7c465dc688359e5199 "><code>3892123</code></a>
Bump ts-jest from 29.4.11 to 29.4.14 (<a
href="https://redirect.github.com/actions/setup-python/issues/1361 ">#1361</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/660965736c4aecc62797ea07d351a3c259f14660 "><code>6609657</code></a>
Bump undici from 6.28.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1364 ">#1364</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/e1be392b26fb1917a7b2c455817e4b4dad6544ce "><code>e1be392</code></a>
Bump <code>@types/semver</code> from 7.7.1 to 7.8.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1359 ">#1359</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/06da6279cdbca41027908073e81a4544dc79c06b "><code>06da627</code></a>
Bump <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1357 ">#1357</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/af9bcc7548695e66d75709de6f29e337624b8de8 "><code>af9bcc7</code></a>
Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (<a
href="https://redirect.github.com/actions/setup-python/issues/1342 ">#1342</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/7aeabeba5501120d873c50398519dbfd0657031c "><code>7aeabeb</code></a>
Bump <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1343 ">#1343</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/create-github-app-token/releases ">actions/create-github-app-token's
releases</a>.</em></p>
<blockquote>
<h2>v3.3.0</h2>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0 ">3.3.0</a>
(2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e ">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb ">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across
1 directory with 3 updates (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/395 ">#395</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 ">a69c19d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md ">actions/create-github-app-token's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0 ">3.3.0</a>
(2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e ">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb ">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across
1 directory with 3 updates (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/395 ">#395</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 ">a69c19d</a>)</li>
</ul>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0 ">3.2.0</a>
(2026-05-12)</h2>
<h3>Features</h3>
<ul>
<li>add support for enterprise-level GitHub Apps (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/263 ">#263</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4 ">952a2a7</a>)</li>
<li>support full repository names in <code>repositories</code> input (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/372 ">#372</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6 ">85eb8dd</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump <code>@actions/core</code> from 3.0.0
to 3.0.1 in the production-dependencies group (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/364 ">#364</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857 ">43e5c34</a>)</li>
<li>validate private-key input (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/376 ">#376</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd ">f24bbd8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/create-github-app-token/commit/64ab729a6294000f5aa4a4bc0b73d1f32bc45510 "><code>64ab729</code></a>
chore(main): release 3.3.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/402 ">#402</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/f3a828e4b91180d3a46ac1f4b43fa8384b0dea07 "><code>f3a828e</code></a>
ci: create signed dist commits in release workflow (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/404 ">#404</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/655017ffa7c6b0c6e4210729fa6bce35cacd8ca0 "><code>655017f</code></a>
docs: clarify when owner grants access to all repositories (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/378 ">#378</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb "><code>12461a3</code></a>
fix(deps): bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e "><code>a47236f</code></a>
feat: update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 "><code>a69c19d</code></a>
fix(deps): bump the production-dependencies group across 1 directory
with 3 u...</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/d5cb7ae41d64331820d88810a4878e0942ec992a "><code>d5cb7ae</code></a>
build(deps): bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/384 ">#384</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/575da866bd0a42d7f234a8645831d55573252b09 "><code>575da86</code></a>
build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to
7.2.0 in...</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/e85f677b44da0d1f08115ce52cdfd8fd2c69874a "><code>e85f677</code></a>
test: omit stack traces from snapshots (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/401 ">#401</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/9419396df4d5672241cfb593dadc19758e54a204 "><code>9419396</code></a>
build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/400 ">#400</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:44 -08:00
dependabot[bot]
50303e0ba1
chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example with 8 updates ( #9526 )
...
Bumps the minor-and-patch group in /libs/cli/js-monorepo-example with 8
updates:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo ) | `2.11.5` | `2.11.10` |
| [eslint](https://github.com/eslint/eslint ) | `10.11.0` | `10.13.0` |
|
[eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier )
| `5.5.6` | `5.5.7` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.70.1` | `8.72.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.70.1` | `8.72.1` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.9` | `3.9.10`
|
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.13` | `1.3.1` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.18` | `1.5.3` |
Updates `turbo` from 2.11.5 to 2.11.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases ">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.11.10</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>fix: Allow non-recursive Turbo commands in root tasks by <a
href="https://github.com/sahyl "><code>@sahyl</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14814 ">vercel/turborepo#14814</a></li>
<li>chore: Release Turborepo 2.11.9 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14824 ">vercel/turborepo#14824</a></li>
<li>chore(deps): Update dependency <code>@vercel/geistdocs</code> to v2
by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14417 ">vercel/turborepo#14417</a></li>
<li>chore: Update with-gatsby example by <a
href="https://github.com/vercel-gh-bot-3 "><code>@vercel-gh-bot-3</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14796 ">vercel/turborepo#14796</a></li>
<li>fix: Avoid pnpm batch-shim shutdown hangs on Windows by <a
href="https://github.com/sahyl "><code>@sahyl</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14819 ">vercel/turborepo#14819</a></li>
<li>chore(deps): Update dependency <code>@vercel/geistdocs</code> to
v2.11.0 by <a
href="https://github.com/vercel-gh-bot-3 "><code>@vercel-gh-bot-3</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14832 ">vercel/turborepo#14832</a></li>
<li>fix: Exclude tool-managed directories from local dependency inputs
by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14696 ">vercel/turborepo#14696</a></li>
<li>fix: Match git's text=auto binary detection in file hashing by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14697 ">vercel/turborepo#14697</a></li>
<li>fix: Drop <code>@react-router/dev</code> from Remix match list by
<a
href="https://github.com/Pcmhacker-piro "><code>@Pcmhacker-piro</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14800 ">vercel/turborepo#14800</a></li>
<li>fix: Match package configuration files and directory inputs in
task-level affected detection by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14804 ">vercel/turborepo#14804</a></li>
<li>fix: Parse pnpm 8 single-project lockfiles by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14806 ">vercel/turborepo#14806</a></li>
<li>fix: Keep task env vars in the hash when globalEnv excludes inferred
vars by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14805 ">vercel/turborepo#14805</a></li>
<li>docs: Generate the sitemap from Geistdocs sources by <a
href="https://github.com/molebox "><code>@molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14865 ">vercel/turborepo#14865</a></li>
<li>fix: Restore cached symlinks when outputs are already on disk by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14807 ">vercel/turborepo#14807</a></li>
<li>chore: Remove CODEOWNERS file by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
with <a href="https://github.com/Copilot "><code>@Copilot</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14810 ">vercel/turborepo#14810</a></li>
<li>feat: Enable WebMCP for Turborepo docs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14828 ">vercel/turborepo#14828</a></li>
<li>fix: Exit quietly when <code>turbo ls</code> output is piped to a
closed reader by <a
href="https://github.com/drakeo338 "><code>@drakeo338</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14868 ">vercel/turborepo#14868</a></li>
<li>fix: Distrust compromised eMudhra intermediate certificates by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14876 ">vercel/turborepo#14876</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vercel/turborepo/compare/v2.11.9...v2.11.10 ">https://github.com/vercel/turborepo/compare/v2.11.9...v2.11.10 </a></p>
<h2>Turborepo v2.11.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.11.8 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14789 ">vercel/turborepo#14789</a></li>
<li>perf: Prefetch Cargo metadata during lazy graph construction by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14497 ">vercel/turborepo#14497</a></li>
<li>perf: Compute Berry lockfile closures once across workspaces by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14499 ">vercel/turborepo#14499</a></li>
<li>perf: Check cache hit outputs in place instead of on the blocking
pool by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14524 ">vercel/turborepo#14524</a></li>
<li>perf: Speed up Berry lockfile loading by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14500 ">vercel/turborepo#14500</a></li>
<li>perf: Parse bun.lock without building a JSON syntax tree by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14502 ">vercel/turborepo#14502</a></li>
<li>perf: Skip the dry run cache batch window when there is no remote
cache by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14505 ">vercel/turborepo#14505</a></li>
<li>perf: Emit lockfile closures pre-sorted and cheapen closure
interning by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14525 ">vercel/turborepo#14525</a></li>
<li>perf: Reuse configuration derived from turbo.json between the shim
and the CLI by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14521 ">vercel/turborepo#14521</a></li>
<li>feat: Report locked tools-only setup plans by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14483 ">vercel/turborepo#14483</a></li>
<li>perf: Compute Bun lockfile closures once across workspaces by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14501 ">vercel/turborepo#14501</a></li>
<li>perf: Reuse open parent directories when restoring cache archives by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14506 ">vercel/turborepo#14506</a></li>
<li>perf: Skip dropping the run right before turbo run exits by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14507 ">vercel/turborepo#14507</a></li>
<li>perf: Match literal input exclusions without compiling globs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14510 ">vercel/turborepo#14510</a></li>
<li>perf: Copy pruned package files in parallel by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14512 ">vercel/turborepo#14512</a></li>
<li>feat: Report proposed first-lock and refresh setup plans by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14571 ">vercel/turborepo#14571</a></li>
<li>perf: Compress large cache archives with multithreaded zstd by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14698 ">vercel/turborepo#14698</a></li>
<li>perf: Read tracked file stats from directory listings on Windows by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14633 ">vercel/turborepo#14633</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/e521641a142a24abe4554a77fdd6551e47e96fb3 "><code>e521641</code></a>
publish 2.11.10 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/aaf5a3afdc7f1f3142ec13b6665ef099b3fb3528 "><code>aaf5a3a</code></a>
fix: Distrust compromised eMudhra intermediate certificates (<a
href="https://redirect.github.com/vercel/turborepo/issues/14876 ">#14876</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/98165036e02c9940e9b22b9ffbed98a721aa24f1 "><code>9816503</code></a>
fix: Exit quietly when <code>turbo ls</code> output is piped to a closed
reader (<a
href="https://redirect.github.com/vercel/turborepo/issues/14868 ">#14868</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/af866e5114c328a25ead2690464607214245b3f8 "><code>af866e5</code></a>
feat: Enable WebMCP for Turborepo docs (<a
href="https://redirect.github.com/vercel/turborepo/issues/14828 ">#14828</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/b42cc68b412d7be1e103f9a014a29b2f56e990e3 "><code>b42cc68</code></a>
chore: Remove CODEOWNERS file (<a
href="https://redirect.github.com/vercel/turborepo/issues/14810 ">#14810</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/921155f01d4abe946ac0265f3b37a763108ec1b3 "><code>921155f</code></a>
fix: Restore cached symlinks when outputs are already on disk (<a
href="https://redirect.github.com/vercel/turborepo/issues/14807 ">#14807</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/9330903fb870682d5c3239d2acac597fd4fb29e8 "><code>9330903</code></a>
docs: Generate the sitemap from Geistdocs sources (<a
href="https://redirect.github.com/vercel/turborepo/issues/14865 ">#14865</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/60480382670ce6ed882bb33ae59cc7be17f80279 "><code>6048038</code></a>
fix: Keep task env vars in the hash when globalEnv excludes inferred
vars (<a
href="https://redirect.github.com/vercel/turborepo/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/57ecce3b0ebed41b43c288ed9082043f29f451ac "><code>57ecce3</code></a>
fix: Parse pnpm 8 single-project lockfiles (<a
href="https://redirect.github.com/vercel/turborepo/issues/14806 ">#14806</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/d926d6a3723956eff9d07228809097b307dc978a "><code>d926d6a</code></a>
fix: Match package configuration files and directory inputs in
task-level aff...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.11.5...v2.11.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.11.0 to 10.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.13.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)
(Irfan fandi)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e "><code>66ac583</code></a>
feat: check <code>yield*</code> expressions in
<code>no-unsafe-optional-chaining</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21399 ">#21399</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3 "><code>87bd2ce</code></a>
fix: avoid redeclared <code>let</code> when <code>no-var</code> and
<code>one-var</code> fix together (<a
href="https://redirect.github.com/eslint/eslint/issues/21389 ">#21389</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)
(lumir)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24 "><code>47b7063</code></a>
chore: update dependency <code>@eslint/json</code> to ^2.1.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21398 ">#21398</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6 "><code>e5aea41</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21390 ">#21390</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.12.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5 "><code>4618052</code></a>
feat: handle astral letters in <code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21357 ">#21357</a>)
(sary)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa "><code>4ec5168</code></a>
feat: allow <code>SourceCode#getText()</code> to accept tokens and
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21340 ">#21340</a>)
(electrohyun)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7 "><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373 ">#21373</a>)
(Daniel Pinto)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038 "><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332 ">#21332</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a "><code>efc4d6b</code></a>
fix: astral letters in <code>consistent-return</code>,
<code>no-eval</code>, <code>no-invalid-this</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21360 ">#21360</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba "><code>93de066</code></a>
fix: prefer-exponentiation-operator autofix for async function base (<a
href="https://redirect.github.com/eslint/eslint/issues/21322 ">#21322</a>)
(Vladimir Babin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5 "><code>02e34ff</code></a>
fix: add missing space after <code>else</code> in <code>curly</code>
autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21355 ">#21355</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160 "><code>b14b8bc</code></a>
fix: correct <code>id-length</code> message for long private names (<a
href="https://redirect.github.com/eslint/eslint/issues/21348 ">#21348</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8 "><code>69aac01</code></a>
fix: support <code>TSFunctionType</code> in
<code>getFunctionHeadLoc</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21335 ">#21335</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532 "><code>686630e</code></a>
fix: <code>no-loss-of-precision</code> false positive with
<code>0.e5</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21337 ">#21337</a>)
(sethamus)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f "><code>67eb586</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21 "><code>5370d7e</code></a>
docs: clarify <code>one-var</code> <code>separateRequires</code> matches
any <code>require()</code> call (<a
href="https://redirect.github.com/eslint/eslint/issues/21192 ">#21192</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f "><code>8816c1d</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e "><code>3d2e7ce</code></a>
docs: fix typo in no-unused-expressions documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21346 ">#21346</a>)
(bytedoe)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6 "><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362 ">#21362</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e "><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376 ">#21376</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177 "><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364 ">#21364</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc853355c "><code>322209e</code></a>
ci: avoid Nx cache in ecosystem tests and disable failing test (<a
href="https://redirect.github.com/eslint/eslint/issues/21369 ">#21369</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d166567901e09940c1de4ad0e95d572eeab5c927 "><code>d166567</code></a>
chore: update dependency prettier to v3.9.9 (<a
href="https://redirect.github.com/eslint/eslint/issues/21371 ">#21371</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/29585ceba7ad35368d1b763bd1e80d899f28842c "><code>29585ce</code></a>
chore: update dependency eslint-plugin-expect-type to ^0.7.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21359 ">#21359</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/39d79ba9650542ac66d585d1899304abd630c07d "><code>39d79ba</code></a>
chore: update github/codeql-action action to v4.38.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21354 ">#21354</a>)
(renovate[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4637f9827a1ba137498eaee70957850621082815 "><code>4637f98</code></a>
10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/96df05ceb7000813859acf16a690f8a8bbbea904 "><code>96df05c</code></a>
Build: changelog update for 10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.11.0...v10.13.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint-plugin-prettier` from 5.5.6 to 5.5.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/eslint-plugin-prettier/releases ">eslint-plugin-prettier's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">#796</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
Thanks <a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>!
- Fix fallback diagnostic locations for all supported line endings.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805 ">#805</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
Thanks <a href="https://github.com/JounQin "><code>@JounQin</code></a>!
- Report a clear error when the sync worker fails to load, so a missing
<code>prettier</code> dependency now fails fast with <code>Cannot find
package 'prettier'</code> instead of hanging ESLint indefinitely.</p>
</li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a
href="https://github.com/truongbo17 "><code>@truongbo17</code></a> made
their first contribution in <a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/798 ">prettier/eslint-plugin-prettier#798</a></li>
<li><a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>
made their first contribution in <a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">prettier/eslint-plugin-prettier#796</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 ">https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md ">eslint-plugin-prettier's
changelog</a>.</em></p>
<blockquote>
<h2>5.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">#796</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
Thanks <a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>!
- Fix fallback diagnostic locations for all supported line endings.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805 ">#805</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
Thanks <a href="https://github.com/JounQin "><code>@JounQin</code></a>!
- Report a clear error when the sync worker fails to load, so a missing
<code>prettier</code> dependency now fails fast with <code>Cannot find
package 'prettier'</code> instead of hanging ESLint indefinitely.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/e6dd27a4e4015748b2e87c646be2c1a530789343 "><code>e6dd27a</code></a>
chore: keep packageManager when cleaning package.json for release (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/808 ">#808</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7544956b642d4e653c235d178432e4d60a312b6b "><code>7544956</code></a>
chore: release eslint-plugin-prettier (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/799 ">#799</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/e3e52386bd8ab1604d4d41ecd961de5e6749eed8 "><code>e3e5238</code></a>
ci: enable npm publish provenance for changesets v3 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/807 ">#807</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7c923c41069c939d6c6c8b7cfcad8f6a266f5276 "><code>7c923c4</code></a>
build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/806 ">#806</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
fix: bump synckit to surface worker failures instead of hanging (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/805 ">#805</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/a6b3feb3ce5d0bf785ddf4a83d24cf6a5c4bb902 "><code>a6b3feb</code></a>
docs: explain line endings and <code>endOfLine</code> behavior (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/804 ">#804</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/2f6ba1dca350a40857884103a7bf0e74b64901f7 "><code>2f6ba1d</code></a>
ci: exercise the getLocFromIndex ponyfill on ESLint 9 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/803 ">#803</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/cf1d2c5cffb7520d28fe680603cc4906ada0816f "><code>cf1d2c5</code></a>
chore(deps): update (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/802 ">#802</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/9f14a554f9737b1b985e2b26501d3bb2defac920 "><code>9f14a55</code></a>
chore(deps): update all dependencies (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/788 ">#788</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
fix: map fallback source locations to actual line starts (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/796 ">#796</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-optional-chain] safe fix
when the chain ends with a strict null comparison (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12805 ">#12805</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
parenthesize constraint in optional tuple elements (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12995 ">#12995</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unused-vars] ignore type-only
refs for after-used (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12977 ">#12977</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1166ba20e9e484167ebfe216fdb38e605e3f7598 "><code>1166ba2</code></a>
chore(type-utils): detect methods in isTypeReadonly without reading the
inter...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2f0343a694bee1ba9815e4a0f946295452deb082 "><code>2f0343a</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] bound recursive type
trav...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c49d287f046c794133b12fa94207e5ee3b846ddd "><code>c49d287</code></a>
chore: [ci] test on oldest supported TS version (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13024 ">#13024</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/594fe286ec518c6899a9b89141cf3220bcfb9f72 "><code>594fe28</code></a>
fix(eslint-plugin): [no-unnecessary-condition] false positives on
unresolved ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c6eb98c17cbeee540d3c48d1406098430b2f0660 "><code>c6eb98c</code></a>
feat(eslint-plugin): [await-thenable] add
<code>allowMixedPromiseArrays</code> option (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b382b74579e5514c247ed54d0dfc428f3a173f3a "><code>b382b74</code></a>
fix(type-utils): discriminateAnyType crashes when calling getAwaitedType
on a...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79edd896790b031457fc0ca6f81c732b29921c9d "><code>79edd89</code></a>
fix(eslint-plugin): [require-array-sort-compare] ignore extra this type
argum...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.1 (2026-10-05)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.0 (2026-09-28)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7488d681f6e0e96c2aaa1eee9c3d1b9b1ef077cb "><code>7488d68</code></a>
chore(release): publish 8.71.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d57b8da272375b6a45270639894a793933208a91 "><code>d57b8da</code></a>
chore(release): publish 8.71.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8695664c5ee3fbb8fd76907fc45e148579cc3162 "><code>8695664</code></a>
chore(release): publish 8.71.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.9 to 3.9.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases ">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.10</h2>
<ul>
<li>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266 ">#20266</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.10/CHANGELOG.md#3910 ">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md ">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.10</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10 ">diff</a></p>
<h4>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266 ">#20266</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<p>See <a
href="https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267 ">https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267 </a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/1172b82c295c4f889fd787dc6c78c3e194ebf353 "><code>1172b82</code></a>
Release 3.9.10</li>
<li><a
href="https://github.com/prettier/prettier/commit/d0142273aff2c76f8a69785d42ee2cedc4b0aaa3 "><code>d014227</code></a>
Update <code>micromark-extension-gfm-table</code> to fix the table parse
issue on perfor...</li>
<li><a
href="https://github.com/prettier/prettier/commit/953b9084329dcd06ed1072a04b333f1e6e9371e8 "><code>953b908</code></a>
Bump Prettier dependency to 3.9.9</li>
<li><a
href="https://github.com/prettier/prettier/commit/ad8a6bf4fa23c42fd114683fec43b28a11bd24af "><code>ad8a6bf</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.2.13 to 1.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12026 ">#12026</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- fix(core): deliver callbacks once to a handler registered twice by
merged configs</p>
<p>Merging two runnable configs that both carry the same callback
handler, as happens when an agent's <code>streamEvents()</code> runs
inside a LangGraph node with tracing on, registered that handler twice,
so it received every callback twice: every streamed chunk arrived twice.
The configured callback manager now keeps each handler once, in order,
including a handler passed as a plain object of methods that merged
configs wrapped twice.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12042 ">#12042</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): include node <code>metadata</code> in
<code>Graph.toJSON()</code> output when set, matching Python</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12048 ">#12048</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): escape <code>drawMermaid</code> node metadata labels and
leave out object values, so metadata with brackets or objects no longer
breaks Mermaid parsing</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11986 ">#11986</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2caf64da3f02730f3cd2aab0c15de6eab41a01da "><code>2caf64d</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat: stream tool-call args as <code>tool-call-delta</code> slices</p>
<p>Tool-call and server-tool-call args now stream as
<code>tool-call-delta</code> events, which carry only the new slice of
the args, instead of <code>block-delta</code> snapshots of the args so
far. A large tool call now costs about the same bytes on the wire as the
same length of text.</p>
<ul>
<li>This covers the compat bridge (any model that only implements
<code>_streamResponseChunks</code>), the OpenAI-compatible converter
(OpenAI Completions, Groq, Mistral, IBM, OpenRouter, Perplexity,
DeepSeek, Fireworks, Together AI and xAI Completions), OpenAI and xAI
Responses, Anthropic (client and server tool calls) and Bedrock
Converse. Google and Ollama still send one complete snapshot per
call.</li>
<li>A tool call's <code>id</code>, <code>name</code> and
<code>index</code> go on <code>content-block-start</code>, which carries
no args. An <code>id</code> or <code>name</code> that arrives later
reaches consumers on <code>content-block-finish</code>.</li>
<li>If you read raw events and their <code>block-delta</code>
<code>fields.args</code> mid-stream, or write agent stream transformers
that do, read <code>tool-call-delta</code> instead. <code>await
stream</code>, <code>.toolCalls</code> and the assembled message are
unchanged.</li>
<li>Upgrade your clients first. Older clients mishandle
<code>tool-call-delta</code>. You need
<code>@langchain/langgraph-sdk</code> 1.12.6 or later;
<code>@langchain/react</code>, <code>@langchain/vue</code>,
<code>@langchain/svelte</code> or <code>@langchain/angular</code> 1.2.6
or later; and <code>langchain-core</code> 1.6.13 or later for Python
clients.</li>
<li>To hold back, pin <code>@langchain/core</code> below 1.3.0. That
also keeps you on <code>@langchain/openai</code>,
<code>@langchain/anthropic</code>, <code>@langchain/aws</code> and
<code>@langchain/xai</code> versions that send snapshots.</li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.20</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11922 ">#11922</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d71c542fb1d9cd1ceb310a4759591c024cf0d57d "><code>d71c542</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): add <code>midConversationSystemMessages</code> and
<code>midConversationTools</code> to <code>ModelProfile</code>. They say
whether a chat model sends a system message after the first turn in
place, and whether it can add a tool through a message rather than the
request's tool list. Either way the prompt prefix before it stays
unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11982 ">#11982</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5af4684bd19a16bb59950801da92245733482fb3 "><code>5af4684</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): read <code>tool-call-delta</code> in
<code>ChatModelStream</code></p>
<ul>
<li><code>ChatModelStream</code> appends <code>tool-call-delta</code>
slices to a tool call's args, and still replaces them on
<code>block-delta</code></li>
<li>It ignores delta types it doesn't recognize instead of throwing
<code>Unknown delta type</code></li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11956 ">#11956</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/93d62b008e13e10f28724a5ab09ab6eda584f1cb "><code>93d62b0</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Require langsmith >=0.11.0 to include the restored NullableHeaders
type declarations.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11822 ">#11822</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e6fe66a5f902fa615f076ca71d9541f1291166 "><code>d3e6fe6</code></a>
Thanks <a href="https://github.com/dqbd "><code>@dqbd</code></a>! - Add
explicit agent address support to <code>LangChainTracer</code>, inherit
project and address destinations together, and delegate default
destination resolution to the LangSmith SDK.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11150 ">#11150</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/cea15cf9ef5216125b24f23bb5ad06b7c1a91b33 "><code>cea15cf</code></a>
Thanks <a
href="https://github.com/mdnanocom "><code>@mdnanocom</code></a>! -
fix(core): defer tool call chunk collapsing in AIMessageChunk to fix
O(n²) streaming aggregation</p>
<p><code>AIMessageChunk</code> eagerly re-ran
<code>collapseToolCallChunks</code> in its constructor on every streamed
delta <code>concat</code>, re-parsing all accumulated tool args each
time — O(n²) over a stream, which can block the event loop for seconds
on long tool-call streams. Collapsing now runs lazily, once, on first
read of <code>tool_calls</code> / <code>invalid_tool_calls</code>.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.17</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e8c5dc82ba52cff3bc08cd71f963a69596d7ea4d "><code>e8c5dc8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12047 ">#12047</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/b5135cc189adbf313f4e92c1527f96a40a546977 "><code>b5135cc</code></a>
feat(openai,langchain): support Decisions API and agent middleware (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11930 ">#11930</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/52d2ba8ea50149f2314df63b79582f8508034a3b "><code>52d2ba8</code></a>
fix(aws): use this.caller in ChatBedrockConverse to support retries (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11463 ">#11463</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
fix(core): deliver callbacks once to a handler registered twice by
merged con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
fix(core): make drawMermaid node metadata labels safe (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12048 ">#12048</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
fix(core): include node metadata in Graph.toJSON() (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12042 ">#12042</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d1d0692d8498d7e1521c854d90af0395535df4d8 "><code>d1d0692</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12044 ">#12044</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/95b191b1928ee8f4e20e51aa821f5c5fd4b8b3da "><code>95b191b</code></a>
feat(openai): refresh model profiles from models.dev (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12046 ">#12046</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/81577b3e84c3f38581e76e8335faa89511e99d74 "><code>81577b3</code></a>
fix(langchain): re-throw a drained tool from the agent's ToolNode (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12043 ">#12043</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4cbf0f5938710ce1669c679febdbea41b733a100 "><code>4cbf0f5</code></a>
chore(deps): bump the npm_and_yarn group across 2 directories with 1
update (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.13...@langchain/core@1.3.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.18 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://gith ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:41 -08:00
dependabot[bot]
d05c887163
chore(deps): bump the uv group across 2 directories with 1 update ( #9513 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory: [langgraph-sdk](https://github.com/langchain-ai/langgraph ).
Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple
directory: [langgraph-sdk](https://github.com/langchain-ai/langgraph ).
Updates `langgraph-sdk` from 0.4.4 to 0.4.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.11</h2>
<p>Changes since sdk==0.4.10</p>
<ul>
<li>release(langgraph): 1.2.19 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9504 ">#9504</a>)</li>
<li>release(sdk-py): 0.4.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9503 ">#9503</a>)</li>
<li>test(sdk-py): check that a reconnect loop resumes after the newest
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9483 ">#9483</a>)</li>
<li>fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects
with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9481 ">#9481</a>)</li>
<li>fix(sdk-py): warn when a stream reconnects without a Last-Event-ID
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9482 ">#9482</a>)</li>
<li>fix(sdk-py): preserve SSE data and cursor state across chunks (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9477 ">#9477</a>)</li>
<li>fix(sdk-py): retry failed stream reconnects with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9462 ">#9462</a>)</li>
<li>fix(sdk-py): match Auth.on overload to optional resources (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9450 ">#9450</a>)</li>
<li>fix(sdk-py): reset the reconnect cursor on every empty id (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9440 ">#9440</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.10</h2>
<p>Changes since sdk==0.4.9</p>
<ul>
<li>release(checkpoint): 4.3.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9447 ">#9447</a>)</li>
<li>release(langgraph): 1.2.18 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9445 ">#9445</a>)</li>
<li>release(sdk-py): 0.4.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9446 ">#9446</a>)</li>
<li>fix(sdk-py): retry runs.wait with a bodyless GET and raise run
errors in sync wait (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9399 ">#9399</a>)</li>
<li>fix(sdk-py): follow the SSE spec for multi-line data, empty ids and
a leading BOM (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9402 ">#9402</a>)</li>
<li>fix(sdk-py): accept durability, stream_resumable and context in the
runs overloads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9403 ">#9403</a>)</li>
<li>release(langgraph): 1.2.17 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9418 ">#9418</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.9</h2>
<p>Changes since sdk==0.4.8</p>
<ul>
<li>release(sdk-py): 0.4.9 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9398 ">#9398</a>)</li>
<li>feat(sdk-py): add Priority for thread priority settings (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9392 ">#9392</a>)</li>
<li>chore(deps): remove precautionary third-party upper bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9390 ">#9390</a>)</li>
<li>chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in
/libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9370 ">#9370</a>)</li>
<li>chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in
/libs/cli/js-examples in the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9154 ">#9154</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt
with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9150 ">#9150</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.8</h2>
<p>Changes since sdk==0.4.7</p>
<ul>
<li>release(langgraph): 1.2.16 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9334 ">#9334</a>)</li>
<li>release(sdk-py): 0.4.8 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9335 ">#9335</a>)</li>
<li>fix(sdk-py): surface thread stream errors and stop retrying a
rejected stream (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9317 ">#9317</a>)</li>
<li>release(prebuilt): 1.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9316 ">#9316</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.7</h2>
<p>Changes since sdk==0.4.6</p>
<ul>
<li>release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li>release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li>fix(sdk-py): end a thread stream's run only on a root lifecycle
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9228 ">#9228</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/05e4efe712ae6b9dd9560007395c9ee248f45b1f "><code>05e4efe</code></a>
release(cli): relax api bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6606 ">#6606</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/c80d93c78a6e6223c3df1581f0e70466110fd4b8 "><code>c80d93c</code></a>
fix(cli): Escape variable substitution in compose codegen (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6594 ">#6594</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/87cb5095285ba809b547584d31bae26046fc844a "><code>87cb509</code></a>
feat(checkpoint): Validate checkpointer type at compile time (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6586 ">#6586</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/84023451a2bd5987b1d4df530f4145d503d75ccb "><code>8402345</code></a>
release(langgraph): bump to 1.0.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6582 ">#6582</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/efe78447b3cdd424702274ffda918961af07e560 "><code>efe7844</code></a>
feat(sdk-py): emit id as part of stream events (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6581 ">#6581</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/df191731918482c5eaf2934a2df0c9cb3571db0c "><code>df19173</code></a>
fix: update readme (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6570 ">#6570</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/4d01e69b823c4126f375cbed72fed7c5797d1b91 "><code>4d01e69</code></a>
release(checkpoint-postgres): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6568 ">#6568</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/e86b5f4da21f0fa00bec19fe0e86d031dba0b004 "><code>e86b5f4</code></a>
chore: pgqs (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6567 ">#6567</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b70d5aac0ee330e9dde22ca9c7e8f0774e44da54 "><code>b70d5aa</code></a>
release(checkpoint-sqlite): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6566 ">#6566</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a "><code>2972429</code></a>
fix(checkpoint-sqlite): harden (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6565 ">#6565</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.4...cli==0.4.11 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langgraph-sdk` from 0.4.4 to 0.4.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.11</h2>
<p>Changes since sdk==0.4.10</p>
<ul>
<li>release(langgraph): 1.2.19 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9504 ">#9504</a>)</li>
<li>release(sdk-py): 0.4.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9503 ">#9503</a>)</li>
<li>test(sdk-py): check that a reconnect loop resumes after the newest
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9483 ">#9483</a>)</li>
<li>fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects
with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9481 ">#9481</a>)</li>
<li>fix(sdk-py): warn when a stream reconnects without a Last-Event-ID
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9482 ">#9482</a>)</li>
<li>fix(sdk-py): preserve SSE data and cursor state across chunks (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9477 ">#9477</a>)</li>
<li>fix(sdk-py): retry failed stream reconnects with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9462 ">#9462</a>)</li>
<li>fix(sdk-py): match Auth.on overload to optional resources (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9450 ">#9450</a>)</li>
<li>fix(sdk-py): reset the reconnect cursor on every empty id (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9440 ">#9440</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.10</h2>
<p>Changes since sdk==0.4.9</p>
<ul>
<li>release(checkpoint): 4.3.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9447 ">#9447</a>)</li>
<li>release(langgraph): 1.2.18 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9445 ">#9445</a>)</li>
<li>release(sdk-py): 0.4.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9446 ">#9446</a>)</li>
<li>fix(sdk-py): retry runs.wait with a bodyless GET and raise run
errors in sync wait (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9399 ">#9399</a>)</li>
<li>fix(sdk-py): follow the SSE spec for multi-line data, empty ids and
a leading BOM (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9402 ">#9402</a>)</li>
<li>fix(sdk-py): accept durability, stream_resumable and context in the
runs overloads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9403 ">#9403</a>)</li>
<li>release(langgraph): 1.2.17 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9418 ">#9418</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.9</h2>
<p>Changes since sdk==0.4.8</p>
<ul>
<li>release(sdk-py): 0.4.9 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9398 ">#9398</a>)</li>
<li>feat(sdk-py): add Priority for thread priority settings (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9392 ">#9392</a>)</li>
<li>chore(deps): remove precautionary third-party upper bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9390 ">#9390</a>)</li>
<li>chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in
/libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9370 ">#9370</a>)</li>
<li>chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in
/libs/cli/js-examples in the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9154 ">#9154</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt
with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9150 ">#9150</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.8</h2>
<p>Changes since sdk==0.4.7</p>
<ul>
<li>release(langgraph): 1.2.16 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9334 ">#9334</a>)</li>
<li>release(sdk-py): 0.4.8 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9335 ">#9335</a>)</li>
<li>fix(sdk-py): surface thread stream errors and stop retrying a
rejected stream (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9317 ">#9317</a>)</li>
<li>release(prebuilt): 1.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9316 ">#9316</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.7</h2>
<p>Changes since sdk==0.4.6</p>
<ul>
<li>release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li>release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li>fix(sdk-py): end a thread stream's run only on a root lifecycle
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9228 ">#9228</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/05e4efe712ae6b9dd9560007395c9ee248f45b1f "><code>05e4efe</code></a>
release(cli): relax api bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6606 ">#6606</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/c80d93c78a6e6223c3df1581f0e70466110fd4b8 "><code>c80d93c</code></a>
fix(cli): Escape variable substitution in compose codegen (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6594 ">#6594</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/87cb5095285ba809b547584d31bae26046fc844a "><code>87cb509</code></a>
feat(checkpoint): Validate checkpointer type at compile time (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6586 ">#6586</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/84023451a2bd5987b1d4df530f4145d503d75ccb "><code>8402345</code></a>
release(langgraph): bump to 1.0.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6582 ">#6582</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/efe78447b3cdd424702274ffda918961af07e560 "><code>efe7844</code></a>
feat(sdk-py): emit id as part of stream events (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6581 ">#6581</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/df191731918482c5eaf2934a2df0c9cb3571db0c "><code>df19173</code></a>
fix: update readme (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6570 ">#6570</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/4d01e69b823c4126f375cbed72fed7c5797d1b91 "><code>4d01e69</code></a>
release(checkpoint-postgres): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6568 ">#6568</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/e86b5f4da21f0fa00bec19fe0e86d031dba0b004 "><code>e86b5f4</code></a>
chore: pgqs (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6567 ">#6567</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b70d5aac0ee330e9dde22ca9c7e8f0774e44da54 "><code>b70d5aa</code></a>
release(checkpoint-sqlite): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6566 ">#6566</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a "><code>2972429</code></a>
fix(checkpoint-sqlite): harden (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6565 ">#6565</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.4...cli==0.4.11 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:37 -08:00
dependabot[bot]
21ab811f91
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 4 updates ( #9523 )
...
Bumps the minor-and-patch group in /libs/checkpoint-conformance with 4
updates: [pytest](https://github.com/pytest-dev/pytest ),
[pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `pytest` from 9.1.1 to 9.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases ">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.2.0</h2>
<h1>pytest 9.2.0 (2026-10-27)</h1>
<h2>Removals and backward incompatible breaking changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14716 ">#14716</a>:
<code>-c</code> now raises a usage error for a path that does not exist,
is a directory, or is in a format pytest has no loader for. Such paths
were previously either ignored or reported as an unhandled
<code>FileNotFoundError</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/8593 ">#8593</a>:
The <code>indirect</code>, <code>ids</code> and <code>scope</code>
arguments of <code>Metafunc.parametrize()
<pytest.Metafunc.parametrize></code> -- and therefore of
<code>@pytest.mark.parametrize <pytest.mark.parametrize
ref></code> -- are now keyword-only.</p>
<p>Passing them positionally was a common source of confusing errors,
e.g. <code>parametrize("arg1", "arg2", [(1,
2)])</code> made the argvalues land in <code>indirect</code> and failed
with <code>indirect fixture '(1, 2)' doesn't exist</code>; such mistakes
now fail with an understandable <code>TypeError</code>. The type
annotations have always declared these arguments as keyword-only.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/993 ">#993</a>:
Plugin import failures at startup are now reported and classified
instead of escaping as a raw traceback with the accidental exit code
<code>1</code>:</p>
<ul>
<li>a plugin that cannot be found -- via <code>-p</code>,
<code>pytest_plugins</code> or <code>PYTEST_PLUGINS</code> -- exits with
<code>pytest.ExitCode</code> <code>USAGE_ERROR</code> (<code>4</code>),
like a <code>conftest.py</code> that fails to import;</li>
<li>a plugin that is found but raises while importing -- including a
broken <code>pytest11</code> entry point or a missing plugin dependency
-- exits with <code>pytest.ExitCode</code> <code>INTERNAL_ERROR</code>
(<code>3</code>), with the traceback preserved.</li>
</ul>
<p><code>pytest.main</code> now returns these codes instead of raising
<code>ImportError</code>. Also fixed an <code>IndexError</code> from
pytest's own internals when the plugin raised an exception with no
arguments.</p>
</li>
</ul>
<h2>Deprecations (removal in next major release)</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14742 ">#14742</a>:
The private <code>_pytest.python.CallSpec2</code> name has been renamed
to <code>CallSpec</code>.
The old <code>CallSpec2</code> alias remains available for now and will
be removed in pytest 10 or 11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14755 ">#14755</a>:
Schedule <em>yield_fixture</em> decorator for removal in pytest 10 or
11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14774 ">#14774</a>:
Similarly to the deprecation of class-scoped fixtures defined as
instance methods in pytest 9.1,
<em>all</em> higher-scoped fixtures (<code>module</code>,
<code>package</code>, and <code>session</code>) defined
as instance methods are now deprecated.</p>
<p>They suffer from the same issue the original deprecation only fixed
for
class-scoped fixtures, see <code>10819</code> and
<code>14011</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14808 ">#14808</a>:
Passing a non-string value to a <code>string</code>-typed ini option now
emits a <code>pytest.PytestRemovedIn10Warning</code>. This affects
<code>[tool.pytest.ini_options]</code> in <code>pyproject.toml</code>.
In pytest 10 this will raise a <code>TypeError</code>, matching the
behavior of the corresponding TOML config path.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/7323 ">#7323</a>:
Passing <code>bytes</code> to <code>TerminalReporter.write_line()</code>
is now deprecated, pass a <code>str</code> instead.</p>
</li>
</ul>
<h2>New features</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14743 ">#14743</a>:
<!-- raw HTML omitted -->Full diff:<!-- raw HTML omitted --> now
contains a legend explaining the <!-- raw HTML omitted -->+<!-- raw HTML
omitted --> & <!-- raw HTML omitted -->-<!-- raw HTML omitted -->
symbols in diff output.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/2781 ">#2781</a>:
When <code>strict_markers</code> is enabled, marker names used in
<code>-m</code> expressions are now validated against registered
markers.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/6881 ">#6881</a>:
Added the <code>parametrize_long_str_id_strategy</code> configuration
option to control how long <code>str</code>/<code>bytes</code> parameter
values are handled in auto-generated test IDs. Explicit IDs set via
<code>ids=[...]</code> or <code>pytest.param(..., id=...)</code> are not
affected. Available strategies: <code>short</code> (default, values over
100 chars fall back to <code>argname+index</code>), <code>sha256</code>
(SHA-256 hex digest), <code>legacy</code> (keep full value), and
<code>disallow</code> (error requesting explicit IDs).</li>
</ul>
<h2>Improvements in existing functionality</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/10745 ">#10745</a>:
A <code>RecursionError</code> whose recursion origin cannot be located
now shows only the
first and last 10 stack frames, matching what pytest already did when
locating
the origin failed outright. Previously the full traceback -- often
around a
thousand near-identical frames -- was rendered, which was both slow and
unreadable. Pass <code>--full-trace</code> to see every frame.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae1d0ff57b8bd4252da9ade7353523ac0ac73281 "><code>ae1d0ff</code></a>
Prepare release version 9.2.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/143ce31dea9b12ff2ab6add04361ee01ab114931 "><code>143ce31</code></a>
pre-commit: exclude codespell on generated release announcements</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/532dc5fc78f57de5115c5ecc9c6c29257787ada7 "><code>532dc5f</code></a>
tox: add attrs dependency to regen, needed in reportingdemo.rst</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a7b2446ee41a7298d3a0bc22c52f3b8bacae1566 "><code>a7b2446</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15245 ">#15245</a>
from pytest-dev/claude/project-thread-9jcf91</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/679d09c6945156746e17e9ec0b1c8309bbde3ad3 "><code>679d09c</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/15266 ">#15266</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/41d12cdbb4a35a7877768d93d8dc50a9117a8d8c "><code>41d12cd</code></a>
docs: clarify typing for yield fixtures</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/b9022ba04a33bfc76b5c9aefb8974755a80bf5ce "><code>b9022ba</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15182 ">#15182</a>
from 1871698/docs/improve-getting-started-description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/16f87a7f364a7362fbfbb204c79a47ad567b4fbd "><code>16f87a7</code></a>
docs: improve getting-started.rst test execution description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/082ed70e314ee8e1ab117763d17fe801648f7508 "><code>082ed70</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15255 ">#15255</a>
from pytest-dev/claude/project-thread-eoi3d6</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae37a013763e9c4a143245eda1acdc3c27961685 "><code>ae37a01</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15227 ">#15227</a>
from pytest-dev/claude/project-thread-4etye4</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-asyncio` from 1.4.0 to 1.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-asyncio/releases ">pytest-asyncio's
releases</a>.</em></p>
<blockquote>
<h2>pytest-asyncio v1.4.1</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.1 ">1.4.1</a>
- 2026-10-25</h1>
<h2>Added</h2>
<ul>
<li>Declared support for Python 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Allow <em>AsyncIterable</em> as a return type for asynchronous
generator fixtures decorated with <em>pytest_asyncio.fixture</em> (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1090 ">#1090</a>)</li>
</ul>
<h2>Notes for Downstream Packagers</h2>
<ul>
<li>Source-tree development dependencies now use PEP 735 dependency
groups and <code>uv.lock</code>. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1518 ">#1518</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/6af7f5c9a8c77fe5040b9d368b9ed01837c25652 "><code>6af7f5c</code></a>
chore: Prepare release of v1.4.1.</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/32ccf64ec115e42543bddb8cd142b2026b0cab77 "><code>32ccf64</code></a>
Support 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/983007120dcc53b14f8f7e9df492cbd1d20a242c "><code>9830071</code></a>
Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1590 ">#1590</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/0238023e439113044a9ed095307884c774ec9e46 "><code>0238023</code></a>
Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1589 ">#1589</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/93893ecd9447d105ebd56419bc5162aa2420587e "><code>93893ec</code></a>
Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/f287e5e0f5425380b24c32b64037dfb2ed3cb937 "><code>f287e5e</code></a>
Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1581 ">#1581</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b71da4fe09265e1ad86d4cbfc452b590ebfc4daa "><code>b71da4f</code></a>
Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1582 ">#1582</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/d8c51d8990a4bbdf8a19ff0cf80d68b95b11dea8 "><code>d8c51d8</code></a>
Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b12808bd8d061b583ccdddc53ad6c85198509eed "><code>b12808b</code></a>
Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1578 ">#1578</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/e0601f0ce9532de0b5453a5cfd08f25b258a93f5 "><code>e0601f0</code></a>
Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1577 ">#1577</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-asyncio/compare/v1.4.0...v1.4.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.9 to 0.17.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>Install ruff 0.17.3</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.17.3</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz ">ruff-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz ">ruff-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip ">ruff-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>0.17.2</h2>
<p>Released on 2026-10-22.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>complexity</code>] Add
<code>unnecessary-regular-expression-compile</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25533 ">#25533</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Avoid syntax errors for type variables with starred constraints
(<code>UP040</code>, <code>UP046</code>, <code>UP047</code>,
<code>RUF053</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28362 ">#28362</a>)</li>
<li>[<code>pydocstyle</code>] Treat backslash-escaped <code>*args</code>
and <code>**kwargs</code> as documented (<code>D417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29536 ">#29536</a>)</li>
<li>[<code>pylint</code>] Avoid false positive on starred elements
(<code>PLE0643</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29483 ">#29483</a>)</li>
<li>[<code>pylint</code>] Mark fixes unsafe when deleting comments
(<code>PLR5501</code>, <code>PLW0120</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29414 ">#29414</a>)</li>
<li>[<code>pyupgrade</code>] Mark fix unsafe when deleting comments
(<code>UP035</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29413 ">#29413</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid intermediate names in lint name resolution (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29506 ">#29506</a>)</li>
<li>Prefilter bidirectional Unicode checks by UTF-8 leading bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29561 ">#29561</a>)</li>
<li>Share postfix parsing and reduce expression copies (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29480 ">#29480</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/ba65abf8ba7bfbcc059f7fb9712be5ba9cab6abc "><code>ba65abf</code></a>
Bump version to 0.17.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29745 ">#29745</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/fb2f9218793e3b0e979175d43d88dcac791e92d6 "><code>fb2f921</code></a>
[ty] Fix narrowing of strings and integers compared with enum members
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29743 ">#29743</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d1812878d5f81af6f5810d193ebc44413d1b21cc "><code>d181287</code></a>
[ty] Index nominal union alternatives (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29196 ">#29196</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/07872adbafa7c00f42f1174d8aa3c3e324033009 "><code>07872ad</code></a>
[ty] Preserve string literals in comparisons with
<code>LiteralString</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29741 ">#29741</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/95888b2edfaa34d0159732856b1466cf53b33e64 "><code>95888b2</code></a>
[ty] Preserve narrowing after guarded match subject captures (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29558 ">#29558</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3c8166b683805aa89557b0739f5b9918ad58ea6d "><code>3c8166b</code></a>
[ty] Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29652 ">#29652</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3fd20e08598ac345b8afd524d3f7086456e4e758 "><code>3fd20e0</code></a>
[ty] Preserve generic callback specializations during return refinement
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29667 ">#29667</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2f0a29ece1f1a539c65c0671c04c76bb886219fe "><code>2f0a29e</code></a>
[ty] Record predicate truthiness alongside expression inference (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29706 ">#29706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/60f104a1a2ec4e980198ff54c38ba6fe7045b29f "><code>60f104a</code></a>
[ty] Honor <a
href="https://github.com/override "><code>@override</code></a> on
overload implementations in stubs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29470 ">#29470</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/207ec3affeb118fce03a65f9333959157e228312 "><code>207ec3a</code></a>
[ty] Add diagnostic baseline support (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27636 ">#27636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.9...0.17.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.84 to 0.0.94
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>Install ty 0.0.94</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.ps1
| iex"
</code></pre>
<h2>Download ty 0.0.94</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz ">ty-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz ">ty-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip ">ty-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip ">ty-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip ">ty-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz ">ty-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz ">ty-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz ">ty-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>0.0.93</h2>
<p>Released on 2026-10-28.</p>
<h3>Preview features</h3>
<ul>
<li>
<p>Add diagnostic baselines to help adopt ty in projects with existing
errors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27636 ">#27636</a>).
Configure a baseline in <code>pyproject.toml</code>:</p>
<pre lang="toml"><code>[tool.ty]
baseline = "ty-baseline.json"
</code></pre>
<p>Run <code>ty check --update-baseline</code> to record existing
diagnostics. Subsequent checks filter matching diagnostics from CLI
output and show them as hints in the language server. The baseline
format may change while the feature is in preview.</p>
</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix a panic when checking truthiness in a loop (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29759 ">#29759</a>)</li>
<li>Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29652 ">#29652</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid synthesizing primary keys for abstract Django models (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29744 ">#29744</a>)</li>
<li>Combine constraints from repeated <code>ParamSpec</code>s (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29172 ">#29172</a>)</li>
<li>Fix narrowing of strings and integers compared with enum members (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29743 ">#29743</a>)</li>
<li>Honor <code>@override</code> on overload implementations in stubs
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29470 ">#29470</a>)</li>
<li>Preserve caller type variables in nested union inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29611 ">#29611</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/f8ea270e0b125116ce52868b16384819183056af "><code>f8ea270</code></a>
Bump version to 0.0.94 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4857 ">#4857</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/7a36fc91318b07a58d0aa27753db4db1d212032a "><code>7a36fc9</code></a>
Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/issues/4853 ">#4853</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3db5e4df7becd3ca55fd06c78e98bf7c8a38e469 "><code>3db5e4d</code></a>
Bump version to 0.0.93 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4842 ">#4842</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f8fd0e8b5ce954b5a7f4e38431d805dd58e50e2d "><code>f8fd0e8</code></a>
Update astral-sh/setup-uv action to v10.3.2 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4843 ">#4843</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/c1ca420006c7e5ef62ddfa16267fd7531a0a1000 "><code>c1ca420</code></a>
Update uv to v0.13.6 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4845 ">#4845</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c5c9079ac053fa3f879ee7625ec5c28a0817de4 "><code>4c5c907</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4844 ">#4844</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/0445d6497ae22a0c480b23807cd71f47889053d8 "><code>0445d64</code></a>
Optimize Linux x86-64 ty releases with LLVM BOLT (<a
href="https://redirect.github.com/astral-sh/ty/issues/4833 ">#4833</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3933e6918b731d86b3f3a4f1bc47f2ce21195e8e "><code>3933e69</code></a>
Bump version to 0.0.92 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4821 ">#4821</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9aaec9ba5896c759e8e93000d0a1dec51f2bae57 "><code>9aaec9b</code></a>
Handle AI policy labels through Actions (<a
href="https://redirect.github.com/astral-sh/ty/issues/4812 ">#4812</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/e1b8efaafd842d3e33c1a21ae7e897434452975b "><code>e1b8efa</code></a>
Update uv to 0.13.5 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4809 ">#4809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.84...0.0.94 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:19 -08:00
dependabot[bot]
d42015a707
chore(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 in /libs/langgraph ( #9535 )
...
Bumps [types-requests](https://github.com/python/typeshed ) from
2.33.0.20260906 to 2.33.0.20261006.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits ">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:53 -08:00
dependabot[bot]
93aaa4632c
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 6 updates ( #9529 )
...
Bumps the minor-and-patch group in /libs/checkpoint with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.5`
| `1.7.1` |
| [pytest](https://github.com/pytest-dev/pytest ) | `9.1.1` | `9.2.0` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio ) |
`1.4.0` | `1.4.1` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.16.0` |
`3.17.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.9` | `0.17.3` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.84` | `0.0.94` |
Updates `langchain-core` from 1.6.5 to 1.7.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.7.1</h2>
<p>Changes since langchain-core==1.7.0</p>
<p>release(core): version 1.7.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41548 ">#41548</a>)
fix(core): preserve gateway tracing metadata in v3 streams (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41504 ">#41504</a>)
fix(core): escape node metadata in Mermaid labels (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41512 ">#41512</a>)
chore(deps): bump the minor-and-patch group across 3 directories with 32
updates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41465 ">#41465</a>)
chore(deps-dev): bump setuptools from 83.0.0 to 84.1.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41442 ">#41442</a>)
chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41425 ">#41425</a>)
chore(infra): relax third-party dependency upper bounds (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41407 ">#41407</a>)</p>
<h2>langchain-core==1.7.0</h2>
<p>Changes since langchain-core==1.6.13</p>
<p>release(core): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41418 ">#41418</a>)
feat(core): emit <code>tool-call-delta</code> for streamed tool-call
args (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41257 ">#41257</a>)</p>
<h2>Notes</h2>
<ul>
<li>Tool-call args now stream as <code>tool-call-delta</code> slices
instead of <code>block-delta</code> snapshots of the args so far. If you
read raw stream events and their <code>block-delta</code> args
mid-stream, read <code>tool-call-delta</code> instead.
<code>.tool_calls.get()</code> and <code>.output</code> are unchanged.
To keep snapshots, pin <code>langchain-core<1.7</code>.</li>
<li>Since 1.6.13, iterating <code>ChatModelStream.tool_calls</code>
yields each call's new args slice, not a snapshot of the args so
far.</li>
</ul>
<h2>langchain-core==1.6.13</h2>
<p>Changes since langchain-core==1.6.12</p>
<p>release(core): 1.6.13 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41397 ">#41397</a>)
chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/core
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41373 ">#41373</a>)
feat(core,langchain,standard-tests): read <code>tool-call-delta</code>
in stream consumers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41246 ">#41246</a>)</p>
<h2>langchain-core==1.6.12</h2>
<p>Changes since langchain-core==1.6.11</p>
<p>release(core): 1.6.12 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41277 ">#41277</a>)
fix(core): propagate extras on content-block-start events (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41272 ">#41272</a>)</p>
<h2>langchain-core==1.6.11</h2>
<p>Changes since langchain-core==1.6.10</p>
<p>release(core): 1.6.11 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41260 ">#41260</a>)
feat(core): accept address inside LangChainTracer (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41006 ">#41006</a>)</p>
<h2>langchain-core==1.6.10</h2>
<p>Changes since langchain-core==1.6.9</p>
<p>release(core): 1.6.10 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41220 ">#41220</a>)
feat(core,anthropic,openai): declare mid-conversation support in model
profiles (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41180 ">#41180</a>)</p>
<h2>langchain-core==1.6.9</h2>
<p>Changes since langchain-core==1.6.8</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/6419339aa163a49f32d9b80ff20d6adc3b446d49 "><code>6419339</code></a>
release(core): version 1.7.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41548 ">#41548</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3bc70b9daa0d17f1438ab408df5e9f2a8ba1e56e "><code>3bc70b9</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41543 ">#41543</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/facf2788ae1f60c62f2397d15698237c405a5f05 "><code>facf278</code></a>
fix(core): preserve gateway tracing metadata in v3 streams (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41504 ">#41504</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/6eb169b56cea0b535b9af0ca504bb367f6407455 "><code>6eb169b</code></a>
release(anthropic): 1.7.7 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41538 ">#41538</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/0808e17e29b59ee1cc45a5ce2aa4cb4006671c1c "><code>0808e17</code></a>
fix(anthropic): trace resolved reasoning effort (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41536 ">#41536</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4b80abeadd6faf7f321ac5d690602812f82a3baf "><code>4b80abe</code></a>
fix(core): escape node metadata in Mermaid labels (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41512 ">#41512</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/abbc0c30b9a3396a748add260284c27c8f5fb09f "><code>abbc0c3</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41520 ">#41520</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/575db57ab3658e38ba1d8c40c2bf62110c8a0c27 "><code>575db57</code></a>
test(openai): use current lightweight model in integration tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41509 ">#41509</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/0d29456babaa707357523ea20b27bd8858fb4766 "><code>0d29456</code></a>
release(openai): 1.7.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41506 ">#41506</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8635846e620acc59ca0273944eaef2f4889452a3 "><code>8635846</code></a>
chore(model-profiles): refresh openai model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41505 ">#41505</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.5...langchain-core==1.7.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest` from 9.1.1 to 9.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases ">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.2.0</h2>
<h1>pytest 9.2.0 (2026-10-27)</h1>
<h2>Removals and backward incompatible breaking changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14716 ">#14716</a>:
<code>-c</code> now raises a usage error for a path that does not exist,
is a directory, or is in a format pytest has no loader for. Such paths
were previously either ignored or reported as an unhandled
<code>FileNotFoundError</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/8593 ">#8593</a>:
The <code>indirect</code>, <code>ids</code> and <code>scope</code>
arguments of <code>Metafunc.parametrize()
<pytest.Metafunc.parametrize></code> -- and therefore of
<code>@pytest.mark.parametrize <pytest.mark.parametrize
ref></code> -- are now keyword-only.</p>
<p>Passing them positionally was a common source of confusing errors,
e.g. <code>parametrize("arg1", "arg2", [(1,
2)])</code> made the argvalues land in <code>indirect</code> and failed
with <code>indirect fixture '(1, 2)' doesn't exist</code>; such mistakes
now fail with an understandable <code>TypeError</code>. The type
annotations have always declared these arguments as keyword-only.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/993 ">#993</a>:
Plugin import failures at startup are now reported and classified
instead of escaping as a raw traceback with the accidental exit code
<code>1</code>:</p>
<ul>
<li>a plugin that cannot be found -- via <code>-p</code>,
<code>pytest_plugins</code> or <code>PYTEST_PLUGINS</code> -- exits with
<code>pytest.ExitCode</code> <code>USAGE_ERROR</code> (<code>4</code>),
like a <code>conftest.py</code> that fails to import;</li>
<li>a plugin that is found but raises while importing -- including a
broken <code>pytest11</code> entry point or a missing plugin dependency
-- exits with <code>pytest.ExitCode</code> <code>INTERNAL_ERROR</code>
(<code>3</code>), with the traceback preserved.</li>
</ul>
<p><code>pytest.main</code> now returns these codes instead of raising
<code>ImportError</code>. Also fixed an <code>IndexError</code> from
pytest's own internals when the plugin raised an exception with no
arguments.</p>
</li>
</ul>
<h2>Deprecations (removal in next major release)</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14742 ">#14742</a>:
The private <code>_pytest.python.CallSpec2</code> name has been renamed
to <code>CallSpec</code>.
The old <code>CallSpec2</code> alias remains available for now and will
be removed in pytest 10 or 11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14755 ">#14755</a>:
Schedule <em>yield_fixture</em> decorator for removal in pytest 10 or
11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14774 ">#14774</a>:
Similarly to the deprecation of class-scoped fixtures defined as
instance methods in pytest 9.1,
<em>all</em> higher-scoped fixtures (<code>module</code>,
<code>package</code>, and <code>session</code>) defined
as instance methods are now deprecated.</p>
<p>They suffer from the same issue the original deprecation only fixed
for
class-scoped fixtures, see <code>10819</code> and
<code>14011</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14808 ">#14808</a>:
Passing a non-string value to a <code>string</code>-typed ini option now
emits a <code>pytest.PytestRemovedIn10Warning</code>. This affects
<code>[tool.pytest.ini_options]</code> in <code>pyproject.toml</code>.
In pytest 10 this will raise a <code>TypeError</code>, matching the
behavior of the corresponding TOML config path.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/7323 ">#7323</a>:
Passing <code>bytes</code> to <code>TerminalReporter.write_line()</code>
is now deprecated, pass a <code>str</code> instead.</p>
</li>
</ul>
<h2>New features</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14743 ">#14743</a>:
<!-- raw HTML omitted -->Full diff:<!-- raw HTML omitted --> now
contains a legend explaining the <!-- raw HTML omitted -->+<!-- raw HTML
omitted --> & <!-- raw HTML omitted -->-<!-- raw HTML omitted -->
symbols in diff output.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/2781 ">#2781</a>:
When <code>strict_markers</code> is enabled, marker names used in
<code>-m</code> expressions are now validated against registered
markers.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/6881 ">#6881</a>:
Added the <code>parametrize_long_str_id_strategy</code> configuration
option to control how long <code>str</code>/<code>bytes</code> parameter
values are handled in auto-generated test IDs. Explicit IDs set via
<code>ids=[...]</code> or <code>pytest.param(..., id=...)</code> are not
affected. Available strategies: <code>short</code> (default, values over
100 chars fall back to <code>argname+index</code>), <code>sha256</code>
(SHA-256 hex digest), <code>legacy</code> (keep full value), and
<code>disallow</code> (error requesting explicit IDs).</li>
</ul>
<h2>Improvements in existing functionality</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/10745 ">#10745</a>:
A <code>RecursionError</code> whose recursion origin cannot be located
now shows only the
first and last 10 stack frames, matching what pytest already did when
locating
the origin failed outright. Previously the full traceback -- often
around a
thousand near-identical frames -- was rendered, which was both slow and
unreadable. Pass <code>--full-trace</code> to see every frame.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae1d0ff57b8bd4252da9ade7353523ac0ac73281 "><code>ae1d0ff</code></a>
Prepare release version 9.2.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/143ce31dea9b12ff2ab6add04361ee01ab114931 "><code>143ce31</code></a>
pre-commit: exclude codespell on generated release announcements</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/532dc5fc78f57de5115c5ecc9c6c29257787ada7 "><code>532dc5f</code></a>
tox: add attrs dependency to regen, needed in reportingdemo.rst</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a7b2446ee41a7298d3a0bc22c52f3b8bacae1566 "><code>a7b2446</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15245 ">#15245</a>
from pytest-dev/claude/project-thread-9jcf91</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/679d09c6945156746e17e9ec0b1c8309bbde3ad3 "><code>679d09c</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/15266 ">#15266</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/41d12cdbb4a35a7877768d93d8dc50a9117a8d8c "><code>41d12cd</code></a>
docs: clarify typing for yield fixtures</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/b9022ba04a33bfc76b5c9aefb8974755a80bf5ce "><code>b9022ba</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15182 ">#15182</a>
from 1871698/docs/improve-getting-started-description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/16f87a7f364a7362fbfbb204c79a47ad567b4fbd "><code>16f87a7</code></a>
docs: improve getting-started.rst test execution description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/082ed70e314ee8e1ab117763d17fe801648f7508 "><code>082ed70</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15255 ">#15255</a>
from pytest-dev/claude/project-thread-eoi3d6</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae37a013763e9c4a143245eda1acdc3c27961685 "><code>ae37a01</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15227 ">#15227</a>
from pytest-dev/claude/project-thread-4etye4</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-asyncio` from 1.4.0 to 1.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-asyncio/releases ">pytest-asyncio's
releases</a>.</em></p>
<blockquote>
<h2>pytest-asyncio v1.4.1</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.1 ">1.4.1</a>
- 2026-10-25</h1>
<h2>Added</h2>
<ul>
<li>Declared support for Python 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Allow <em>AsyncIterable</em> as a return type for asynchronous
generator fixtures decorated with <em>pytest_asyncio.fixture</em> (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1090 ">#1090</a>)</li>
</ul>
<h2>Notes for Downstream Packagers</h2>
<ul>
<li>Source-tree development dependencies now use PEP 735 dependency
groups and <code>uv.lock</code>. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1518 ">#1518</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/6af7f5c9a8c77fe5040b9d368b9ed01837c25652 "><code>6af7f5c</code></a>
chore: Prepare release of v1.4.1.</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/32ccf64ec115e42543bddb8cd142b2026b0cab77 "><code>32ccf64</code></a>
Support 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/983007120dcc53b14f8f7e9df492cbd1d20a242c "><code>9830071</code></a>
Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1590 ">#1590</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/0238023e439113044a9ed095307884c774ec9e46 "><code>0238023</code></a>
Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1589 ">#1589</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/93893ecd9447d105ebd56419bc5162aa2420587e "><code>93893ec</code></a>
Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/f287e5e0f5425380b24c32b64037dfb2ed3cb937 "><code>f287e5e</code></a>
Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1581 ">#1581</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b71da4fe09265e1ad86d4cbfc452b590ebfc4daa "><code>b71da4f</code></a>
Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1582 ">#1582</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/d8c51d8990a4bbdf8a19ff0cf80d68b95b11dea8 "><code>d8c51d8</code></a>
Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b12808bd8d061b583ccdddc53ad6c85198509eed "><code>b12808b</code></a>
Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1578 ">#1578</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/e0601f0ce9532de0b5453a5cfd08f25b258a93f5 "><code>e0601f0</code></a>
Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1577 ">#1577</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-asyncio/compare/v1.4.0...v1.4.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.16.0 to 3.17.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.17.0</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/641 ">#641</a>:
Failures of mock assertions such as <code>assert_called_with</code> are
again reported only once, instead of two or three times with the
original error from the <code>mock</code> module chained before
them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/642 ">#642</a>:
Mock assertion failures no longer show misleading introspection when
they are not about the arguments of the last call:
<code>assert_called</code>, <code>assert_called_once</code>,
<code>assert_not_called</code>, <code>assert_any_call</code>, their
<code>await</code> counterparts, and
<code>assert_called_once_with</code>/<code>assert_awaited_once_with</code>
when the mock was not called (awaited) exactly once. The introspection
also no longer reports arguments passed by position versus by keyword as
different for autospecced mocks, and no longer shows empty
<code>Args:</code>/<code>Kwargs:</code> sections when assertion
rewriting is not available.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/643 ">#643</a>:
<code>assert_has_calls</code> and <code>assert_has_awaits</code>
failures no longer show pytest introspection, which compared the
expected and actual calls position by position and so reported
differences between unrelated calls. The mock's own message, listing the
expected and actual calls, is still shown.</li>
</ul>
<h2>v3.16.1</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/617 ">#617</a>:
Fixed <code>assert_has_calls</code> raising <code>ValueError</code>
instead of <code>AssertionError</code> (or showing misleading
introspection) when the expected calls are plain tuples rather than
<code>call(...)</code> objects, such as <code>(args, kwargs)</code>
entries of another mock's <code>call_args_list</code>,
<code>(args,)</code>, <code>(kwargs,)</code>, <code>(name, args)</code>
or <code>(name, kwargs)</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/621 ">#621</a>:
Fixed <code>mocker.stop()</code> sometimes stopping the wrong mock, for
example with mocks from <code>mocker.create_autospec</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/621 ">#621</a>:
<code>mocker.stop()</code> now undoes the most recent patch first when
the same object is used in several patches.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/623 ">#623</a>:
Fixed misleading introspection in <code>assert_has_awaits</code>
failures, and
<code>assert_has_calls</code>/<code>assert_has_awaits</code> raising
<code>IndexError</code> instead of <code>AssertionError</code> when
<code>calls</code> is passed by keyword.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/624 ">#624</a>:
Clear <code>spy_return_iter</code> after a spied synchronous or
asynchronous function raises, matching <code>spy_return</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/627 ">#627</a>:
Document <code>async_stub</code> await assertions and the distinction
between call and await tracking.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/629 ">#629</a>:
Fixed <code>mocker.resetall()</code> skipping the mocks patched with
<code>mocker.patch.multiple()</code>, both the ones it creates and the
ones passed explicitly.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/630 ">#630</a>:
<code>mocker.resetall()</code> now also resets <code>spy_return</code>
and <code>spy_exception</code> of spies, like it already did for
<code>spy_return_list</code> and <code>spy_return_iter</code>, and no
longer overwrites attributes with these names on mocks that are not
spies.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/633 ">#633</a>:
Fixed spies on <code>classmethod</code>, <code>staticmethod</code>,
builtins and classes returning a <code>MagicMock</code> instead of
calling the spied code after
<code>mocker.resetall(side_effect=True)</code>. Resetting a spy's
<code>side_effect</code> now goes back to calling the spied code, also
clearing any <code>side_effect</code> set on the spy.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.17.0</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><code>[#641 ](https://github.com/pytest-dev/pytest-mock/issues/641 )
<https://github.com/pytest-dev/pytest-mock/pull/641> ;</code>_:
Failures of mock assertions such as <code>assert_called_with</code> are
again reported only once, instead of two or three times with the
original error from the <code>mock</code> module chained before
them.</li>
<li><code>[#642 ](https://github.com/pytest-dev/pytest-mock/issues/642 )
<https://github.com/pytest-dev/pytest-mock/pull/642> ;</code>_: Mock
assertion failures no longer show misleading introspection when they are
not about the arguments of the last call: <code>assert_called</code>,
<code>assert_called_once</code>, <code>assert_not_called</code>,
<code>assert_any_call</code>, their <code>await</code> counterparts, and
<code>assert_called_once_with</code>/<code>assert_awaited_once_with</code>
when the mock was not called (awaited) exactly once. The introspection
also no longer reports arguments passed by position versus by keyword as
different for autospecced mocks, and no longer shows empty
<code>Args:</code>/<code>Kwargs:</code> sections when assertion
rewriting is not available.</li>
<li><code>[#643 ](https://github.com/pytest-dev/pytest-mock/issues/643 )
<https://github.com/pytest-dev/pytest-mock/pull/643> ;</code>_:
<code>assert_has_calls</code> and <code>assert_has_awaits</code>
failures no longer show pytest introspection, which compared the
expected and actual calls position by position and so reported
differences between unrelated calls. The mock's own message, listing the
expected and actual calls, is still shown.</li>
</ul>
<h2>3.16.1</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><code>[#617 ](https://github.com/pytest-dev/pytest-mock/issues/617 )
<https://github.com/pytest-dev/pytest-mock/pull/617> ;</code>_:
Fixed <code>assert_has_calls</code> raising <code>ValueError</code>
instead of <code>AssertionError</code> (or showing misleading
introspection) when the expected calls are plain tuples rather than
<code>call(...)</code> objects, such as <code>(args, kwargs)</code>
entries of another mock's <code>call_args_list</code>,
<code>(args,)</code>, <code>(kwargs,)</code>, <code>(name, args)</code>
or <code>(name, kwargs)</code>.</li>
<li><code>[#621 ](https://github.com/pytest-dev/pytest-mock/issues/621 )
<https://github.com/pytest-dev/pytest-mock/pull/621> ;</code>_:
Fixed <code>mocker.stop()</code> sometimes stopping the wrong mock, for
example with mocks from <code>mocker.create_autospec</code>.</li>
<li><code>[#621 ](https://github.com/pytest-dev/pytest-mock/issues/621 )
<https://github.com/pytest-dev/pytest-mock/pull/621> ;</code>_:
<code>mocker.stop()</code> now undoes the most recent patch first when
the same object is used in several patches.</li>
<li><code>[#623 ](https://github.com/pytest-dev/pytest-mock/issues/623 )
<https://github.com/pytest-dev/pytest-mock/pull/623> ;</code>_:
Fixed misleading introspection in <code>assert_has_awaits</code>
failures, and
<code>assert_has_calls</code>/<code>assert_has_awaits</code> raising
<code>IndexError</code> instead of <code>AssertionError</code> when
<code>calls</code> is passed by keyword.</li>
<li><code>[#624 ](https://github.com/pytest-dev/pytest-mock/issues/624 )
<https://github.com/pytest-dev/pytest-mock/pull/624> ;</code>_:
Clear <code>spy_return_iter</code> after a spied synchronous or
asynchronous function raises, matching <code>spy_return</code>.</li>
<li><code>[#627 ](https://github.com/pytest-dev/pytest-mock/issues/627 )
<https://github.com/pytest-dev/pytest-mock/pull/627> ;</code>_:
Document <code>async_stub</code> await assertions and the distinction
between call and await tracking.</li>
<li><code>[#629 ](https://github.com/pytest-dev/pytest-mock/issues/629 )
<https://github.com/pytest-dev/pytest-mock/pull/629> ;</code>_:
Fixed <code>mocker.resetall()</code> skipping the mocks patched with
<code>mocker.patch.multiple()</code>, both the ones it creates and the
ones passed explicitly.</li>
<li><code>[#630 ](https://github.com/pytest-dev/pytest-mock/issues/630 )
<https://github.com/pytest-dev/pytest-mock/pull/630> ;</code>_:
<code>mocker.resetall()</code> now also resets <code>spy_return</code>
and <code>spy_exception</code> of spies, like it already did for
<code>spy_return_list</code> and <code>spy_return_iter</code>, and no
longer overwrites attributes with these names on mocks that are not
spies.</li>
<li><code>[#633 ](https://github.com/pytest-dev/pytest-mock/issues/633 )
<https://github.com/pytest-dev/pytest-mock/pull/633> ;</code>_:
Fixed spies on <code>classmethod</code>, <code>staticmethod</code>,
builtins and classes returning a <code>MagicMock</code> instead of
calling the spied code after
<code>mocker.resetall(side_effect=True)</code>. Resetting a spy's
<code>side_effect</code> now goes back to calling the spied code, also
clearing any <code>side_effect</code> set on the spy.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/5c2f207ca7098dde996f9bedd06e596e39b6246b "><code>5c2f207</code></a>
Release 3.17.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/96252715fad4a0dfec1997103cc231bc1f133616 "><code>9625271</code></a>
Bump the minor version for releases that change existing behavior</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/34b87aeeef1d2a85be5ce4fadb0c6bc4a033c40a "><code>34b87ae</code></a>
Drop introspection from assert_has_calls and assert_has_awaits (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/643 ">#643</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/866520f2d339c7649af56ac227ca67ed36b1e92e "><code>866520f</code></a>
Only show introspection for failures about the call arguments (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/642 ">#642</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/5ab41c143c57842456caad0029082e919fa6a95d "><code>5ab41c1</code></a>
Do not chain the original mock error to wrapped assertion failures (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/641 ">#641</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/1916b14db224b893edf18251f26a38487eb0d6a6 "><code>1916b14</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/635 ">#635</a>
from nicoddemus/docs-contributing-resetall</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/212fcd903aeb685a3b39875be82fc84ff58ebc56 "><code>212fcd9</code></a>
Document resetall, the changelog format and running tests with tox</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9374b2c3e38e3bbc2e04328f7026ae3680f0476f "><code>9374b2c</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/634 ">#634</a>
from pytest-dev/release-3.16.1</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/fab730daf4a4cfc260d8656b0467503131535a00 "><code>fab730d</code></a>
Release 3.16.1</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/d26d41bb01e99de5c0b59156c667d46985b03470 "><code>d26d41b</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/627 ">#627</a>
from xiehuanyi/docs/async-stub-awaits-20261012-r2</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.16.0...v3.17.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.9 to 0.17.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>Install ruff 0.17.3</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.17.3</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz ">ruff-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz ">ruff-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip ">ruff-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>0.17.2</h2>
<p>Released on 2026-10-22.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>complexity</code>] Add
<code>unnecessary-regular-expression-compile</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25533 ">#25533</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Avoid syntax errors for type variables with starred constraints
(<code>UP040</code>, <code>UP046</code>, <code>UP047</code>,
<code>RUF053</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28362 ">#28362</a>)</li>
<li>[<code>pydocstyle</code>] Treat backslash-escaped <code>*args</code>
and <code>**kwargs</code> as documented (<code>D417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29536 ">#29536</a>)</li>
<li>[<code>pylint</code>] Avoid false positive on starred elements
(<code>PLE0643</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29483 ">#29483</a>)</li>
<li>[<code>pylint</code>] Mark fixes unsafe when deleting comments
(<code>PLR5501</code>, <code>PLW0120</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29414 ">#29414</a>)</li>
<li>[<code>pyupgrade</code>] Mark fix unsafe when deleting comments
(<code>UP035</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29413 ">#29413</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid intermediate names in lint name resolution (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29506 ">#29506</a>)</li>
<li>Prefilter bidirectional Unicode checks by UTF-8 leading bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29561 ">#29561</a>)</li>
<li>Share postfix parsing and reduce expression copies (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29480 ">#29480</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/ba65abf8ba7bfbcc059f7fb9712be5ba9cab6abc "><code>ba65abf</code></a>
Bump version to 0.17.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29745 ">#29745</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/fb2f9218793e3b0e979175d43d88dcac791e92d6 "><code>fb2f921</code></a>
[ty] Fix narrowing of strings and integers compared with enum members
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29743 ">#29743</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d1812878d5f81af6f5810d193ebc44413d1b21cc "><code>d181287</code></a>
[ty] Index nominal union alternatives (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29196 ">#29196</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/07872adbafa7c00f42f1174d8aa3c3e324033009 "><code>07872ad</code></a>
[ty] Preserve string literals in comparisons with
<code>LiteralString</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29741 ">#29741</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/95888b2edfaa34d0159732856b1466cf53b33e64 "><code>95888b2</code></a>
[ty] Preserve narrowing after guarded match subject captures (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29558 ">#29558</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3c8166b683805aa89557b0739f5b9918ad58ea6d "><code>3c8166b</code></a>
[ty] Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29652 ">#29652</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3fd20e08598ac345b8afd524d3f7086456e4e758 "><code>3fd20e0</code></a>
[ty] Preserve generic callback specializations during return refinement
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29667 ">#29667</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2f0a29ece1f1a539c65c0671c04c76bb886219fe "><code>2f0a29e</code></a>
[ty] Record predicate truthiness alongside expression inference (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29706 ">#29706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/60f104a1a2ec4e980198ff54c38ba6fe7045b29f "><code>60f104a</code></a>
[ty] Honor <a
href="https://github.com/override "><code>@override</code></a> on
overload implementations in stubs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29470 ">#29470</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/207ec3affeb118fce03a65f9333959157e228312 "><code>207ec3a</code></a>
[ty] Add diagnostic baseline support (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27636 ">#27636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.9...0.17.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.84 to 0.0.94
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>Install ty 0.0.94</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.ps1
| iex"
</code></pre>
<h2>Download ty 0.0.94</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz ">ty-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz ">ty-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip ">ty-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip ">ty-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip ">ty-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz ">ty-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz ">ty-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz ">ty-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>0.0.93</h2>
<p>Released on 2026-10-28.</p>
<h3>Preview features</h3>
<ul>
<li>
<p>Add diagnostic baselines to help adopt ty in projects with existing
errors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27636 ">#27636</a>).
Configure a baseline in <code>pyproject.toml</code>:</p>
<pre lang="toml"><code>[tool.ty]
baseline = "ty-baseline.json"
</code></pre>
<p>Run <code>ty check --update-baseline</code> to record existing
diagnostics. Subsequent checks filter matching diagnostics from CLI
output and show them as hints in the language server. The baseline
format may change while the feature is in preview.</p>
</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix a panic when checking truthiness in a loop (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29759 ">#29759</a>)</li>
<li>Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29652 ">#29652</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid synthesizing primary keys for abstract Django models (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29744 ">#29744</a>)</li>
<li>Combine constraints from repeated <code>ParamSpec</code>s (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29172 ">#29172</a>)</li>
<li>Fix narrowing of strings and integers compared with enum members (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29743 ">#29743</a>)</li>
<li>Honor <code>@override</code> on overload implementations in stubs
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29470 ">#29470</a>)</li>
<li>Preserve caller type variables in nested union inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29611 ">#29611</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/f8ea270e0b125116ce52868b16384819183056af "><code>f8ea270</code></a>
Bump version to 0.0.94 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4857 ">#4857</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/7a36fc91318b07a58d0aa27753db4db1d212032a "><code>7a36fc9</code></a>
Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/issues/4853 ">#4853</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3db5e4df7becd3ca55fd06c78e98bf7c8a38e469 "><code>3db5e4d</code></a>
Bump version to 0.0.93 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4842 ">#4842</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f8fd0e8b5ce954b5a7f4e38431d805dd58e50e2d "><code>f8fd0e8</code></a>
Update astral-sh/setup-uv action to v10.3.2 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4843 ">#4843</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/c1ca420006c7e5ef62ddfa16267fd7531a0a1000 "><code>c1ca420</code></a>
Update uv to v0.13.6 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4845 ">#4845</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c5c9079ac053fa3f879ee7625ec5c28a0817de4 "><code>4c5c907</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4844 ">#4844</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/0445d6497ae22a0c480b23807cd71f47889053d8 "><code>0445d64</code></a>
Optimize Linux x86-64 ty releases with LLVM BOLT (<a
href="https://redirect.github.com/astral-sh/ty/issues/4833 ">#4833</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3933e6918b731d86b3f3a4f1bc47f2ce21195e8e "><code>3933e69</code></a>
Bump version to 0.0.92 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4821 ">#4821</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9aaec9ba5896c759e8e93000d0a1dec51f2bae57 "><code>9aaec9b</code></a>
Handle AI policy labels through Actions (<a
href="https://redirect.github.com/astral-sh/ty/issues/4812 ">#4812</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/e1b8efaafd842d3e33c1a21ae7e897434452975b "><code>e1b8efa</code></a>
Update uv to 0.13.5 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4809 ">#4809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.84...0.0.94 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:41 -08:00
dependabot[bot]
f8812e50a5
chore(deps-dev): bump pycryptodome from 3.23.0 to 4.2.0 in /libs/checkpoint in the major group ( #9531 )
...
Bumps the major group in /libs/checkpoint with 1 update:
[pycryptodome](https://github.com/Legrandin/pycryptodome ).
Updates `pycryptodome` from 3.23.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/releases ">pycryptodome's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0 - Jura</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<h2>v4.1.0 - Issy-les-Moulineaux</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version compiled for them and with 4-way SHA-3 is used: compared
to the portable version, key generation and verification are 30-45%
faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204), hedged (default) or deterministic,
with an optional context. The new <code>MLDSAMuHash</code> computes the
message representative mu (external mu), to sign or verify a large
message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes, to hash a whole message with a single call, like
<code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up to 1
KiB, it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane
at a time, two rounds per iteration, which needs fewer registers: SHA-3
and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8 <code>OneAsymmetricKey</code> version
2 (RFC 5958), if present, matches the private key. Before, it was
ignored.</li>
</ul>
<h2>v4.0.1 - Le Havre</h2>
<h2>New features</h2>
<ul>
<li>The Windows wheels for x86-64 are built with <code>clang-cl</code>
(compatible with MSVC), so the
code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and
the other
Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big
integers of RSA,
DSA and the NIST curves. To build from source with
<code>clang-cl</code>, set the environment
variable <code>PYCRYPTODOME_CLANG_CL</code> (see the installation
instructions).</li>
</ul>
<h2>v4.0.0 - Grenoble</h2>
<p>Major release, with some breaking changes. See Changelog.</p>
<h2>v3.24.1 - Frejus</h2>
<h2>Resolved issues</h2>
<ul>
<li>Security: the time to create an ECDSA, EdDSA or DSA signature
depended
on the secret nonce, enough to recover the private key with a lattice
attack.
DSA signing is now about 40% slower with GMP. Thanks to Daniel
Bleichenbacher.</li>
</ul>
<h2>v3.24.0 - Evreux</h2>
<p>New features</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst ">pycryptodome's
changelog</a>.</em></p>
<blockquote>
<p>4.2.0 (24 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<p>4.1.0 (19 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version
compiled for them and with 4-way SHA-3 is used: compared to the portable
version,
key generation and verification are 30-45% faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204),
hedged (default) or deterministic, with an optional context.
The new <code>MLDSAMuHash</code> computes the message representative mu
(external mu),
to sign or verify a large message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes,
to hash a whole message with a single call,
like <code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up
to 1 KiB,
it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE
and KangarooTwelve) processes the state one plane at a time, two rounds
per iteration,
which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8
<code>OneAsymmetricKey</code> version 2 (RFC 5958), if present, matches
the private key.
Before, it was ignored.</li>
</ul>
<p>4.0.1 (17 October 2026)
++++++++++++++++++++++++++</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/fba5867dc8f46e1100b2b9438e0ca7c09f0d5fa7 "><code>fba5867</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/52a8ff62cff5c390091ef30834bc7ae8f1a4f7eb "><code>52a8ff6</code></a>
Fix PyPy wheels on Windows with setuptools 84.2</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/5a6f04770d72ed158b4157847de39b0a93728479 "><code>5a6f047</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9865be1158315cf7b4d077437b4a90d6c8086b11 "><code>9865be1</code></a>
Don't run portable python with cffi</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9c642f06a8220387a3381d745abdfb2d1e483e61 "><code>9c642f0</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c40f64ba91b54e225740f11de6e3014dacd25d49 "><code>c40f64b</code></a>
Merge branch 'mlkem_import_export'</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/e9f74ecfca36e4b4b79ece354388b51d31f2f489 "><code>e9f74ec</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/83f1406ad321158c6f3a7a85e95c21e38f99f68e "><code>83f1406</code></a>
Fix icons</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/00f2277e648334c1e42d41cc7c85cf7d17f14e0a "><code>00f2277</code></a>
Add logo</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c4b4328c5218f1cf9c5de722b1cefad3db582a30 "><code>c4b4328</code></a>
Fix docs</li>
<li>Additional commits viewable in <a
href="https://github.com/Legrandin/pycryptodome/compare/v3.23.0...v4.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:19 -08:00
dependabot[bot]
5608dfb71e
chore(deps-dev): bump pycryptodome from 3.23.0 to 4.2.0 in /libs/langgraph in the major group ( #9534 )
...
Bumps the major group in /libs/langgraph with 1 update:
[pycryptodome](https://github.com/Legrandin/pycryptodome ).
Updates `pycryptodome` from 3.23.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/releases ">pycryptodome's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0 - Jura</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<h2>v4.1.0 - Issy-les-Moulineaux</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version compiled for them and with 4-way SHA-3 is used: compared
to the portable version, key generation and verification are 30-45%
faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204), hedged (default) or deterministic,
with an optional context. The new <code>MLDSAMuHash</code> computes the
message representative mu (external mu), to sign or verify a large
message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes, to hash a whole message with a single call, like
<code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up to 1
KiB, it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane
at a time, two rounds per iteration, which needs fewer registers: SHA-3
and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8 <code>OneAsymmetricKey</code> version
2 (RFC 5958), if present, matches the private key. Before, it was
ignored.</li>
</ul>
<h2>v4.0.1 - Le Havre</h2>
<h2>New features</h2>
<ul>
<li>The Windows wheels for x86-64 are built with <code>clang-cl</code>
(compatible with MSVC), so the
code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and
the other
Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big
integers of RSA,
DSA and the NIST curves. To build from source with
<code>clang-cl</code>, set the environment
variable <code>PYCRYPTODOME_CLANG_CL</code> (see the installation
instructions).</li>
</ul>
<h2>v4.0.0 - Grenoble</h2>
<p>Major release, with some breaking changes. See Changelog.</p>
<h2>v3.24.1 - Frejus</h2>
<h2>Resolved issues</h2>
<ul>
<li>Security: the time to create an ECDSA, EdDSA or DSA signature
depended
on the secret nonce, enough to recover the private key with a lattice
attack.
DSA signing is now about 40% slower with GMP. Thanks to Daniel
Bleichenbacher.</li>
</ul>
<h2>v3.24.0 - Evreux</h2>
<p>New features</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst ">pycryptodome's
changelog</a>.</em></p>
<blockquote>
<p>4.2.0 (24 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<p>4.1.0 (19 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version
compiled for them and with 4-way SHA-3 is used: compared to the portable
version,
key generation and verification are 30-45% faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204),
hedged (default) or deterministic, with an optional context.
The new <code>MLDSAMuHash</code> computes the message representative mu
(external mu),
to sign or verify a large message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes,
to hash a whole message with a single call,
like <code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up
to 1 KiB,
it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE
and KangarooTwelve) processes the state one plane at a time, two rounds
per iteration,
which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8
<code>OneAsymmetricKey</code> version 2 (RFC 5958), if present, matches
the private key.
Before, it was ignored.</li>
</ul>
<p>4.0.1 (17 October 2026)
++++++++++++++++++++++++++</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/fba5867dc8f46e1100b2b9438e0ca7c09f0d5fa7 "><code>fba5867</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/52a8ff62cff5c390091ef30834bc7ae8f1a4f7eb "><code>52a8ff6</code></a>
Fix PyPy wheels on Windows with setuptools 84.2</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/5a6f04770d72ed158b4157847de39b0a93728479 "><code>5a6f047</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9865be1158315cf7b4d077437b4a90d6c8086b11 "><code>9865be1</code></a>
Don't run portable python with cffi</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9c642f06a8220387a3381d745abdfb2d1e483e61 "><code>9c642f0</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c40f64ba91b54e225740f11de6e3014dacd25d49 "><code>c40f64b</code></a>
Merge branch 'mlkem_import_export'</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/e9f74ecfca36e4b4b79ece354388b51d31f2f489 "><code>e9f74ec</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/83f1406ad321158c6f3a7a85e95c21e38f99f68e "><code>83f1406</code></a>
Fix icons</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/00f2277e648334c1e42d41cc7c85cf7d17f14e0a "><code>00f2277</code></a>
Add logo</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c4b4328c5218f1cf9c5de722b1cefad3db582a30 "><code>c4b4328</code></a>
Fix docs</li>
<li>Additional commits viewable in <a
href="https://github.com/Legrandin/pycryptodome/compare/v3.23.0...v4.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:47:40 -08:00
dependabot[bot]
ab350fd5a4
chore(deps): bump langgraph-sdk from 0.4.5 to 0.4.6 in /libs/cli ( #9514 )
...
Bumps [langgraph-sdk](https://github.com/langchain-ai/langgraph ) from
0.4.5 to 0.4.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.6</h2>
<p>Changes since sdk==0.4.5</p>
<ul>
<li>release(sdk-py): 0.4.6 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9214 ">#9214</a>)</li>
<li>fix(sdk-py): percent-encode thread_id and assistant_id in thread
stream requests (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9213 ">#9213</a>)</li>
<li>release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li>chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5
updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9149 ">#9149</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9134 ">#9134</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/ade3f372a5be9e9e9b52db22f128fc501fb72e3d "><code>ade3f37</code></a>
0.4.6</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/bece43dc67024bcd0d4d7649323df3104f56949c "><code>bece43d</code></a>
Fix</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/913b8d5e9547d78523e75304d473555d7347546f "><code>913b8d5</code></a>
Lint</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3c0d9346c278f628ad1b340f4579eef63e08dda6 "><code>3c0d934</code></a>
Add sync test</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/0ebb78d9b202782d65da35e03619c9f65e19d532 "><code>0ebb78d</code></a>
Fix</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/70153ceba22013d34b51317cd76c976a62af80cb "><code>70153ce</code></a>
Fix exception handling for imperative tasks</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/a9c87ed8b64efc6152b4b86a014d2f4cd327cae1 "><code>a9c87ed</code></a>
prebuilt: release 0.2.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4801 ">#4801</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/837fe59e243aa51a7ac361c3cb4cc53d8e542c68 "><code>837fe59</code></a>
prebuilt: support provider builtin tools in
<code>create_react_agent</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4800 ">#4800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/aff3be03dcd5b8ce0fdebde71997295e87b96f61 "><code>aff3be0</code></a>
prebuilt: release 0.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4793 ">#4793</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/10c6ed73205f23cf134833b6f4e56cd4e38de8f0 "><code>10c6ed7</code></a>
Code review</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.5...0.4.6 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:46:09 -08:00
hari-dhanushkodi
e5c961d7fb
fix(cli): remove outdated deploy private-beta notice ( #9506 )
2026-10-30 20:26:39 -04:00
Elior Nataf Lackritz
5bd231cbfd
release(langgraph): 1.2.19 ( #9504 )
...
Bumps langgraph from 1.2.18 to 1.2.19.
Includes:
- List a `ToolNode`'s tool names in its `get_graph()` node metadata
(#9449 )
- Apply a node's `trace_policy` to tracers only, so it no longer changes
what streams see (#9486 )
- Give `messages` and `tools` events the namespace of the graph they ran
in (#9458 )
- Stream messages a node returns from a graph streamed inside another
node (#9463 )
- Respect `subgraphs=False` in `RemoteGraph.stream` when the parent
streams subgraphs (#9453 )
- Stop reporting a tool paused on `interrupt()` as failed on the `tools`
stream (#9406 )
- Return an awaited `@task`'s value while streaming instead of `None`
(#9407 )
2026-10-30 18:14:31 -04:00
Elior Nataf Lackritz
3eaf06c67c
release(checkpoint-sqlite): 3.1.3 ( #9505 )
...
Bumps langgraph-checkpoint-sqlite from 3.1.2 to 3.1.3.
Includes:
- Require `langgraph-checkpoint>=4.3.1`, which rejects NUL bytes in
namespace labels (#9383 )
`checkpoint==4.3.1` is already on PyPI.
2026-10-30 18:14:27 -04:00
Elior Nataf Lackritz
6fab323753
release(sdk-py): 0.4.11 ( #9503 )
...
Bumps the Python SDK version from 0.4.10 to 0.4.11.
Includes:
- Reset the reconnect cursor on every empty SSE `id`, including a
`Last-Event-ID` the caller passed in (#9440 )
- Let `Auth.on()` type-check with no resources or `resources=None`
(#9450 )
- Retry a stream reconnect that fails to open (429, 5xx, transport
error) with backoff (#9462 )
- Keep SSE data and cursor state across chunks (#9477 )
- Retry `runs.wait`, `runs.join` and `runs.cancel(wait=True)` reconnects
with backoff (#9481 )
- Warn when a stream reconnects without a `Last-Event-ID` (#9482 )
2026-10-30 18:14:22 -04:00
Elior Nataf Lackritz
8d5637b2dd
fix(langgraph): keep trace_policy from rewriting streamed node payloads ( #9486 )
...
A node's `trace_policy` was applied to every callback handler on the
node's run, not only to tracers. `RunnableSeq` passed the processed
input and output to `on_chain_start` and `on_chain_end`, so LangGraph's
stream handlers received them too. With `process_outputs=omit_payload`,
messages a node returned never reached `stream_mode="messages"`. With
`process_inputs=omit_payload`, messages a node passed through were
emitted again, because the dedupe never saw them. `astream_events`
reported the node's input and output as `{}`.
`RunnableSeq` now takes the `TracePolicy` itself, in place of
`trace_outputs`, and `PregelNode` passes it there instead of through
`trace_inputs` and `trace_outputs`. When the policy changes the payload,
the run's start and end events go out in two dispatches under one run
id: tracers (`BaseTracer` handlers, `LangChainTracer` included) get the
processed payload, and every other handler gets the real one: the stream
handlers behind the `messages` and `tools` stream modes,
`astream_events` and `astream_log`, and any handler a user adds. Tracers
never receive the unprocessed payload, at start, where `LangChainTracer`
posts the run, or at end. Integrations whose handlers are not
`BaseTracer`s, such as Langfuse's or MLflow's, now get the real payload
too, since the policy exists to keep tracer ingest small. As before, a
processor that raises is logged and the raw payload is recorded. Child
runs still attach to the node's run, since both dispatches use the same
run id and children inherit every handler. Tracers get the end first;
langchain-core shields each `on_chain_end` dispatch once it starts, so a
cancellation can only skip the other handlers' end, never the tracers'.
Errors still reach every handler in one dispatch. With no policy, or a
processor that returns the same object it was given (like the
pass-through policy `create_agent` puts on middleware nodes), every
handler gets the payload in one dispatch, as before. `trace_inputs` is
unchanged; the functional API uses it so every handler, `astream_events`
included, sees `@task` arguments by name.
LangGraph now decides what a stream handler is in one place, by
inheritance from `_StreamingCallbackHandler`: the payload split, the
output taps in `RunnableSeq.stream` and `astream`, and Pregel's choice
to run nodes with `astream` all use it. A handler that only defines the
tap methods used to be tapped and saw the node's raw streamed output; it
no longer gets the taps.
Three new tests in `tests/test_trace_policy.py` run a node that calls a
chat model under a policy and a `FakeTracer`, through sync `stream` and
async `astream` with `stream_mode="messages"`, and through
`astream_events`. The two `messages` tests check that the node's own
message is streamed and the passed-through input is not re-emitted; the
`astream_events` test checks that the node's start and end events carry
the real input and output. All three check that the tracer's node run
holds exactly what the policy returned and that the model run is its
child (on Python 3.11+ for the async tests, since on 3.10 a model called
from a sync node on the async path is not traced at all). All three fail
on main. Two more tests check that a custom handler with the tap methods
gets the real payload and none of the node's streamed output while a
tracer next to it gets the processed one, through `ainvoke` and
`astream_events` (this fails on main too), and that a run cancelled as
the node ends still closes the tracer's node run. The existing trace
policy tests pass unchanged.
Thanks @digit50 for the report and the root-cause analysis.
Fixes #9090
2026-10-30 20:58:19 +00:00
Elior Nataf Lackritz
1f0cf816d5
fix(langgraph): give messages and tools events the namespace of their graph ( #9458 )
...
Fixes #6373
Fixes #5674
`messages` and `tools` events should stream under the namespace of the
graph they ran in, and a stream without `subgraphs=True` should get only
its own graph's events, plus those of a graph that one of its nodes
streams itself. langchain-ai/langgraphjs#3121 applies these rules in JS.
Python broke them in four places:
- **`@task` calls.** A task call nests its checkpoint namespace segment
under its caller's, although it runs in the caller's graph. The handlers
dropped only the last segment, so a model or tool called in a task
looked like a subgraph's: without `subgraphs=True` its events were
dropped, so a functional API agent streamed no tokens (#6373 ), and with
it they came under the calling node's namespace, one level deeper per
nested call. The handlers now also drop one segment per enclosing task
call, read from the task's `langgraph_path`. Send tasks and plain nodes
are unchanged.
- **A graph that runs outside the caller's task.** A graph invoked
inside a node with its own `thread_id`, `checkpoint_ns` or
`checkpoint_id`, or through a LangChain runnable called with its own
`configurable` (which replaces the caller's), starts its namespace at
the root, so a handler inherited from the caller streamed its events as
the caller's own, even with `subgraphs=False` (#5674 ). Such a graph now
drops the `messages` and `tools` handlers it inherits, whatever their
`subgraphs`, so its events stay out of the caller's stream like its
`updates` and `custom` output. A node that streams it still gets its
events.
- **A graph a node streams after running another.** The loop numbers the
namespace of every subgraph a task runs after its first (`node:<id>|1`),
but the handlers read their own namespace before that, so the node got
none of that graph's events. They now read it from the loop.
- **`push_message`.** It kept the pushing node's own segment, ignored
`subgraphs=False`, and reached only the first messages handler, so a
node that streamed a graph never got that graph's pushed messages. It
now follows the same rules, for every messages handler.
Reading the namespace from the loop changes one more case: a root run
given a subgraph's config, with its `checkpoint_ns` (as
`get_state(subgraphs=True)` returns it), took that namespace as its own
and streamed the subgraph's tokens with `subgraphs=False`. The loop runs
it at the root, so it now streams the subgraph node's returned messages,
like any root run.
`stream_events(version="v3")` reads the same namespaces, so a task's
tokens and tool calls and a root node's pushed messages now show in the
run's `messages` and `tool_calls` projections, where they were missing.
The new tests in `test_stream_namespaces.py` fail on `main`, except two
guards that invoke a child graph with no config. No existing test
changed.
Thanks @sdole and @Kannndev for the reports, @lxingy3 for the smaller
repro and diagnosis on #5674 , and @roydonsequeira for the review that
caught the `subgraphs=True` case and the 3.10 failure.
## Release note
`messages` and `tools` events from a `@task` now stream without
`subgraphs=True`, as events of the graph that called the task, so a
functional API agent's `messages` stream carries its tokens. With
`subgraphs=True` they move from the calling node's namespace, such as
`("workflow:<id>",)`, to their graph's, `()` at the root. A graph
invoked inside a node with its own `thread_id`, `checkpoint_ns` or
`checkpoint_id`, or through a runnable called with its own
`configurable`, no longer streams into the caller's `messages` or
`tools` stream, even when the caller passes `subgraphs=True`; a node
that streams it still gets its events. A node that streams a graph after
running another one now gets that graph's events. Messages sent with
`push_message` stream under the namespace of their graph, stay out of a
stream without `subgraphs=True` when they come from a subgraph, and
reach a node that streams their graph. A root run given a subgraph's
`checkpoint_ns` with `subgraphs=False` now streams that subgraph node's
returned messages instead of its tokens. The `stream_mode` chunks that
`astream_events` carries change the same way; its own events do not.
2026-10-30 15:07:34 -04:00
Elior Nataf Lackritz
6f2df053f4
test(sdk-py): check that a reconnect loop resumes after the newest event ( #9483 )
...
Follow-up to the review on #9482 : with `stream_resumable=True`, does a
loop of reconnects replay events? Each reconnect sends the newest event
id the stream got, and a failed reconnect keeps that id for the next
one, so the server replays only what the client missed. The existing
loop tests served the same events whatever the cursor, so nothing
checked this.
`test_*_reconnect_loop_resumes_after_the_newest_event` checks the
`Last-Event-ID` of every request in two loops, sync and async: progress
between drops, and a 502 between two reconnects. A stream that kept its
first cursor, or dropped it after a failed reconnect, fails it.
2026-10-29 15:08:20 -04:00
Elior Nataf Lackritz
ffc3336367
fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects with backoff ( #9481 )
...
`runs.wait`, `runs.join` and `runs.cancel(wait=True)` reconnect to the
run's `Location` when the response is cut off, but with no delay: a 429,
a 5xx or a refused connection on the reconnect raised at once, and a
dropped body reconnected again immediately, so they could not ride out a
server restart or a deploy. #9462 fixed the same for streams.
The reconnect now waits with the stream path's backoff and retries those
failures within the same five attempts; any other status and a failed
first request still raise. Each attempt is one GET with
`reconnect_limit=0`, so the loop owns every retry (the join `Location`
points back at itself, so nothing is lost by not following it).
`request_reconnect` raises plain `httpx.HTTPStatusError`, so it checks
429 and 5xx directly, the same set the stream path catches as
`RateLimitError` and `InternalServerError`.
`test_wait_retries_a_failed_reconnect_after_a_backoff` covers each
failure, sync and async, and fails on `main`; the other two new tests
check the budget and that a 404 still raises. `no_sleep` moves to
`conftest.py` so both test files can use it.
2026-10-28 18:55:31 -04:00
Elior Nataf Lackritz
5f4b28a9f7
fix(sdk-py): warn when a stream reconnects without a Last-Event-ID ( #9482 )
...
A dropped stream reconnects even when it has no event id to resume from
(a run created without `stream_resumable=True`, or one that dropped
before its first event). The reconnect can't replay what was sent while
it was disconnected, so those events were lost without a sign.
The SDK now warns when a reconnect request carries no `Last-Event-ID`,
whether the cursor would come from the stream's ids or from the caller's
own header. It still reconnects: everything sent after the reconnect
arrives, so refusing would turn a gap into losing the rest of the
stream.
The new table test covers a stream with no ids (warns; fails on `main`),
one with ids and one with a caller cursor (no warning), sync and async.
The empty-id tests now expect the warning, since they reconnect without
a cursor too.
2026-10-28 18:44:56 -04:00
dependabot[bot]
5c96bce8d3
chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph ( #9433 )
...
Bumps [setuptools](https://github.com/pypa/setuptools ) from 83.0.0 to
84.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/setuptools/blob/main/NEWS.rst ">setuptools's
changelog</a>.</em></p>
<blockquote>
<h1>v84.1.0</h1>
<h2>Features</h2>
<ul>
<li><code>setuptools.archive_util</code> now raises the new
<code>UnsafeMember</code> exception when
an archive member would be extracted outside of the extraction
directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding
a
quietly incomplete extraction, and matches the behavior of the standard
library's <code>tarfile</code> extraction filters.</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>Wheel.install_as_egg</code> no longer creates namespace package
directories
outside of the destination egg directory. Entries in a wheel's
<code>namespace_packages.txt</code> were split on <code>.</code> and
passed straight to
<code>os.path.join</code>, so an entry that was absolute,
drive-qualified, or UNC
discarded the destination and placed an <code>__init__.py</code> at a
path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.</p>
<p>This code path is reached only by the deprecated
<code>setup_requires</code>
mechanism when <code>setup()</code> is invoked outside a PEP 517
frontend; the
setuptools build backend never reaches it.</p>
</li>
<li>
<p><code>setuptools.archive_util</code> no longer extracts archive
members outside of the
requested extraction directory. Both the tar and zip formats specify
<code>/</code> as
the only path separator, but the guard against <code>..</code>
components split member
names on <code>/</code> alone, so a name such as
<code>..\escaped.txt</code> was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC
prefix
are now rejected on every platform, as are members whose resolved
destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.</p>
</li>
</ul>
<h1>v84.0.0</h1>
<h2>Features</h2>
<ul>
<li>Newline-separated <code>keywords</code> and
<code>platforms</code><code>pypa/setuptools#4887</code><code>old
specification <https://peps.python.org/pep-0345/> ;</code>_
separated items with spaces and the current one uses commas. (<a
href="https://redirect.github.com/pypa/setuptools/issues/4887 ">#4887</a>)</li>
<li><code>Extension</code><code>pypa/distutils#373</code><a
href="https://redirect.github.com/pypa/setuptools/issues/5022 ">#5022</a>)</li>
<li>The C compiler modules now emit log messages through their own
<code>compilers.C.*</code> loggers instead of the distutils root logger,
part of decoupling the compilers package from distutils. The logger
names are normalized to a stable <code>compilers.C.*</code> prefix so
they remain constant as the package migrates toward a standalone
<code>compilers.C</code> distribution. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5266 ">#5266</a>)</li>
<li>The C compilers gained a <code>Compiler.call</code> method -- a thin
wrapper over <code>subprocess.check_call</code> (with macOS
deployment-target env injection) that is the modern replacement for
<code>Compiler.spawn</code>. The compilers no longer depend on
<code>distutils.spawn</code>, <code>distutils.dir_util</code>,
<code>distutils.file_util</code>, <code>distutils._modified</code>, or
<code>distutils.util.execute</code>/<code>split_quoted</code>: the
generic <code>newer</code>/<code>newer_group</code> and
<code>split_quoted</code> helpers are vendored into the
<code>compilers</code> package, and
<code>Compiler.mkpath</code>/<code>move_file</code>/<code>execute</code>
are implemented directly on the standard library
(<code>os.makedirs</code>/<code>shutil.move</code>). The methods are
retained for backward compatibility. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5267 ">#5267</a>)</li>
<li>The compilers no longer depend on <code>distutils.util</code>,
<code>distutils.version</code>, <code>distutils.compat</code>, or
<code>distutils._macos_compat</code>. The platform-identification
helpers
(<code>get_platform</code>/<code>get_host_platform</code>/<code>is_mingw</code>)
now live in <code>distutils.compilers.platform.detect</code> and the
macOS deployment-target logic and <code>compiler_fixup</code> in
<code>distutils.compilers.platform.macos</code>;
<code>CygwinCCompiler.gcc_version</code> returns a
<code>packaging.version.Version</code>. <code>distutils.util</code>
re-exports the platform/macOS helpers from their new homes for backward
compatibility rather than keeping duplicate copies. (sysconfig lookups
still route through distutils pending its own decoupling.) (<a
href="https://redirect.github.com/pypa/setuptools/issues/5268 ">#5268</a>)</li>
<li>The compilers now read their build configuration from the standard
library's <code>sysconfig</code> instead of
<code>distutils.sysconfig</code>. Per-compiler customization --
previously <code>distutils.sysconfig.customize_compiler</code> -- has
moved into <code>Compiler.configure_system()</code>: a no-op on the base
class, with <code>UnixCCompiler</code> applying the
compiler/flag/archiver settings CPython recorded in
<code>sysconfig</code> (and the usual
<code>CC</code>/<code>CFLAGS</code>/<code>LDSHARED</code>/… environment
overrides). <code>distutils.sysconfig.customize_compiler</code> is
retained as a thin wrapper that calls
<code>compiler.configure_system()</code>. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5269 ">#5269</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/setuptools/commit/77b7ace0aaf660beeb9b3f9da4aabf21cbcf3fa9 "><code>77b7ace</code></a>
Bump version: 84.0.0 → 84.1.0</li>
<li><a
href="https://github.com/pypa/setuptools/commit/e66004c64eaf6cf2f8c53ccdfac75cf7abce7ccf "><code>e66004c</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5329 ">#5329</a>
from pypa/fix/wheel-namespace-path-escape</li>
<li><a
href="https://github.com/pypa/setuptools/commit/54b5dcadc1bd938a5a66919e8ab7bcd59805e7fd "><code>54b5dca</code></a>
Cover the containment check with a symlink escape test</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af "><code>6d07b8d</code></a>
Validate namespace package names during legacy wheel installation</li>
<li><a
href="https://github.com/pypa/setuptools/commit/8419f006d4e34c4ecfc7a0bd1bc6993855adc3cc "><code>8419f00</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5356 ">#5356</a>
from pypa/skeleton-ruff-0.16</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6dadc86a3f7dbe1cf49c6301548ffde61d4e74e1 "><code>6dadc86</code></a>
Remove DTZ011 suppressions that Ruff 0.17 reports as unused.</li>
<li><a
href="https://github.com/pypa/setuptools/commit/715ec38b46424533806195a96983e3dd70fdf3b9 "><code>715ec38</code></a>
Merge <a
href="https://github.com/jaraco/skeleton ">https://github.com/jaraco/skeleton </a></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9695460ebfa879ada16545d62b26b9a489a6d5ed "><code>9695460</code></a><code>jaraco/skeleton#219</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9e0812976b1154a7aece47188814385c887bc6c9 "><code>9e08129</code></a><code>jaraco/skeleton#216</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/4e612f9e44ecfad130d0b2a27a2dce0740599b4b "><code>4e612f9</code></a>
Ignore PyPy's deprecated check_home warning in tests</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-29 03:03:53 +09:00
2f46bb3ca4
fix(sdk-py): preserve SSE data and cursor state across chunks ( #9477 )
...
Replaces https://github.com/langchain-ai/langgraph/pull/9451 , which
GitHub would not reopen after the branch was rebased. Prior discussion
and review remain on that PR.
Preserve empty data lines and unnamed null events, emit CR-terminated
lines immediately, and retain decoded cursor IDs across reconnects.
Replace malformed UTF-8 consistently with JS, expose decoder state
through its constructor/read-only property, and suppress repeated
control placeholders.
Rebased onto the current reconnect/backoff fixes without changing
request header encoding, retry parsing, JSON-only payloads or tolerant
EOF behavior. Matching JS changes:
https://github.com/langchain-ai/langgraphjs/pull/3128 .
### SSE references
- [MDN event stream format and
fields](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events#event_stream_format ):
UTF-8, comments, colonless fields and multiline data.
- [WHATWG
parsing](https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream ):
CR/LF/CRLF framing and buffering.
- [WHATWG
interpretation](https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation ):
BOM, data assembly and ID rules.
- [WHATWG
reconnection](https://html.spec.whatwg.org/multipage/server-sent-events.html#sse-processing-model ):
cursor propagation.
Native Python/JS JSON semantics remain language-specific; this does not
claim exhaustive conformance.
## References
-
[Plan](https://openswe.langchain.dev/agents/86db0ac8-b177-5c04-a1e5-e3226a37b42e/plan )
- [Slack
thread](https://langchain.slack.com/archives/C0C411URFR6/p1792789247110279 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/86db0ac8-b177-5c04-a1e5-e3226a37b42e )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Hunter Lovell <hntrl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-28 10:53:22 -07:00
dependabot[bot]
4b7f2f5230
chore(deps): bump zod from 4.3.6 to 4.6.7 in /libs/cli/js-monorepo-example ( #9431 )
...
Bumps [zod](https://github.com/colinhacks/zod ) from 4.3.6 to 4.6.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases ">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.7</h2>
<h2>Commits:</h2>
<ul>
<li>b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7</li>
</ul>
<h2>v4.6.6</h2>
<blockquote>
<p>Six malicious commits pushed to <code>main</code> on September 21
with a compromised git credential were reverted the same day in <a
href="https://redirect.github.com/colinhacks/zod/issues/6620 ">#6620</a>
and have since been removed from the history of <code>main</code>. None
were ever published to npm. The npm provenance for 4.6.6 names 284243fb,
the pre-rewrite copy of 9c219833 with identical contents.</p>
</blockquote>
<h2>Commits:</h2>
<ul>
<li>0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale
directly in Zod Mini</li>
<li>9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from
zod/locales, not z.locales</li>
<li>34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales
tree-shaking note</li>
<li>74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions
instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to
bronze sponsors</li>
<li>8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for
Japan logo and list it first in bronze</li>
<li>bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for
Japan logo to match the other bronze tiles</li>
<li>c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on
the release-approval environment until the staged versions are approved
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6638 ">#6638</a>)</li>
<li>a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record
output and input as members, not base type arguments (<a
href="https://redirect.github.com/colinhacks/zod/issues/6645 ">#6645</a>)</li>
<li>a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set
and map size bounds before parsing elements (<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li>529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6</li>
<li>9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a
failed OIDC token exchange says why</li>
</ul>
<h2>v4.6.5</h2>
<h2>Commits:</h2>
<ul>
<li>d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch
highlights to the 4.6 post</li>
<li>f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch
highlights into the 4.6 post's own sections</li>
<li>de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties
section with the check and add a Zod Mini tab (<a
href="https://redirect.github.com/colinhacks/zod/issues/6598 ">#6598</a>)</li>
<li>56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the
.properties() shape off the instance type (<a
href="https://redirect.github.com/colinhacks/zod/issues/6600 ">#6600</a>)</li>
<li>ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add
z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)"</li>
<li>cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert
"feat: add z.currencyCode() over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)""</li>
<li>0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5</li>
<li>59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the
integration peers to the workspace zod after the 4.6.5 bump</li>
</ul>
<h2>v4.6.4</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.3 ">4.6.3</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/d6bc1e30 "><code>d6bc1e30</code></a>
feat: add <code>z.currencyCode()</code> over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/pull/6595 ">#6595</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/ad32d751 "><code>ad32d751</code></a>
perf: <code>z.url()</code> rejects an invalid URL with
<code>URL.canParse()</code> instead of a throwing constructor, about 50x
faster; fewer allocations on the validation path (<a
href="https://redirect.github.com/colinhacks/zod/pull/6588 ">#6588</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/2bb08717 "><code>2bb08717</code></a>
chore: re-pin the integration peers to the workspace zod after the 4.6.4
bump</li>
<li><a
href="https://github.com/colinhacks/zod/commit/f6e1701a "><code>f6e1701a</code></a>
chore(deps): bump next to 15.5.25 and vite to 7.3.6 (<a
href="https://redirect.github.com/colinhacks/zod/pull/6153 ">#6153</a>)</li>
</ul>
<h2>v4.6.3</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.2 ">4.6.2</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/413cce9a "><code>413cce9a</code></a>
fix(v4): make z.properties() a check again (<a
href="https://redirect.github.com/colinhacks/zod/pull/6594 ">#6594</a>) —
removes the standalone <code>z.properties()</code> schema from 4.6.0;
<code>z.instanceof().properties()</code> and
<code>.check(...z.properties())</code> are unchanged</li>
<li><a
href="https://github.com/colinhacks/zod/commit/75d63ee1 "><code>75d63ee1</code></a>
docs: show only the <code>.properties()</code> method form in the 4.6
post</li>
<li><a
href="https://github.com/colinhacks/zod/commit/46da9572 "><code>46da9572</code></a>
docs: match the error-message examples to what the parsers emit</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042 "><code>b500a2e</code></a>
4.6.7</li>
<li><a
href="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 "><code>9c21983</code></a>
ci: stage at verbose so a failed OIDC token exchange says why</li>
<li><a
href="https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7 "><code>529f78d</code></a>
4.6.6</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd "><code>a0ebf97</code></a>
fix(v4): check array, set and map size bounds before parsing elements
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67 "><code>a2ba4a6</code></a>
fix(types): declare record output and input as members, not base type
argumen...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10 "><code>c42596b</code></a>
release: hold the run on the release-approval environment until the
staged ve...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290 "><code>bacad51</code></a>
docs: square the Code for Japan logo to match the other bronze
tiles</li>
<li><a
href="https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462 "><code>8fb2faf</code></a>
docs: crop the Code for Japan logo and list it first in bronze</li>
<li><a
href="https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa "><code>b2ef983</code></a>
docs: add Code for Japan to bronze sponsors</li>
<li><a
href="https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df "><code>74304ce</code></a>
release: stage npm versions instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.6.7 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-29 02:29:45 +09:00
Richard Scarrott
5a3e5dd739
fix(sdk-py): retry failed stream reconnects with backoff ( #9462 )
...
## Summary
A stream reconnect that fails to open (429, 5xx, transport error,
non-SSE response) is now retried with backoff instead of ending the
stream, e.g. while the server restarts or deploys.
```diff
HttpClient.stream / SyncHttpClient.stream, on reconnect (GET to Location)
- retry only a mid-read drop, with no delay, 5 times per stream
+ also retry a reconnect that fails to open: 429, 5xx, transport error, non-SSE
+ sleep 1, 2, 4, 5, 5s (+ up to 25% jitter) before each reconnect
+ reset the 5 attempts once a reconnect yields an event
+ give up with "Exceeded maximum…" raised from the last error
```
The first POST still raises on any error, since retrying it could start
a duplicate run. The backoff formula moves to `_shared/utilities.py`,
shared with the stream controllers.
The sleep also delays the first reconnect after a plain drop by about a
second, which matches the JS SDK. A run created without
`stream_resumable=True` can't replay what it sent while the client was
away, so it now loses about a second more of events. Resumable runs lose
nothing.
## Evidence
- **Before:** a reconnect hitting 429/502/503, a connect error or a
non-SSE response raised, a stream with 6 spaced-out drops gave up, and
reconnects never slept.
**After:** `test_client_stream.py` covers each (sync and async), plus
404 and first-POST failures staying fatal, and giving up after ~20s.
## Merge Danger
**Door:** two-way
**Blast Radius:** small (sdk-py stream reconnects only)
2026-10-28 11:46:39 +00:00
Hunter Lovell
eb8ec111b3
fix(langgraph): emit node-output messages from a graph streamed inside a node ( #9463 )
...
When a node streams a graph with `stream_mode="messages"`, messages that
one of that graph's nodes *returns* (rather than streams from an LLM)
are dropped. The same graph streamed at the top level reports them:
```python
def respond(state: MessagesState) -dict:
return {"messages": [AIMessage("hi there")]}
subgraph = StateGraph(MessagesState).add_node("respond", respond).add_edge(START, "respond").compile()
subgraph.stream(msgs, stream_mode="messages") # -> "hi there"
def parent_node(state, config):
for msg, _ in subgraph.stream(msgs, config, stream_mode="messages"):
... # -> nothing
```
A graph streamed this way attaches its own messages handler with the
node's namespace as `parent_ns`, so it still reports that graph's own
messages with `subgraphs=False` (#5836 ). `on_chat_model_start` honors
`parent_ns`, but `on_chain_start` didn't, so node outputs were filtered
out as if they came from a subgraph. This applies the same check in
`on_chain_start`.
Split out of #9453 (see @eliornl's [review
comment](https://github.com/langchain-ai/langgraph/pull/9453#discussion_r …)).
2026-10-27 14:46:39 -07:00
Hunter Lovell
8c177f7388
fix(langgraph): respect subgraphs=False in RemoteGraph.stream under a streaming parent ( #9453 )
...
When a node streams a `RemoteGraph` with `subgraphs=False` while its
parent graph is itself streamed with `subgraphs=True`,
`RemoteGraph.stream`/`astream` yield the remote graph's subgraph events
to the caller. With `stream_mode="updates"`, the node gets `['model',
'child']` where an in-memory graph streamed the same way gives
`['child']`.
`RemoteGraph` requests `stream_subgraphs=True` whenever the config
carries a parent stream, so the parent sees the remote graph's subgraph
events. Those events are forwarded to the parent correctly, but the
values yielded to the caller were never filtered by the caller's own
`subgraphs` setting. Locally this falls out of how streams are wired:
with `subgraphs=False` the run never installs the caller's queue for its
subgraphs, so their events only reach the parent. This applies the same
split on the client: subgraph events still go to the parent, and only
reach the caller when it passed `subgraphs=True`.
`messages` events are left as they are. The server's messages handler
dedupes across namespaces, so once it has sent a message from inside a
subgraph it doesn't send the top-level copy a `subgraphs=False` caller
would see locally. Filtering would leave that caller with nothing, so it
keeps getting the subgraph tokens, as today. Matching local exactly
needs the server to produce the caller's view; I'll open an issue for
that.
The new tests fail on `main`.
2026-10-27 14:40:42 -07:00
55013146ae
fix(sdk-py): match Auth.on overload to optional resources ( #9450 )
...
Match the `Auth.on` decorator-factory overload to its existing optional
`resources` argument so `auth.on()`, action-only calls, and
`resources=None` type-check. Add regression coverage for the overload
and wildcard registration; runtime authorization behavior is unchanged.
## References
- [Slack
thread](https://langchain.slack.com/archives/C0C411URFR6/p1792789013113819 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/094c284b-638a-5b04-95f0-623b47d0a52f )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Hunter Lovell <hntrl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-27 14:34:20 -07:00
Elior Nataf Lackritz
858891aaa1
fix(langgraph): don't report a paused tool as failed on the tools stream ( #9406 )
...
`interrupt()` inside a tool raises `GraphInterrupt`, and langchain-core
calls `on_tool_error` for every exception, so the `tools` stream
reported a tool that was only waiting for an answer as `tool-error`,
with the interrupt flattened into the message. With a subagent running
inside a tool, the outer tool showed as failed while the subagent waited
for approval. Fixes #8218 .
## Fix
- An interrupt or a drain ends the tool's events without a `tool-error`.
On resume the tool runs again and emits `tool-started` and
`tool-finished`. A parent command doesn't rerun the tool, so it still
ends the call with `tool-error`, as before.
- `astream` no longer runs every node in streaming mode just because the
`tools` handler is attached. Like the `messages` handler, it doesn't
need it, and with it a `@task` awaited inside a subgraph node returned
`None` whenever the `tools` mode was on.
The new tests fail on `main`.
## Release note
The `tools` stream no longer sends `tool-error` for a tool that pauses
on `interrupt()`. Until the run resumes, that tool has a `tool-started`
event and no end event. In-process `stream_events(version="v3")` now
ends that tool's stream as completed with no output, instead of failed
with the interrupt.
Same idea as #8219 by @haseeb-m4235 and #8282 by @thsfranca.
2026-10-26 19:35:13 -04:00
Elior Nataf Lackritz
1526b0e82d
fix(sdk-py): reset the reconnect cursor on every empty id ( #9440 )
...
#9402 made an empty `id:` field reset the reconnect cursor, so the next
reconnect sends no `Last-Event-ID`. Two cases still reconnected with the
old cursor.
- A `Last-Event-ID` header the caller passed in, as
`runs.join_stream(last_event_id=...)` does, stayed in the reconnect
headers. A stream joined at 5 that sent id 6 and then an empty id
reconnected from 5, so event 6 arrived twice. Once the stream has sent
an `id:` field, the caller's header is now dropped, in any letter case,
and the stream's cursor is sent if it is not empty. This also stops a
caller header spelled `last-event-id` from going out next to the SDK's
own `Last-Event-ID`.
- An empty `id:` on its own, with no event or data in its block, never
reached the stream loop, because the decoder skipped the block as empty.
The decoder now returns it as an empty part. The stream loop takes the
reset from it and, like every other caller in the SDK, drops the part.
The new test cases fail on `main`.
Both cases were reported by @1052326311 on #9014 and by @Tivonsico on
#9230 , whose suggested approach this follows. Related: #9299 , not fixed
here.
## Release note
Once a stream has sent an `id:` field, reconnects no longer send a
`Last-Event-ID` header the caller passed in. After an empty `id:`,
`SSEDecoder.decode` returns an empty part, with no event and no data,
for each block that has neither, as it already did after a non-empty id.
2026-10-26 20:31:20 +00:00
Elior Nataf Lackritz
c2c73b4f91
fix(langgraph): return an awaited @task's value while streaming ( #9407 )
...
A `@task` awaited inside a node returned `None` whenever the node ran in
streaming mode, which `astream_events` (v1 and v2) turns on, and so does
everything built on it. With streaming, `arun_with_retry` drains the
task's `astream()` and returned nothing, so the awaiting node got
`None`. Fixes #9284 .
It now returns the value the task wrote, on both stream paths (with and
without a timeout).
The new test fails on `main` for v1 and v2, including a task that
returns a falsy value.
Same idea as #9295 by @AaronG18, and the lookup @amishaguptaberk
suggested on the issue.
2026-10-26 20:29:22 +00:00
Sera
03e73ff51b
feat(langgraph): list ToolNode tool names in graph node metadata ( #9449 )
...
A `ToolNode` appears in `get_graph()` output as a plain runnable named
`tools`. Graph viewers such as Studio can't show which tools it runs,
and with deep agents that's most of what the agent does.
## Changes
- `draw_graph` adds `metadata["__tools"]`, the node's tool names in
order, for any node with a non-empty `tools_by_name`.
- The check is duck-typed, so core doesn't import from
`langgraph-prebuilt`.
## Reviewer notes
- Names only. Tool descriptions are long for deep agents and would bloat
`/graph` payloads.
- This sits next to `__interrupt`. Like it, `__tools` shows up in node
labels from `draw_mermaid(with_styles=True)`, but not in the
`with_styles=False` output.
## Test Plan
- [x] The `to_json()` snapshots for `create_react_agent` and the
hand-built `ToolNode` graph now include `__tools`.
- [x] A local deep agent's `/assistants/{id}/graph` response lists all
11 tools on the `tools` node.
2026-10-26 16:11:08 -04:00
Elior Nataf Lackritz
3521f08e21
release(checkpoint): 4.3.1 ( #9447 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpoint==4.3.0`:
- #9383 - reject NUL bytes in store namespace labels
2026-10-26 19:47:44 +00:00
Elior Nataf Lackritz
24294fad37
release(langgraph): 1.2.18 ( #9445 )
...
Bumps langgraph from 1.2.17 to 1.2.18.
Includes:
- Default `DeltaChannel` snapshots to every 100 updates instead of 1000
(#9420 )
- Let `error_handler` recover on every path and stream failed task
results (#9408 )
- Stream the last checkpoint of a run stopped by `interrupt_after` or
the recursion limit (#9409 )
- Stop duplicating tags at every subgraph level (#9400 )
2026-10-26 15:40:09 -04:00
Elior Nataf Lackritz
f6317d5cb1
release(sdk-py): 0.4.10 ( #9446 )
...
Bumps the Python SDK version from 0.4.9 to 0.4.10.
Includes:
- Retry `runs.wait` with a bodyless GET and raise run errors in the sync
`wait` (#9399 )
- Follow the SSE spec for multi-line data, empty ids and a leading BOM
(#9402 )
- Accept `durability`, `stream_resumable` and `context` in the `runs`
overloads (#9403 )
2026-10-26 15:40:04 -04:00
Elior Nataf Lackritz
7e56e6c80b
fix(langgraph): let error_handler recover on every path and stream failed task results ( #9408 )
...
- A node's `error_handler` ran, but the original error was still raised
when the node ran on the executor path: when streaming `messages` or
`custom`, with `subgraphs=True`, or next to a parallel node. The runner
marked the handled task's future, but the executors re-raised every
failed future on exit without checking the mark. The mark now lives in
the executor module, and both executors skip those futures. Fixes #8608 .
- With only `tasks` or `debug` streaming, a failing task's result (with
its `error`) was never streamed: the single-task fast path raised before
the caller drained the stream queue. It now yields once before
re-raising. Fixes #5764 .
The new tests fail on `main`.
Ideas from #8278 by @UdayKiranJadi, #8611 by @SnowingFox, #8823 by
@sailikhithk, #6984 by @Br1an67 and #8400 by @cms19859230182-lang.
2026-10-26 14:15:25 -04:00
0fc4f35b66
feat(langgraph)!: default delta snapshots to 100 updates ( #9420 )
...
Change `DeltaChannel`'s default `snapshot_frequency` from 1000 to 100
updates, including channels used for messages, to bound replay latency
with more frequent snapshots. Explicit overrides remain unchanged.
Co-authored-by: Elior Nataf Lackritz <eliornl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-26 13:28:01 -04:00
raghavverma-langchain
58be6911de
release(cli): 0.4.40 ( #9443 )
...
## Summary
bumps the cli to 0.4.40 to cut a release with #9396 , the only cli change
since 0.4.39
- `langgraph deploy --remote` now sends whatever headers the control
plane returns with the source upload url, so uploads work with storage
that needs extra headers (like azure blob storage)
- control planes that dont return any headers keep the old behavior, so
nothing changes for existing setups
## Test Plan
- [x] #9396 (send the upload headers the control plane returns) is the
only CLI change merged since 0.4.39
- [ ] After merge, run the `release` workflow with `working-directory:
libs/cli` (merging doesn't publish by itself)
- [ ] `pip install -U langgraph-cli` picks up 0.4.40
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-26 16:25:10 +00:00
raghavverma-langchain
1adeafeaf3
feat(cli): send the upload headers the control plane returns ( #9396 )
...
## Summary
some storage needs extra headers on the signed upload PUT (azure blob
storage 400s without `x-ms-blob-type`), and `langgraph deploy --remote`
always sent the same gcs style headers no matter what. this lets the
control plane tell the cli what to send
- `request_upload_url` now sends `supports_upload_headers: true` so the
control plane knows this cli can handle it
- if the response has `upload_headers` the upload sends exactly those +
content-length. if not its the same defaults as before so older control
planes wont see a difference
- content-type stays as a fallback, otherwise urllib sneaks in a form
content type and that breaks signed urls
## Test Plan
- [x] `make lint` and `make test` pass in `libs/cli` (576 tests)
- [x] New tests: the upload-url request carries the flag; returned
headers are sent as-is plus the real `Content-Length` (overriding a
returned one); missing or empty `upload_headers` sends the old defaults;
returned headers without a `Content-Type` still send `application/gzip`.
Each fails without the change
- [x] Against a real Azure Blob Storage upload URL: 0.4.36 fails with
`MissingRequiredHeader` (`x-ms-blob-type`), and this branch's upload
with the returned headers succeeds (201)
- [ ] After release, `langgraph deploy --remote` still uploads against a
control plane that returns no `upload_headers`
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-26 11:02:08 -04:00
Hugo DURAND
dc1741ce96
release(cli): 0.4.39 ( #9442 )
...
Bumps the CLI to 0.4.39 to cut a release including #9395 , the only CLI
change merged since 0.4.38:
- `langgraph deploy list --json` prints `[{"id": "...", "name":
"..."}]`, so a CI job can check whether a deployment exists before it
deploys.
- `deploy list` and `deploy listeners list` now read every page, instead
of stopping at 20 deployments or 100 listeners.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-26 10:14:16 -04:00
Igor Soarez
244ca657e4
docs: add "Direction: LangGraph is a runtime" section to AGENTS.md ( #9439 )
...
## What
Adds a "Direction" section to `AGENTS.md`, placed before the library
list so it frames how the rest of the file is read. It states the
project's strategic direction for contributors — human and coding-agent
alike:
- LangGraph is consolidating as the low-level **runtime** for agents and
workflows (graph execution, checkpointing, streaming, interrupt/resume),
and is moving away from being a friendly SDK for building agents
directly.
- Agent development belongs on a harness; Deep Agents (separate repo) is
the recommended one.
- Contributions are optimized for runtime correctness, reliability,
performance, and simplicity — not for the shortest agent example.
## Why
LangGraph today is both a runtime and an agent-building SDK. As agent
harnesses have consolidated, keeping both roles blurs the contribution
criteria: "should I add this convenience helper?" and "is this the right
place for this feature?" have no written answer. `AGENTS.md` is the
first thing a coding agent reads before touching this repo; giving it an
explicit direction makes that judgment mechanical and aligns
agent-generated contributions with where the project is going.
## Notes for reviewers
- **The ratchet is stated inline, not linked.** The section embeds the
stabilization rule ("one way to do each thing, and every change leaves
fewer ways than it found") directly, because that rule currently has no
home in this repo. If the full stabilization policy lands in
`CONTRIBUTING.md`, the bullet can shrink to a link and the "deprecation
process" reference can point at it.
- **Scope is explicit.** The consolidation mandate applies to the
runtime core (`langgraph`, `checkpoint*`); the client SDKs and CLI
remain ergonomic, as thin clients.
- **`prebuilt` is marked maintenance-only**, matching its state in code
(`create_react_agent` is already `@deprecated` in favour of
`langchain.agents`). The library list itself is unchanged in this PR;
rewording the `langgraph` and `prebuilt` descriptions could be a
follow-up.
- **Removal discipline is part of the section**: breaking changes must
be a PR's stated purpose and go through deprecation — never a side
effect of an unrelated change. The intent is to prevent agents from
over-reading the direction as license for opportunistic removals.
- **Companion PR:** a matching section adapted for
langchain-ai/langgraphjs follows.
Nothing here changes code or CI; this is a documentation-only change to
contributor guidance.
2026-10-26 15:56:56 +02:00
Hugo DURAND
c696d4e79f
feat(cli): add --json to deploy list ( #9395 )
...
This PR adds a `--json` flag to the `langgraph deploy list` CLI command.
It solves the issue of CI/CD pipelines having to parse complex ASCII
tables by providing a structured JSON output (e.g., `[{"id": "...",
"name": "..."}]`) to check for existing deployments. It also fixes a
limitation where the CLI previously only fetched the first 20
deployments by implementing proper pagination.
## Changes
* **Added `--json` flag:** Outputs a clean, allow-listed JSON array of
deployments.
* **Stripped secrets:** Explicitly excludes environment variables from
the JSON output to prevent leaking secrets in CI logs.
* **Full pagination:** Updates the backend to fetch all limit/offset
pages, ensuring all deployments (not just the first 20) are retrieved.
* **Cleaned standard output:** Moved beta warnings to `stderr` and
disabled interactive prompts when using `--json` to guarantee valid JSON
on `stdout`.
* **Centralized formatting:** Refactored three separate table rendering
functions into a single shared `Table` and `JsonOutput` logic.
## Test
* **Automated checks:** Passed `make format`, `make lint`, and `make
test` (580 tests total).
* **New unit tests:** Added extensive testing for JSON shape, secret
omission, empty lists, missing IDs, stderr routing, and multi-page
retrieval logic.
* **Manual verification:** Tested against a local mock control plane
with 101 deployments, verifying that `jq` can successfully parse the
output and check for specific deployment names.
Release Note: Added `--json` flag to `langgraph deploy list` to support
scriptable, structured deployment lookups in CI/CD environments.
2026-10-26 09:45:57 -04:00
Elior Nataf Lackritz
34c7f58655
fix(sdk-py): retry runs.wait with a bodyless GET and raise run errors in sync wait ( #9399 )
...
Two `runs.wait` bugs in the Python SDK.
- When the response of `runs.wait` broke off mid-read, the SDK retried
with a GET to the `Location` header, but that GET reused the POST's
`Content-Length` and `Content-Type`, so the only retry always failed
with `h11.LocalProtocolError`. The sync client also sent a JSON `null`
body on every body-less request made this way (`runs.join`,
`runs.cancel(wait=True)`). Fixes #7858 .
- Sync `runs.wait(raise_error=True)` returned a failed run's
`{"__error__": ...}` as a normal result, and sent `raise_error` to the
server, which ignores it. The async client raises. Fixes #8383 .
## Fix
The retry GET carries only the caller's headers, and the sync client
sends no body for `json=None`, as the async one already did. Sync
`runs.wait` checks `__error__` like the async client and no longer sends
`raise_error`.
The new tests fail on `main`.
## Release note
Sync `runs.wait` now raises when the run fails, as `raise_error=True`
(the default) always documented. Code that reads `__error__` from the
result should pass `raise_error=False`.
Ideas from #7869 by @pragnyanramtha, #8385 by @Solaris-star and #9377 by
@ShallAbby.
2026-10-26 09:25:00 -04:00
Elior Nataf Lackritz
1b1aee689d
fix(langgraph): stream the last checkpoint of a run stopped by interrupt_after or the recursion limit ( #9409 )
...
When a run stopped at an `interrupt_after` pause or at the recursion
limit, the checkpoint it stopped on was never sent on the `checkpoints`
or `debug` stream. A checkpoint is streamed at the start of the next
tick, which works out its next tasks; `interrupt_after` raises right
after saving it, and the recursion limit stops the run at the start of
the next tick before that point. A client that resumes from the last
checkpoint it saw ran the last node again. Fixes #9180 .
The block that prepares the next tasks and streams the checkpoint moves
into one method, called by `tick` and on both of those exits.
The new tests fail on `main` with every checkpointer in the suite.
## Release note
The `checkpoints` and `debug` streams send one more event when a run
stops at an `interrupt_after` pause or at the recursion limit: the
checkpoint it stopped on.
Same approach as @jayhemnani9910's branch on the issue.
2026-10-26 09:18:02 -04:00
Elior Nataf Lackritz
27aeb75efd
fix(langgraph): stop duplicating tags at every subgraph level ( #9400 )
...
Tags passed at invoke time are repeated at every subgraph level: a node
one subgraph deep sees each tag twice, three levels deep 8 times. The
copies show up in the node's `config["tags"]`, in `messages` stream
metadata and in traces. Fixes #9084 .
## Cause
`ensure_config` appends the tags of explicit configs to the ambient
config's tags, so tags bound with `with_config` survive. A subgraph is
called with its parent's config, which the ambient config also holds, so
the parent's tags are appended a second time at each level.
## Fix
`ensure_config` skips tags the ambient config already has. Tags repeated
across explicit configs are still concatenated, as before.
The new tests fail on `main`.
Same approach as #9110 by @mudscode.
2026-10-26 08:56:49 -04:00
Elior Nataf Lackritz
c18a42fcba
fix(sdk-py): follow the SSE spec for multi-line data, empty ids and a leading BOM ( #9402 )
...
The Python SDK's SSE decoder broke three rules of the SSE spec.
- Repeated `data:` lines were concatenated without a newline, so a value
split across lines could decode to a different one: `[1` then `0]`
became `[10]`. They are now joined with a newline. Fixes #7915 .
- An empty `id:` field did not reset the reconnect cursor, so a
reconnect after it resumed from the previous id. It now clears the
cursor, and the reconnect sends no `Last-Event-ID`. Fixes #9009 .
- A UTF-8 BOM at the start of a stream became part of the first field
name, so the first event lost its type. It is now stripped. Fixes #9225 .
A server that writes each event's data on one line, with no BOM and no
empty ids, sees no change.
The new tests fail on `main`.
## Release note
Multi-line `data:` fields are joined with newlines, so data that only
parsed because its lines were glued together now raises a decode error.
`SSEDecoder.last_event_id` returns `""` after an empty `id:` field,
instead of `None`.
Ideas from #7936 by @NishchayMahor, #7947 by @tayyub-ai, #9014 by
@daleselaji-dev and #9236 by @Kayvan-Zahiri.
2026-10-26 08:56:37 -04:00
Elior Nataf Lackritz
b54566b620
fix(sdk-py): accept durability, stream_resumable and context in the runs overloads ( #9403 )
...
The `@overload` stubs of `runs.stream`, `runs.create` and `runs.wait`
left out parameters their implementations accept, so type checkers
rejected valid calls, for example `client.runs.wait(thread_id,
assistant_id, durability="sync")` (mypy: "Unexpected keyword argument").
Fixes #8442 .
Added `durability` to all 16 stubs, `stream_resumable` to the two sync
stateful `stream` stubs, and `context` to the two async stateless
`stream` stubs. A new test parses both runs clients and checks that
every overload accepts the implementation's keyword parameters, except
the ones a run kind leaves out on purpose (thread-only parameters on
stateless runs, `on_completion` on stateful ones). It fails on `main`,
and mypy accepts the calls above with this change.
Covers the gap #7101 by @KartikPawade fixed for `stream_resumable`.
Co-authored-by: Kartik Pawade
<81703361+KartikPawade@users.noreply.github.com >
Co-authored-by: Anurag Paul
<231525521+anuragpaul602-netizen@users.noreply.github.com >
2026-10-26 08:56:26 -04:00
dependabot[bot]
a25bfafe48
chore(deps): bump zod from 4.3.6 to 4.6.7 in /libs/cli/js-examples ( #9432 )
...
Bumps [zod](https://github.com/colinhacks/zod ) from 4.3.6 to 4.6.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases ">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.7</h2>
<h2>Commits:</h2>
<ul>
<li>b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7</li>
</ul>
<h2>v4.6.6</h2>
<blockquote>
<p>Six malicious commits pushed to <code>main</code> on September 21
with a compromised git credential were reverted the same day in <a
href="https://redirect.github.com/colinhacks/zod/issues/6620 ">#6620</a>
and have since been removed from the history of <code>main</code>. None
were ever published to npm. The npm provenance for 4.6.6 names 284243fb,
the pre-rewrite copy of 9c219833 with identical contents.</p>
</blockquote>
<h2>Commits:</h2>
<ul>
<li>0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale
directly in Zod Mini</li>
<li>9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from
zod/locales, not z.locales</li>
<li>34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales
tree-shaking note</li>
<li>74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions
instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to
bronze sponsors</li>
<li>8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for
Japan logo and list it first in bronze</li>
<li>bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for
Japan logo to match the other bronze tiles</li>
<li>c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on
the release-approval environment until the staged versions are approved
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6638 ">#6638</a>)</li>
<li>a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record
output and input as members, not base type arguments (<a
href="https://redirect.github.com/colinhacks/zod/issues/6645 ">#6645</a>)</li>
<li>a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set
and map size bounds before parsing elements (<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li>529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6</li>
<li>9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a
failed OIDC token exchange says why</li>
</ul>
<h2>v4.6.5</h2>
<h2>Commits:</h2>
<ul>
<li>d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch
highlights to the 4.6 post</li>
<li>f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch
highlights into the 4.6 post's own sections</li>
<li>de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties
section with the check and add a Zod Mini tab (<a
href="https://redirect.github.com/colinhacks/zod/issues/6598 ">#6598</a>)</li>
<li>56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the
.properties() shape off the instance type (<a
href="https://redirect.github.com/colinhacks/zod/issues/6600 ">#6600</a>)</li>
<li>ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add
z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)"</li>
<li>cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert
"feat: add z.currencyCode() over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)""</li>
<li>0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5</li>
<li>59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the
integration peers to the workspace zod after the 4.6.5 bump</li>
</ul>
<h2>v4.6.4</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.3 ">4.6.3</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/d6bc1e30 "><code>d6bc1e30</code></a>
feat: add <code>z.currencyCode()</code> over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/pull/6595 ">#6595</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/ad32d751 "><code>ad32d751</code></a>
perf: <code>z.url()</code> rejects an invalid URL with
<code>URL.canParse()</code> instead of a throwing constructor, about 50x
faster; fewer allocations on the validation path (<a
href="https://redirect.github.com/colinhacks/zod/pull/6588 ">#6588</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/2bb08717 "><code>2bb08717</code></a>
chore: re-pin the integration peers to the workspace zod after the 4.6.4
bump</li>
<li><a
href="https://github.com/colinhacks/zod/commit/f6e1701a "><code>f6e1701a</code></a>
chore(deps): bump next to 15.5.25 and vite to 7.3.6 (<a
href="https://redirect.github.com/colinhacks/zod/pull/6153 ">#6153</a>)</li>
</ul>
<h2>v4.6.3</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.2 ">4.6.2</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/413cce9a "><code>413cce9a</code></a>
fix(v4): make z.properties() a check again (<a
href="https://redirect.github.com/colinhacks/zod/pull/6594 ">#6594</a>) —
removes the standalone <code>z.properties()</code> schema from 4.6.0;
<code>z.instanceof().properties()</code> and
<code>.check(...z.properties())</code> are unchanged</li>
<li><a
href="https://github.com/colinhacks/zod/commit/75d63ee1 "><code>75d63ee1</code></a>
docs: show only the <code>.properties()</code> method form in the 4.6
post</li>
<li><a
href="https://github.com/colinhacks/zod/commit/46da9572 "><code>46da9572</code></a>
docs: match the error-message examples to what the parsers emit</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042 "><code>b500a2e</code></a>
4.6.7</li>
<li><a
href="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 "><code>9c21983</code></a>
ci: stage at verbose so a failed OIDC token exchange says why</li>
<li><a
href="https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7 "><code>529f78d</code></a>
4.6.6</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd "><code>a0ebf97</code></a>
fix(v4): check array, set and map size bounds before parsing elements
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67 "><code>a2ba4a6</code></a>
fix(types): declare record output and input as members, not base type
argumen...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10 "><code>c42596b</code></a>
release: hold the run on the release-approval environment until the
staged ve...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290 "><code>bacad51</code></a>
docs: square the Code for Japan logo to match the other bronze
tiles</li>
<li><a
href="https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462 "><code>8fb2faf</code></a>
docs: crop the Code for Japan logo and list it first in bronze</li>
<li><a
href="https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa "><code>b2ef983</code></a>
docs: add Code for Japan to bronze sponsors</li>
<li><a
href="https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df "><code>74304ce</code></a>
release: stage npm versions instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.6.7 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 15:27:13 +00:00
dependabot[bot]
471fee3dff
chore(deps): bump langgraph-checkpoint-postgres from 3.1.1 to 3.1.3 in /libs/cli/uv-examples/monorepo in the uv group across 1 directory ( #9422 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory:
[langgraph-checkpoint-postgres](https://github.com/langchain-ai/langgraph ).
Updates `langgraph-checkpoint-postgres` from 3.1.1 to 3.1.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-checkpoint-postgres's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-checkpoint-postgres==3.1.3</h2>
<p>Changes since checkpointpostgres==3.1.2</p>
<ul>
<li>release(checkpoint-postgres): 3.1.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9287 ">#9287</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): treat an empty
checkpoint_id as the latest in delta history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9262 ">#9262</a>)</li>
<li>perf(checkpoint-postgres): start the delta walk at the target (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9248 ">#9248</a>)</li>
<li>fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate
namespace labels before store dispatch (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9217 ">#9217</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9147 ">#9147</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9132 ">#9132</a>)</li>
<li>fix(checkpoint-postgres): derive the delta walk cursor once the
target loads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8556 ">#8556</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 3 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8773 ">#8773</a>)</li>
<li>fix(checkpoint): widen <code>Store</code> <code>put</code> value
type to <code>Mapping[str, Any]</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8617 ">#8617</a>)</li>
</ul>
<h2>langgraph-checkpoint-postgres==3.1.2</h2>
<p>Changes since checkpointpostgres==3.1.1</p>
<ul>
<li>release(checkpoint-postgres): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8565 ">#8565</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
<li>test(checkpoint-postgres,checkpoint-sqlite): run the conformance
suite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8537 ">#8537</a>)</li>
<li>fix(checkpoint-postgres): find plain-value seeds when walking delta
history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8535 ">#8535</a>)</li>
<li>chore: enable RUF100 and clear unused noqa directives (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8546 ">#8546</a>)</li>
<li>chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint
rule (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8540 ">#8540</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8497 ">#8497</a>)</li>
</ul>
<h2>langgraph-checkpoint-sqlite==3.1.2</h2>
<p>Changes since checkpointsqlite==3.1.1</p>
<ul>
<li>release(checkpoint-sqlite): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9288 ">#9288</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): treat an empty
checkpoint_id as the latest in delta history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9262 ">#9262</a>)</li>
<li>fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate
namespace labels before store dispatch (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9217 ">#9217</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 3 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9146 ">#9146</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9135 ">#9135</a>)</li>
<li>fix(checkpoint-sqlite): walk delta ancestors by parent pointer (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8557 ">#8557</a>)</li>
<li>chore(deps): bump anyio from 4.12.1 to 4.14.2 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8993 ">#8993</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 2 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8772 ">#8772</a>)</li>
<li>fix(checkpoint): widen <code>Store</code> <code>put</code> value
type to <code>Mapping[str, Any]</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8617 ">#8617</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
<li>test(checkpoint-postgres,checkpoint-sqlite): run the conformance
suite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8537 ">#8537</a>)</li>
<li>chore: enable RUF100 and clear unused noqa directives (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8546 ">#8546</a>)</li>
<li>chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint
rule (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8540 ">#8540</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 4 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8494 ">#8494</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/afbe7e48b17f62e139b5c6337ab934549e6dc73b "><code>afbe7e4</code></a>
release(checkpoint-postgres): 3.1.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9287 ">#9287</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1074714c260486900d9bec9b5dd48e13883dd5df "><code>1074714</code></a>
release(checkpoint-sqlite): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9288 ">#9288</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/740461ed50f89f867b0c3a1e46fa6d2a4e339cf4 "><code>740461e</code></a>
release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/08a345637fb2bd499f69c90056a22c478a468817 "><code>08a3456</code></a>
release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b7d053b256157ac6b8e8ff5a0783f8a446a9c89e "><code>b7d053b</code></a>
fix(langgraph): give every message written to a messages DeltaChannel an
id (...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/395c145c047aaf962a4f599582bbc8d717bd9fa1 "><code>395c145</code></a>
fix(langgraph): save a cached node's writes like a node that ran (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9259 ">#9259</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/10f1fabb3b2f2d550b8133fba1217391c27694c4 "><code>10f1fab</code></a>
fix(langgraph): stop at an interrupt_before breakpoint when a drain is
reques...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/799c2f04fd3a56186e24e9fb8bbf3568e543cfbe "><code>799c2f0</code></a>
fix(langgraph): keep an exit run from a checkpoint the thread moved past
out ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b4991f1ba36a2449ab59c38ab71828ee865bff84 "><code>b4991f1</code></a>
fix(langgraph): store an update_state input's writes on the checkpoint
it upd...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/6aa0afba682b0308fbcace31f66fb532978d4dca "><code>6aa0afb</code></a>
fix(checkpoint): default InMemorySaver delta history to the latest
checkpoint...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/checkpointsqlite==3.1.1...checkpointpostgres==3.1.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-26 00:09:10 +09:00
dependabot[bot]
7bf29e9798
chore(deps): bump virtualenv from 21.7.13 to 21.14.13 in /libs/cli ( #9427 )
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 21.7.13 to
21.14.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases ">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.14.13</h2>
<h1>Bugfixes - 21.14.13</h1>
<ul>
<li>
<p>Stop bash running commands from <code>--prompt</code> or an
environment name containing <code>$(...)</code>, backticks or a
backslash
after <code>shopt -s promptvars</code>, <code>set -o posix</code>, or in
a child shell that inherits an exported <code>PS1</code>
(GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt
from <code>psvar[9]</code>, which is never parsed
as shell syntax.</p>
<p>Write the <code>.venv</code> redirect and the wheel
<code>RECORD</code> with exclusive create, so a link planted after the
existence
check cannot redirect the write. On POSIX, a read-only
<code>.venv</code> redirect that points at a virtualenv is replaced.
(<a
href="https://redirect.github.com/pypa/virtualenv/issues/3466 ">#3466</a>)</p>
</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.13/ ">PyPI
release</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13 ">https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13 </a></p>
<h2>21.14.12</h2>
<h1>Bugfixes - 21.14.12</h1>
<ul>
<li>
<p>Upgrade embedded wheels:</p>
<ul>
<li>setuptools to <code>84.2.1</code> from <code>84.0.0</code></li>
<li>pip to <code>26.2.2</code> from <code>26.2.1</code> (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3452 ">#3452</a>)</li>
</ul>
</li>
</ul>
<h1>Improved Documentation - 21.14.12</h1>
<ul>
<li>Require a pull request news fragment and a matching changelog
section before publishing. (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3445 ">#3445</a>)</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.12/ ">PyPI
release</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.14.11...21.14.12 ">https://github.com/pypa/virtualenv/compare/21.14.11...21.14.12 </a></p>
<h2>21.14.11</h2>
<h1>Bugfixes - 21.14.11</h1>
<ul>
<li>Search all directories supplied by repeated
<code>--extra-search-dir</code> options instead of keeping only the last
group.
(<a
href="https://redirect.github.com/pypa/virtualenv/issues/3440 ">#3440</a>)</li>
<li>On Windows, the app data is now migrated into the nested cache
directory instead of the migration failing with a
warning on every run. (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3441 ">#3441</a>)</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.11/ ">PyPI
release</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst ">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.14.13</h1>
<ul>
<li>
<p>Stop bash running commands from <code>--prompt</code> or an
environment name containing <code>$(...)</code>, backticks or a
backslash
after <code>shopt -s promptvars</code>, <code>set -o posix</code>, or in
a child shell that inherits an exported <code>PS1</code>
(GHSA-cx6f-vjhg-g3cc); reported by :user:<code>rozzkml</code>. zsh now
draws the prompt from <code>psvar[9]</code>, which is never parsed
as shell syntax.</p>
<p>Write the <code>.venv</code> redirect and the wheel
<code>RECORD</code> with exclusive create, so a link planted after the
existence
check cannot redirect the write. On POSIX, a read-only
<code>.venv</code> redirect that points at a virtualenv is replaced.
(:issue:<code>3466</code>)</p>
</li>
</ul>
<hr />
<p>v21.14.12 (2026-10-21)</p>
<hr />
<h1>Bugfixes - 21.14.12</h1>
<ul>
<li>
<p>Upgrade embedded wheels:</p>
<ul>
<li>setuptools to <code>84.2.1</code> from <code>84.0.0</code></li>
<li>pip to <code>26.2.2</code> from <code>26.2.1</code>
(:issue:<code>3452</code>)</li>
</ul>
</li>
</ul>
<h1>Improved Documentation - 21.14.12</h1>
<ul>
<li>Require a pull request news fragment and a matching changelog
section before publishing. (:issue:<code>3445</code>)</li>
</ul>
<hr />
<p>v21.14.11 (2026-10-18)</p>
<hr />
<h1>Bugfixes - 21.14.11</h1>
<ul>
<li>Search all directories supplied by repeated
<code>--extra-search-dir</code> options instead of keeping only the last
group.
(:issue:<code>3440</code>)</li>
<li>On Windows, the app data is now migrated into the nested cache
directory instead of the migration failing with a
warning on every run. (:issue:<code>3441</code>)</li>
</ul>
<hr />
<p>v21.14.10 (2026-10-17)</p>
<hr />
<h1>Bugfixes - 21.14.10</h1>
<ul>
<li>Always copy seed packages when app-data is temporary, including when
symlink seeding is enabled through an environment
variable or configuration file. Seeded packages remain available after
temporary cache cleanup. (:issue:<code>3437</code>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/6accbd5ee857f6d7a5a59b1bd3db25cd5f04174a "><code>6accbd5</code></a>
release 21.14.13</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 "><code>3598e20</code></a>
🐛 fix(bash): escape the prompt for every PS1 state (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3466 ">#3466</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/f6512a559dc5a4561b8364881aee0f8ea7341e9b "><code>f6512a5</code></a>
release 21.14.12</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/b5357267d81fcb95672fa2fe8f33108de4b04a33 "><code>b535726</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3455 ">#3455</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/7e32366ab551514994a7d455ffb203208ecdc08b "><code>7e32366</code></a>
Fix broken pip and code review links in the docs (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3460 ">#3460</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/632e56fc92d8f64da72922f3e9da569491bc52c7 "><code>632e56f</code></a>
Upgrade embedded pip/setuptools/wheel and CI test tools (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3452 ">#3452</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a8bd1a916a5629859307c153bfc1924e56ba969c "><code>a8bd1a9</code></a>
chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3462 ">#3462</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/c82323bb7140ed678b2485e00c3785525f4e91af "><code>c82323b</code></a>
chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3461 ">#3461</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/863ae6ccfe1878e77b6f00074f3fd91664c8c0aa "><code>863ae6c</code></a>
chore(deps): bump the runtime-dependencies group with 3 updates (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3456 ">#3456</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/79537b3461bf150d3eb439347f2858b8ecd504f8 "><code>79537b3</code></a>
👷 ci: pin App token action v3.3.0 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3449 ">#3449</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/virtualenv/compare/21.7.13...21.14.13 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 10:03:59 +00:00
dependabot[bot] and John Kennedy
80133010ac
chore(deps): bump opentelemetry-api from 1.39.1 to 1.45.1 in /libs/langgraph ( #9424 )
...
Bumps
[opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python )
from 1.39.1 to 1.45.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/releases ">opentelemetry-api's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1</h2>
<p>This is a patch release on the previous 1.45.0/0.66b0 release, fixing
the issue(s) below.</p>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for long running resource detectors (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default HTTP transport so proxy environment
variables such as <code>HTTPS_PROXY</code> are honored again (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header and discard <code>tracestate</code>
headers longer than 8192 characters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource attributes as metric labels (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute values everywhere. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative configuration — when set,
maps the OTel <code>SeverityNumber</code> value to a Python logging
level and applies it to the <code>opentelemetry</code> logger so SDK
internal diagnostics respect the configured severity. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add <code>log_record_limits</code> support to
<code>LoggerProvider</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the Logger API, SDK, and
<code>LogRecordProcessor</code> to let instrumentation skip expensive
work when logging is disabled (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental
<code>tracer_configurator/development</code>,
<code>meter_configurator/development</code> and
<code>logger_configurator/development</code> fields into
<code>create_tracer_provider</code>, <code>create_meter_provider</code>
and <code>create_logger_provider</code>, so per-instrumentation-scope
<code>enabled</code> overrides declared in the config file are applied
to the provider (previously these fields were parsed but silently
discarded). The logger
<code>minimum_severity</code>/<code>trace_based</code> fields are not
supported by the Python SDK and are ignored with a warning. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418 ">#5418</a>)</li>
<li><code>docs/examples</code>: add example on how to manually setup the
SDK to get SDK metrics (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449 ">#5449</a>)</li>
<li><code>opentelemetry-docker-tests</code>: add Prometheus exporter
docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457 ">#5457</a>)</li>
<li><code>opentelemetry-sdk</code>: count records dropped after shutdown
on <code>otel.sdk.processor.{span,log}.processed</code> with
<code>error.type=already_shutdown</code> (batch span/log and simple log
processors), which the semantic conventions define as a valid value for
this metric. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509 ">#5509</a>)</li>
<li><code>opentelemetry-semantic-conventions</code>: update semantic
conventions to v1.44.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511 ">#5511</a>)</li>
<li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host
resource detector (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653 ">#5653</a>)</li>
<li><code>opentelemetry-test-utils</code>: add
<code>CapturingSampler</code> to record what samplers receive in
instrumentation tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681 ">#5681</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all
violations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150 ">#5150</a>)</li>
<li>The public <code>opentelemetry.util.types.AttributeValue</code> type
in package <code>opentelemetry-api</code> is being expanded to include
<code>None</code>, heterogeneous sequences of primitive types (and
nested sequences) as opposed to only homogeneous primitive sequences,
and Mappings of strings to any primitive types or sequences/mappings
(which themselves must only contain primitive types or
sequences/mappings validated the same way). If a <code>bytes</code> type
is set as an attribute value in the SDK, it will no longer be utf-8
decoded to a string, instead it will be passed along as is in accordance
with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP
proto. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: add a
<code>max_request_size</code> argument to the OTLP HTTP exporters
(traces, logs, metrics); serialized requests larger than the limit are
dropped before sending, measured before compression. Defaults to 64 MiB
(enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369 ">#5369</a>)</li>
<li>[BREAKING] <code>opentelemetry-api</code>: subclasses of
<code>Logger</code> need to implement the <code>enabled</code> method
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use
shared opentelemetry-exporter-otlp-common and
opentelemetry-exporter-http-transport packages and switch default HTTP
backend to urllib3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389 ">#5389</a>)</li>
<li><code>opentelemetry-sdk</code>: unify logging force_flush timeout
defaults to 30000ms (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438 ">#5438</a>)</li>
<li><code>opentelemetry-python</code>: enable Ruff default ruleset and
fix auto-fixable lint issues (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491 ">#5491</a>)</li>
<li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now
drops spans ended after <code>shutdown()</code> instead of passing them
to the exporter, and counts them on
<code>otel.sdk.processor.span.processed</code> with
<code>error.type=already_shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512 ">#5512</a>)</li>
<li>Bump pytest to 9.0.3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518 ">#5518</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that
the <code>endpoint=</code> kwarg requires the full signal path (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633 ">#5633</a>)</li>
<li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658 ">#5658</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-configuration</code>: perform environment
variable substitution on scalar values after parsing the configuration
file, so <code>${VAR}</code> references inside comments and mapping keys
are no longer substituted and undefined references in comments no longer
abort loading (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407 ">#5407</a>)</li>
<li><code>opentelemetry-configuration</code>: declarative config
environment variable substitution now replaces an unset variable that
has no default with an empty value instead of raising an error, per the
configuration spec. Resource attributes whose value resolves to null (an
unset <code>${VAR}</code> with no default) are skipped with a warning
instead of being inserted as a null value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408 ">#5408</a>)</li>
<li>'scripts/build.sh<code>: add
</code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json`
to the package to release (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425 ">#5425</a>)</li>
<li><code>opentelemetry-sdk</code>: fix <code>View</code>
instrument-name matching so a view configured with an instrument's real
(mixed-case) name is applied; matching is now case-insensitive and
platform-independent instead of relying on <code>fnmatch</code>'s
OS-dependent case handling (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430 ">#5430</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md ">opentelemetry-api's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1 (2026-10-06)</h2>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type
aliases
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for
long running resource detectors
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default
HTTP transport so proxy environment variables such as
<code>HTTPS_PROXY</code> are
honored again
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header
and discard <code>tracestate</code> headers longer than 8192 characters
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0 (2026-09-25)</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource
attributes as metric labels
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute
values everywhere.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative
configuration — when set, maps the OTel <code>SeverityNumber</code>
value to a Python
logging level and applies it to the <code>opentelemetry</code> logger so
SDK internal
diagnostics respect the configured severity.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add
<code>log_record_limits</code> support to <code>LoggerProvider</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the
Logger API, SDK, and <code>LogRecordProcessor</code> to let
instrumentation skip
expensive work when logging is disabled
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/14971cef9c84c2354cbaf6871090896fad0f9a1a "><code>14971ce</code></a>
Prepare release 1.45.1/0.66b1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5752 ">#5752</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/44ac26edcee5cc99e03a65d6a1a9978775703e28 "><code>44ac26e</code></a>
opentelemetry-sdk: fix thread leak bug in resource initialization logic
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/570 ">#570</a>...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/a2ec3f91f1c2b735ccba177eaa77d6019a4428ae "><code>a2ec3f9</code></a>
[release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore
requ...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b "><code>d5224bf</code></a>
opentelemetry-api: improve performance of tracestate parsing (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5746 ">#5746</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5749 ">#5749</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/db61173a56475d4fa1276d16182e46b43db83b9e "><code>db61173</code></a>
Declare AnyValue and AttributeValue as explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5703 ">#5703</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5750 ">#5750</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2 "><code>4f0fcfa</code></a>
Prepare release 1.45.0/0.66b0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690 ">#5690</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9 "><code>9406f34</code></a>
opentelemetry-test-utils: add CapturingSampler for instrumentation tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681 ">#5681</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c "><code>1fe31a9</code></a>
fix: update W3CBaggagePropagator to properly handle whitespace (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680 ">#5680</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534 "><code>008b5b0</code></a>
feat(config): wire top-level attribute_limits into per-signal providers
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365 ">#5365</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1 "><code>edfad0c</code></a>
[opentelemetry-sdk] Fix overwriting of the service.instance.id which has
been...</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.39.1...v1.45.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-10-25 10:03:11 +00:00
dependabot[bot]
4136a6b763
chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/cli ( #9425 )
...
Bumps [setuptools](https://github.com/pypa/setuptools ) from 83.0.0 to
84.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/setuptools/blob/main/NEWS.rst ">setuptools's
changelog</a>.</em></p>
<blockquote>
<h1>v84.1.0</h1>
<h2>Features</h2>
<ul>
<li><code>setuptools.archive_util</code> now raises the new
<code>UnsafeMember</code> exception when
an archive member would be extracted outside of the extraction
directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding
a
quietly incomplete extraction, and matches the behavior of the standard
library's <code>tarfile</code> extraction filters.</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>Wheel.install_as_egg</code> no longer creates namespace package
directories
outside of the destination egg directory. Entries in a wheel's
<code>namespace_packages.txt</code> were split on <code>.</code> and
passed straight to
<code>os.path.join</code>, so an entry that was absolute,
drive-qualified, or UNC
discarded the destination and placed an <code>__init__.py</code> at a
path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.</p>
<p>This code path is reached only by the deprecated
<code>setup_requires</code>
mechanism when <code>setup()</code> is invoked outside a PEP 517
frontend; the
setuptools build backend never reaches it.</p>
</li>
<li>
<p><code>setuptools.archive_util</code> no longer extracts archive
members outside of the
requested extraction directory. Both the tar and zip formats specify
<code>/</code> as
the only path separator, but the guard against <code>..</code>
components split member
names on <code>/</code> alone, so a name such as
<code>..\escaped.txt</code> was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC
prefix
are now rejected on every platform, as are members whose resolved
destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.</p>
</li>
</ul>
<h1>v84.0.0</h1>
<h2>Features</h2>
<ul>
<li>Newline-separated <code>keywords</code> and
<code>platforms</code><code>pypa/setuptools#4887</code><code>old
specification <https://peps.python.org/pep-0345/> ;</code>_
separated items with spaces and the current one uses commas. (<a
href="https://redirect.github.com/pypa/setuptools/issues/4887 ">#4887</a>)</li>
<li><code>Extension</code><code>pypa/distutils#373</code><a
href="https://redirect.github.com/pypa/setuptools/issues/5022 ">#5022</a>)</li>
<li>The C compiler modules now emit log messages through their own
<code>compilers.C.*</code> loggers instead of the distutils root logger,
part of decoupling the compilers package from distutils. The logger
names are normalized to a stable <code>compilers.C.*</code> prefix so
they remain constant as the package migrates toward a standalone
<code>compilers.C</code> distribution. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5266 ">#5266</a>)</li>
<li>The C compilers gained a <code>Compiler.call</code> method -- a thin
wrapper over <code>subprocess.check_call</code> (with macOS
deployment-target env injection) that is the modern replacement for
<code>Compiler.spawn</code>. The compilers no longer depend on
<code>distutils.spawn</code>, <code>distutils.dir_util</code>,
<code>distutils.file_util</code>, <code>distutils._modified</code>, or
<code>distutils.util.execute</code>/<code>split_quoted</code>: the
generic <code>newer</code>/<code>newer_group</code> and
<code>split_quoted</code> helpers are vendored into the
<code>compilers</code> package, and
<code>Compiler.mkpath</code>/<code>move_file</code>/<code>execute</code>
are implemented directly on the standard library
(<code>os.makedirs</code>/<code>shutil.move</code>). The methods are
retained for backward compatibility. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5267 ">#5267</a>)</li>
<li>The compilers no longer depend on <code>distutils.util</code>,
<code>distutils.version</code>, <code>distutils.compat</code>, or
<code>distutils._macos_compat</code>. The platform-identification
helpers
(<code>get_platform</code>/<code>get_host_platform</code>/<code>is_mingw</code>)
now live in <code>distutils.compilers.platform.detect</code> and the
macOS deployment-target logic and <code>compiler_fixup</code> in
<code>distutils.compilers.platform.macos</code>;
<code>CygwinCCompiler.gcc_version</code> returns a
<code>packaging.version.Version</code>. <code>distutils.util</code>
re-exports the platform/macOS helpers from their new homes for backward
compatibility rather than keeping duplicate copies. (sysconfig lookups
still route through distutils pending its own decoupling.) (<a
href="https://redirect.github.com/pypa/setuptools/issues/5268 ">#5268</a>)</li>
<li>The compilers now read their build configuration from the standard
library's <code>sysconfig</code> instead of
<code>distutils.sysconfig</code>. Per-compiler customization --
previously <code>distutils.sysconfig.customize_compiler</code> -- has
moved into <code>Compiler.configure_system()</code>: a no-op on the base
class, with <code>UnixCCompiler</code> applying the
compiler/flag/archiver settings CPython recorded in
<code>sysconfig</code> (and the usual
<code>CC</code>/<code>CFLAGS</code>/<code>LDSHARED</code>/… environment
overrides). <code>distutils.sysconfig.customize_compiler</code> is
retained as a thin wrapper that calls
<code>compiler.configure_system()</code>. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5269 ">#5269</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/setuptools/commit/77b7ace0aaf660beeb9b3f9da4aabf21cbcf3fa9 "><code>77b7ace</code></a>
Bump version: 84.0.0 → 84.1.0</li>
<li><a
href="https://github.com/pypa/setuptools/commit/e66004c64eaf6cf2f8c53ccdfac75cf7abce7ccf "><code>e66004c</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5329 ">#5329</a>
from pypa/fix/wheel-namespace-path-escape</li>
<li><a
href="https://github.com/pypa/setuptools/commit/54b5dcadc1bd938a5a66919e8ab7bcd59805e7fd "><code>54b5dca</code></a>
Cover the containment check with a symlink escape test</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af "><code>6d07b8d</code></a>
Validate namespace package names during legacy wheel installation</li>
<li><a
href="https://github.com/pypa/setuptools/commit/8419f006d4e34c4ecfc7a0bd1bc6993855adc3cc "><code>8419f00</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5356 ">#5356</a>
from pypa/skeleton-ruff-0.16</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6dadc86a3f7dbe1cf49c6301548ffde61d4e74e1 "><code>6dadc86</code></a>
Remove DTZ011 suppressions that Ruff 0.17 reports as unused.</li>
<li><a
href="https://github.com/pypa/setuptools/commit/715ec38b46424533806195a96983e3dd70fdf3b9 "><code>715ec38</code></a>
Merge <a
href="https://github.com/jaraco/skeleton ">https://github.com/jaraco/skeleton </a></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9695460ebfa879ada16545d62b26b9a489a6d5ed "><code>9695460</code></a><code>jaraco/skeleton#219</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9e0812976b1154a7aece47188814385c887bc6c9 "><code>9e08129</code></a><code>jaraco/skeleton#216</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/4e612f9e44ecfad130d0b2a27a2dce0740599b4b "><code>4e612f9</code></a>
Ignore PyPy's deprecated check_home warning in tests</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:56:36 -07:00
dependabot[bot]
4f5740e53e
chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/langgraph ( #9426 )
...
Bumps [nbconvert](https://github.com/jupyter/nbconvert ) from 7.17.1 to
7.17.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/releases ">nbconvert's
releases</a>.</em></p>
<blockquote>
<h2>v7.17.2</h2>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327 ">#2327</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau "><code>@Carreau</code></a>, <a
href="https://github.com/claude "><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318 ">#2318</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/minrk "><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau "><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/claude "><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/minrk "><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/Yann-P "><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md ">nbconvert's
changelog</a>.</em></p>
<blockquote>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327 ">#2327</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau "><code>@Carreau</code></a>, <a
href="https://github.com/claude "><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318 ">#2318</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/minrk "><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau "><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/claude "><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/minrk "><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/Yann-P "><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/commit/e681152f214b65387f875aad96a4726994533a0b "><code>e681152</code></a>
Publish 7.17.2</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/8685e15e2d924fa39be38aeafb6ac859fc254ccc "><code>8685e15</code></a>
Fix CI: fetch the classic CSS from PyPI, update dead links</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f "><code>ce4bd99</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/1ff189e1b30f0820238e95427c035a9150a5e43f "><code>1ff189e</code></a>
Use org-level security policy (jupyter/.github/SECURITY.md) (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2318 ">#2318</a>)</li>
<li>See full diff in <a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...v7.17.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:55:35 -07:00
dependabot[bot]
225328f2f9
chore(deps): bump opentelemetry-api from 1.41.0 to 1.45.1 in /libs/cli ( #9423 )
...
Bumps
[opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python )
from 1.41.0 to 1.45.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/releases ">opentelemetry-api's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1</h2>
<p>This is a patch release on the previous 1.45.0/0.66b0 release, fixing
the issue(s) below.</p>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for long running resource detectors (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default HTTP transport so proxy environment
variables such as <code>HTTPS_PROXY</code> are honored again (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header and discard <code>tracestate</code>
headers longer than 8192 characters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource attributes as metric labels (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute values everywhere. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative configuration — when set,
maps the OTel <code>SeverityNumber</code> value to a Python logging
level and applies it to the <code>opentelemetry</code> logger so SDK
internal diagnostics respect the configured severity. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add <code>log_record_limits</code> support to
<code>LoggerProvider</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the Logger API, SDK, and
<code>LogRecordProcessor</code> to let instrumentation skip expensive
work when logging is disabled (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental
<code>tracer_configurator/development</code>,
<code>meter_configurator/development</code> and
<code>logger_configurator/development</code> fields into
<code>create_tracer_provider</code>, <code>create_meter_provider</code>
and <code>create_logger_provider</code>, so per-instrumentation-scope
<code>enabled</code> overrides declared in the config file are applied
to the provider (previously these fields were parsed but silently
discarded). The logger
<code>minimum_severity</code>/<code>trace_based</code> fields are not
supported by the Python SDK and are ignored with a warning. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418 ">#5418</a>)</li>
<li><code>docs/examples</code>: add example on how to manually setup the
SDK to get SDK metrics (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449 ">#5449</a>)</li>
<li><code>opentelemetry-docker-tests</code>: add Prometheus exporter
docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457 ">#5457</a>)</li>
<li><code>opentelemetry-sdk</code>: count records dropped after shutdown
on <code>otel.sdk.processor.{span,log}.processed</code> with
<code>error.type=already_shutdown</code> (batch span/log and simple log
processors), which the semantic conventions define as a valid value for
this metric. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509 ">#5509</a>)</li>
<li><code>opentelemetry-semantic-conventions</code>: update semantic
conventions to v1.44.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511 ">#5511</a>)</li>
<li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host
resource detector (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653 ">#5653</a>)</li>
<li><code>opentelemetry-test-utils</code>: add
<code>CapturingSampler</code> to record what samplers receive in
instrumentation tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681 ">#5681</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all
violations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150 ">#5150</a>)</li>
<li>The public <code>opentelemetry.util.types.AttributeValue</code> type
in package <code>opentelemetry-api</code> is being expanded to include
<code>None</code>, heterogeneous sequences of primitive types (and
nested sequences) as opposed to only homogeneous primitive sequences,
and Mappings of strings to any primitive types or sequences/mappings
(which themselves must only contain primitive types or
sequences/mappings validated the same way). If a <code>bytes</code> type
is set as an attribute value in the SDK, it will no longer be utf-8
decoded to a string, instead it will be passed along as is in accordance
with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP
proto. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: add a
<code>max_request_size</code> argument to the OTLP HTTP exporters
(traces, logs, metrics); serialized requests larger than the limit are
dropped before sending, measured before compression. Defaults to 64 MiB
(enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369 ">#5369</a>)</li>
<li>[BREAKING] <code>opentelemetry-api</code>: subclasses of
<code>Logger</code> need to implement the <code>enabled</code> method
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use
shared opentelemetry-exporter-otlp-common and
opentelemetry-exporter-http-transport packages and switch default HTTP
backend to urllib3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389 ">#5389</a>)</li>
<li><code>opentelemetry-sdk</code>: unify logging force_flush timeout
defaults to 30000ms (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438 ">#5438</a>)</li>
<li><code>opentelemetry-python</code>: enable Ruff default ruleset and
fix auto-fixable lint issues (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491 ">#5491</a>)</li>
<li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now
drops spans ended after <code>shutdown()</code> instead of passing them
to the exporter, and counts them on
<code>otel.sdk.processor.span.processed</code> with
<code>error.type=already_shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512 ">#5512</a>)</li>
<li>Bump pytest to 9.0.3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518 ">#5518</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that
the <code>endpoint=</code> kwarg requires the full signal path (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633 ">#5633</a>)</li>
<li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658 ">#5658</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-configuration</code>: perform environment
variable substitution on scalar values after parsing the configuration
file, so <code>${VAR}</code> references inside comments and mapping keys
are no longer substituted and undefined references in comments no longer
abort loading (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407 ">#5407</a>)</li>
<li><code>opentelemetry-configuration</code>: declarative config
environment variable substitution now replaces an unset variable that
has no default with an empty value instead of raising an error, per the
configuration spec. Resource attributes whose value resolves to null (an
unset <code>${VAR}</code> with no default) are skipped with a warning
instead of being inserted as a null value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408 ">#5408</a>)</li>
<li>'scripts/build.sh<code>: add
</code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json`
to the package to release (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425 ">#5425</a>)</li>
<li><code>opentelemetry-sdk</code>: fix <code>View</code>
instrument-name matching so a view configured with an instrument's real
(mixed-case) name is applied; matching is now case-insensitive and
platform-independent instead of relying on <code>fnmatch</code>'s
OS-dependent case handling (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430 ">#5430</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md ">opentelemetry-api's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1 (2026-10-06)</h2>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type
aliases
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for
long running resource detectors
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default
HTTP transport so proxy environment variables such as
<code>HTTPS_PROXY</code> are
honored again
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header
and discard <code>tracestate</code> headers longer than 8192 characters
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0 (2026-09-25)</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource
attributes as metric labels
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute
values everywhere.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative
configuration — when set, maps the OTel <code>SeverityNumber</code>
value to a Python
logging level and applies it to the <code>opentelemetry</code> logger so
SDK internal
diagnostics respect the configured severity.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add
<code>log_record_limits</code> support to <code>LoggerProvider</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the
Logger API, SDK, and <code>LogRecordProcessor</code> to let
instrumentation skip
expensive work when logging is disabled
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/14971cef9c84c2354cbaf6871090896fad0f9a1a "><code>14971ce</code></a>
Prepare release 1.45.1/0.66b1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5752 ">#5752</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/44ac26edcee5cc99e03a65d6a1a9978775703e28 "><code>44ac26e</code></a>
opentelemetry-sdk: fix thread leak bug in resource initialization logic
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/570 ">#570</a>...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/a2ec3f91f1c2b735ccba177eaa77d6019a4428ae "><code>a2ec3f9</code></a>
[release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore
requ...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b "><code>d5224bf</code></a>
opentelemetry-api: improve performance of tracestate parsing (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5746 ">#5746</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5749 ">#5749</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/db61173a56475d4fa1276d16182e46b43db83b9e "><code>db61173</code></a>
Declare AnyValue and AttributeValue as explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5703 ">#5703</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5750 ">#5750</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2 "><code>4f0fcfa</code></a>
Prepare release 1.45.0/0.66b0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690 ">#5690</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9 "><code>9406f34</code></a>
opentelemetry-test-utils: add CapturingSampler for instrumentation tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681 ">#5681</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c "><code>1fe31a9</code></a>
fix: update W3CBaggagePropagator to properly handle whitespace (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680 ">#5680</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534 "><code>008b5b0</code></a>
feat(config): wire top-level attribute_limits into per-signal providers
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365 ">#5365</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1 "><code>edfad0c</code></a>
[opentelemetry-sdk] Fix overwriting of the service.instance.id which has
been...</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.41.0...v1.45.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:55:05 -07:00
Elior Nataf Lackritz
4c52e129eb
release(langgraph): 1.2.17 ( #9418 )
...
Bumps langgraph from 1.2.16 to 1.2.17.
Includes:
- Apply an explicit `recursion_limit` equal to the default (#9417 )
- Keep the caller's namespace in `RemoteGraph.stream(subgraphs=True)`
(#9401 )
2026-10-24 01:02:32 +00:00
Elior Nataf Lackritz
6c4ceb1332
fix(langgraph): apply an explicit recursion_limit equal to the default ( #9417 )
...
Fixes #9416 .
`merge_configs` decided whether a `recursion_limit` was set by comparing
it with `DEFAULT_RECURSION_LIMIT`, so an explicit limit equal to the
default was dropped. `LANGGRAPH_DEFAULT_RECURSION_LIMIT` sets that
default, so with it at 1000, `agent.with_config(recursion_limit=1000)`
silently kept the 9999 that `create_agent` and `create_deep_agent` bind,
and a looping agent ran to 9999 steps.
The default is now a sentinel, as #7313 proposed: `ensure_config` fills
in one `int` subclass instance, and `merge_configs` skips that exact
object instead of any equal value. The filled-in default still never
overrides a bound limit (a subgraph bound to 50 keeps 50 when its parent
runs at the default), while an explicit limit equal to the default now
applies wherever configs are merged: `with_config`, `RemoteGraph` calls,
and the limit a parent passes to its subgraphs.
langchain-core has the same check in its own `merge_configs`
(langchain-ai/langchain#39994 ); this PR does not touch it.
Thanks @awg66 for the report and the repro.
2026-10-24 00:56:19 +00:00
Elior Nataf Lackritz
4897c51365
fix(langgraph): keep the caller's namespace in RemoteGraph.stream(subgraphs=True) ( #9401 )
...
`RemoteGraph.stream(..., subgraphs=True)` and `astream` dropped the
caller's namespace prefix from the events they yield. Called inside a
node of a graph running under `outer:123`, a remote subgraph event came
back as `("sub:abc",)` instead of `("outer:123", "sub:abc")`, while the
events RemoteGraph pushes to the parent graph's stream, and an in-memory
subgraph streamed the same way, keep the prefix. Fixes #6604 .
The `subgraphs` branch parsed the namespace from the event name a second
time, after the caller prefix was added. This removes that second parse
in `stream` and `astream`.
The new tests fail on `main`.
Same fix as #6605 by @Rakshit-gen.
Co-authored-by: Rakshit Sisodiya
<64471316+rakshit-gen@users.noreply.github.com >
2026-10-23 19:24:04 -04:00
ataller-lc
eb066bd31a
release(cli): 0.4.38 ( #9411 )
...
Bumps the CLI to 0.4.38 to cut a release including #9393 (the `priority`
section in `langgraph.json`), the only CLI change merged since 0.4.37.
The section takes effect with `langgraph-api` 0.18.0 or later; older
servers ignore it, and configs without it build the same images as
before.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-23 14:18:08 +00:00
ataller-lc
6b83b9b019
release(sdk-py): 0.4.9 ( #9398 )
...
Bumps the Python SDK version from 0.4.8 to 0.4.9. Adds `Priority`
(beta), which lets a deployment set each thread's priority settings in
its own code (#9392 ); it needs `langgraph-api` 0.18.0 or later and a
`langgraph-cli` that supports the `priority` section. Also picks up the
`certifi` bump (#9370 ).
2026-10-23 09:32:43 -04:00
ataller-lc
9d68e5b3eb
feat(cli): add the priority section to langgraph.json ( #9393 )
...
`langgraph.json` gets a `priority` section that names a `Priority`
object from `langgraph_sdk` (#9392 ), as `auth` and `encryption` name
theirs:
```json
"priority": {"path": "./priority.py:priority"}
```
- The path must be `file.py:name` or `module:name`, as for `encryption`.
It must point to Python: JavaScript and TypeScript files are rejected. A
Node.js-only project can still name a Python file, since the callback
runs in the Python server, as `encryption` does.
- Image builds rewrite the path to its location in the image, for both
`dependencies`-based and `uv`-source projects, and write `ENV
LANGGRAPH_PRIORITY` into the Dockerfile.
- `langgraph dev` passes `priority` to the server. A server that doesn't
read the section ignores it.
- `PriorityConfig` is in the JSON schema (`make update-schema`).
## Test plan
- [x] New unit tests next to the `encryption` ones: `LANGGRAPH_PRIORITY`
with the rewritten path from both builders, a path outside
`dependencies`, a malformed path, the six JS and TS extensions, a
Node.js-only project with a Python path, the section kept by validation
and not reported as unknown, and `langgraph dev` passing it to the
server. Each one fails when the change it covers is removed.
- [x] `make test` in `libs/cli`: 586 passed. `make lint` clean, and
`make update-schema` leaves no diff.
2026-10-22 17:26:01 -04:00
ataller-lc
544386f6cc
feat(sdk-py): add Priority for thread priority settings ( #9392 )
...
`Priority` lets a deployment decide each thread's run priority in its
own code, declared the way `Auth` and `Encryption` are: an object in the
project, named by a `priority` section in `langgraph.json`. It's beta,
and construction warns like `Encryption()` does.
```python
from langgraph_sdk import Priority, PriorityContext, PrioritySettings
priority = Priority()
@priority.assign
async def assign(ctx: PriorityContext) -> PrioritySettings | None:
return {"priority": 3 if "premium" in ctx.permissions else 0}
```
- The server calls the function at the first run on a thread with no
settings and stores what it returns on the thread. Later runs on the
thread use the stored settings.
- `PriorityContext` is a frozen dataclass: the user and their
permissions, the thread's ID (`None` when the run creates its thread
without one) and metadata, the assistant and graph IDs, the assistant's
and the run's metadata, and the cron ID when a cron started the run.
- `PrioritySettings` has three optional keys: `priority` (-5 to 5, 5
runs first), `fairness_group` (a non-empty string, stored unencrypted,
so an opaque ID rather than personal data) and `fairness_weight` (1 to
100). A missing key, `None`, or a `None` return takes the default: 0,
`"default"`, 1.
- `@priority.assign` takes one async function with one parameter and
raises on a second registration. It reuses `DuplicateHandlerError` and
`LangGraphBetaWarning` from `langgraph_sdk.encryption`.
- `Priority`, `PriorityContext` and `PrioritySettings` are exported from
`langgraph_sdk`; the types are also on `Priority.types`.
## Test plan
- [x] New unit tests in `tests/test_priority.py`: registration and its
checks, the exports, a frozen context that accepts `thread_id=None`,
every settings key optional, the beta warning. Each one fails when the
check it covers is removed.
- [x] `make test` in `libs/sdk-py`: 561 passed. `make lint` clean,
`check_sdk_methods.py` passes.
2026-10-22 17:25:38 -04:00
c2df8ab04b
chore(deps): remove precautionary third-party upper bounds ( #9390 )
...
Remove only the precautionary `websockets<17` ceiling from
`langgraph-sdk`, keeping `websockets>=14` and every first-party
dependency range unchanged. Refresh mirrored lock metadata without
changing resolved versions, Python support, or development/build
constraints.
AI assistance: implemented with Open SWE.
## References
-
[Plan](https://openswe.langchain.dev/agents/8ca5d7fe-ecc3-5d70-9b14-d2904a2c0948/plan )
- [Slack
thread](https://langchain.slack.com/archives/C0C5950ARJT/p1792630605250939 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/8ca5d7fe-ecc3-5d70-9b14-d2904a2c0948 )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Mason Daugherty <mdrxy@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-22 16:27:58 -04:00
3cd57c038a
fix(checkpoint): reject NUL bytes in namespace labels ( #9383 )
...
Reject NUL bytes in namespace labels with `InvalidNamespaceError` to
prevent SQLite GLOB truncation from bypassing namespace segment
boundaries. Add shared sync/async validation coverage and a SQLite
regression for public search and direct batch operations against
in-memory and file-backed stores.
## References
- [Slack
thread](https://langchain.slack.com/archives/D0B5PRNJA05/p1792583492031829 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/9499abf7-c3c8-5004-ac28-fe55d4955ae6 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-21 21:22:40 +09:00
dependabot[bot]
4098bb138c
chore(deps): bump uv from 0.11.15 to 0.13.4 in /libs/cli ( #9366 )
...
Bumps [uv](https://github.com/astral-sh/uv ) from 0.11.15 to 0.13.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases ">uv's
releases</a>.</em></p>
<blockquote>
<h2>0.13.4</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-20.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62 ">GHSA-hq85-5cpj-mr62</a>,
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.</p>
<h3>Preview features</h3>
<ul>
<li>Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22512 ">#22512</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Update the bundled Mozilla root certificates via
<code>webpki-root-certs</code> 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22760 ">#22760</a>)</li>
</ul>
<h2>Install uv 0.13.4</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1
| iex"
</code></pre>
<h2>Download uv 0.13.4</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz ">uv-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz ">uv-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip ">uv-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-pc-windows-msvc.zip ">uv-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip ">uv-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz ">uv-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-gnu.tar.gz ">uv-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-powerpc64le-unknown-linux-gnu.tar.gz ">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-gnu.tar.gz ">uv-riscv64gc-unknown-linux-gnu.tar.gz</a></td>
<td>RISCV Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-s390x-unknown-linux-gnu.tar.gz ">uv-s390x-unknown-linux-gnu.tar.gz</a></td>
<td>S390x Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-s390x-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz ">uv-x86_64-unknown-linux-gnu.tar.gz</a></td>
<td>x64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-armv7-unknown-linux-gnueabihf.tar.gz ">uv-armv7-unknown-linux-gnueabihf.tar.gz</a></td>
<td>ARMv7 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz ">uv-aarch64-unknown-linux-musl.tar.gz</a></td>
<td>ARM64 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-musl.tar.gz ">uv-i686-unknown-linux-musl.tar.gz</a></td>
<td>x86 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-musl.tar.gz ">uv-riscv64gc-unknown-linux-musl.tar.gz</a></td>
<td>RISCV MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz ">uv-x86_64-unknown-linux-musl.tar.gz</a></td>
<td>x64 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-arm-unknown-linux-musleabihf.tar.gz ">uv-arm-unknown-linux-musleabihf.tar.gz</a></td>
<td>ARMv6 MUSL Linux (Hardfloat)</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-arm-unknown-linux-musleabihf.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md ">uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.13.4</h2>
<p>Released on 2026-10-20.</p>
<h3>Preview features</h3>
<ul>
<li>Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22512 ">#22512</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Update the bundled Mozilla root certificates via
<code>webpki-root-certs</code> 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22760 ">#22760</a>)</li>
</ul>
<h2>0.13.3</h2>
<p>Released on 2026-10-20.</p>
<h3>Performance</h3>
<ul>
<li>Avoid severe <code>uv export</code> slowdowns in dependency graphs
with extras (<a
href="https://redirect.github.com/astral-sh/uv/pull/22750 ">#22750</a>)</li>
</ul>
<h2>0.13.2</h2>
<p>Released on 2026-10-19.</p>
<h3>Enhancements</h3>
<ul>
<li>Report all installed packages in <code>uv workspace metadata</code>,
including packages outside the selected resolution (<a
href="https://redirect.github.com/astral-sh/uv/pull/22395 ">#22395</a>)</li>
<li>Include supported environment restrictions when exporting
<code>pylock.toml</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22596 ">#22596</a>)</li>
<li>Retry dropped GET and HEAD requests when fetching package and index
data (<a
href="https://redirect.github.com/astral-sh/uv/pull/22672 ">#22672</a>)</li>
<li>Preserve encoding declarations in wheel data scripts that require
shell launchers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22526 ">#22526</a>)</li>
<li>Show causes and hints when <code>uv python find --script</code>
cannot discover an interpreter, including with <code>-q</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22549 ">#22549</a>)</li>
<li>Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh (<a
href="https://redirect.github.com/astral-sh/uv/pull/22538 ">#22538</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22572 ">#22572</a>)</li>
<li>Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's <code>[build-system].requires</code>
validation (<a
href="https://redirect.github.com/astral-sh/uv/pull/22577 ">#22577</a>)</li>
</ul>
<h3>Python</h3>
<ul>
<li>Add PyPy 3.11.17 and 3.12.15 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22578 ">#22578</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Fetch and parse PEP 825 index-level variant metadata with
<code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22509 ">#22509</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22511 ">#22511</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22608 ">#22608</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22615 ">#22615</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22651 ">#22651</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22674 ">#22674</a>)</li>
<li>Reduce the time and memory used to parse and store complex
dependency markers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22675 ">#22675</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22676 ">#22676</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22681 ">#22681</a>)</li>
<li>Reduce resolver memory use for large dependency graphs, forks,
extras, and dependency groups (<a
href="https://redirect.github.com/astral-sh/uv/pull/22565 ">#22565</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22625 ">#22625</a>)</li>
<li>Speed up project discovery in large workspaces by caching member
names (<a
href="https://redirect.github.com/astral-sh/uv/pull/22635 ">#22635</a>)</li>
<li>Reduce uv's binary size and speed up CycloneDX exports (<a
href="https://redirect.github.com/astral-sh/uv/pull/22431 ">#22431</a>)</li>
<li>Reduce <code>uv-build</code> binary size, including Linux x86_64
wheels (<a
href="https://redirect.github.com/astral-sh/uv/pull/22539 ">#22539</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22573 ">#22573</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/7456b60bc6bc348e13e06e3691bf08e78d3aef54 "><code>7456b60</code></a>
Bump version to 0.13.4 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22761 ">#22761</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0a7aa9ddf7009f6a7c5496eb7036ec7e93527ef7 "><code>0a7aa9d</code></a>
Switch back to env::args_os (<a
href="https://redirect.github.com/astral-sh/uv/issues/22763 ">#22763</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5bae848da3626fe9c6a2463339752e11666d37ae "><code>5bae848</code></a>
Update certifi to 2026.10.19 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22762 ">#22762</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/158c9d35c592747ab6e94d4e66a0bb8f1b387c0c "><code>158c9d3</code></a>
Bump webpki-root-certs to 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22760 ">#22760</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5280ad3833e0a714a5a95ba435ff22419fc60843 "><code>5280ad3</code></a>
Parse and validate variant metadata (<a
href="https://redirect.github.com/astral-sh/uv/issues/22512 ">#22512</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/8d1626698d1ad5eafd7d4427a4d893fc7c0d3960 "><code>8d16266</code></a>
Use indoc for multiline test strings (<a
href="https://redirect.github.com/astral-sh/uv/issues/22723 ">#22723</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/502f93ca6145cbc78bfb9dd6bb37fa05340be0b3 "><code>502f93c</code></a>
Bump version to 0.13.3 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22752 ">#22752</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0595a1120c1bbc71c89bf99b3c9b1edb7a37fc79 "><code>0595a11</code></a>
Revert optional-extra activation tracking in exports (<a
href="https://redirect.github.com/astral-sh/uv/issues/22750 ">#22750</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b2eb713620a60e4314df8647f93ddca2bd357820 "><code>b2eb713</code></a>
Deserialize build metadata contacts in one pass (<a
href="https://redirect.github.com/astral-sh/uv/issues/22748 ">#22748</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b98692400b73dc7236be47647e03f5d755b7525a "><code>b986924</code></a>
Borrow the uv-build command argument (<a
href="https://redirect.github.com/astral-sh/uv/issues/22747 ">#22747</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.11.15...0.13.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:39:47 +01:00
dependabot[bot]
6f874e9878
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/langgraph ( #9375 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:12:01 +01:00
dependabot[bot]
7d9a670710
chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in /libs/cli ( #9374 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.2.25 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:55 +01:00
dependabot[bot]
c6b7486550
chore(deps): bump the uv group across 2 directories with 1 update ( #9373 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory: [certifi](https://github.com/certifi/python-certifi ).
Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple
directory: [certifi](https://github.com/certifi/python-certifi ).
Updates `certifi` from 2026.2.25 to 2026.10.19
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `certifi` from 2026.5.20 to 2026.10.19
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:49 +01:00
dependabot[bot]
9c1a4efc96
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint ( #9372 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:43 +01:00
dependabot[bot]
283855b817
chore(deps): bump certifi from 2026.4.22 to 2026.10.19 in /libs/checkpoint-conformance ( #9371 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.4.22 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.04.22...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:37 +01:00
dependabot[bot]
8c10fbdc04
chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in /libs/sdk-py ( #9370 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.2.25 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:30 +01:00
dependabot[bot]
a3ca41eb1b
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint-postgres ( #9369 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:23 +01:00
dependabot[bot]
264535917f
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint-sqlite ( #9368 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:17 +01:00
dependabot[bot]
4de8792dc4
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/prebuilt ( #9367 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:10:39 +01:00
a24fc97778
fix(cli): patch missed brace-expansion dependency majors ( #9360 )
...
Patch the remaining 1.x and 2.x copies covered by
[GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr ),
which were not addressed by #9349 . Regenerate both CLI fixture locks
with their declared Yarn 1.22.22: 1.1.11/1.1.12 → 1.1.21 and 2.0.2 →
2.1.7, retaining 5.0.12 with no new packages or manifest changes.
Verification:
- Both fixtures: `yarn install --frozen-lockfile --ignore-scripts
--non-interactive` and `yarn check --integrity --ignore-scripts` passed.
- Local Node regression harness: 16 checks passed across all installed
brace-expansion and real minimatch 3/9/10 consumers, including normal
expansion/matching and advisory-shaped DoS payloads with a three-second
subprocess deadline (direct 128k braces; minimatch 64k braces).
- Every tracked text file scanned for brace-expansion; all five resolved
lock entries are outside all four current advisory ranges. No additional
repository copies found.
- `git diff --check` passed; only three generated version/URL/integrity
triplets changed.
Lifecycle scripts and the full suite were intentionally not run.
Existing peer-dependency warnings remain, including the checkpoint
resolution mismatch in js-examples; dependency-graph ingestion and alert
status were not refreshed or claimed resolved.
## References
-
[Plan](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846/plan )
- [Slack
thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-20 11:09:26 +01:00
Elior Nataf Lackritz
1400d25b7b
release(cli): 0.4.37 ( #9351 )
...
Bumps the CLI to 0.4.37 to cut a release including #9333 (`langgraph
deploy` defaults to serverless) and #9350 (`--verbose` no longer prints
subprocess stdin), the two CLI changes merged since 0.4.36.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-19 10:03:29 -04:00
Elior Nataf Lackritz
7b23a10846
fix(cli): stop printing subprocess stdin in verbose output ( #9350 )
...
`--verbose` printed each subprocess command followed by everything piped
to its stdin, which can hold credentials. It now prints only the command
line, so `langgraph up --verbose`, `langgraph build` and `langgraph
deploy --verbose` no longer show the generated compose file or
Dockerfile (`langgraph dockerfile` still writes the Dockerfile out).
2026-10-19 13:45:42 +00:00
8b9c1a1301
Merge PR #9349
...
Update brace-expansion from 5.0.9 to 5.0.12 in both CLI JavaScript
example lockfiles to address CVE-2026-102277. Existing dependency ranges
already allow the patched version; no manifests or runtime code change.
Verification: generated the replacement entries with the declared Yarn
1.22.22 in an isolated dependency fixture, then checked basic
brace/range expansion and `git diff --check`. Full example installs were
attempted but blocked by registry.yarnpkg.com DNS/timeouts, including
with npm selected as the registry; only the authentic generated package
entries were transferred, preserving unrelated resolutions. Full package
lint/tests were not run and CI is not claimed.
## References
- [Slack
thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-19 21:47:25 +09:00
98043c37ab
fix(cli): default deploy to serverless ( #9333 )
...
- Default new deployments to serverless, preserving explicit
deployment-type overrides.
- Let the backend determine AWS serverless availability; preserve its
rejection and append guidance to use --deployment-type dev. Do not
detect AWS hostnames, block attempts locally, or silently fall back.
- Serverless deployment on AWS works without another CLI change once the
backend supports it.
## References
- [Slack
thread](https://langchain.slack.com/archives/C0BHM1C5R5L/p1792175194359579 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/c71525bc-e760-503e-b187-6997859056c1 )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Hari Dhanushkodi <hari-dhanushkodi@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-18 15:18:50 -04:00
0870f5efce
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 9 updates ( #9152 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.9` | `1.2.13` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.13` | `1.4.18` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc ) | `3.3.6` |
`3.3.7` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.68.0` | `8.70.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.68.0` | `8.70.1` |
| [eslint](https://github.com/eslint/eslint ) | `10.9.1` | `10.11.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest ) |
`30.5.0` | `30.5.2` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.6` | `3.9.9` |
| [ts-jest](https://github.com/kulshekhar/ts-jest ) | `29.4.12` |
`29.4.14` |
Updates `@langchain/core` from 1.2.9 to 1.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.13</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11714 ">#11714</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1 "><code>a83dfb1</code></a>
Thanks <a href="https://github.com/ccurme "><code>@ccurme</code></a>! -
Abbreviate long tool-call IDs when formatting chat messages as strings,
keeping original messages unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.12</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11675 ">#11675</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/030a726639e0147488bc8c23c063a2e72b004c2e "><code>030a726</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Preserve structured tool arguments in tracer run inputs.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11603 ">#11603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/fec9cd87b01976014dd549bd2cf7849aee89a566 "><code>fec9cd8</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- fix(core): build streaming <code>llmOutput.tokenUsage</code> from the
fully-accumulated chunk instead of whichever individual chunk's
<code>usage_metadata</code> arrived last</p>
<p>Affects both core streaming paths —
<code>.stream()</code>/<code>.streamEvents()</code>
(<code>_streamIterator</code>) and
<code>.invoke()</code>/<code>.generate()</code> when a
streaming-preferring callback is attached
(<code>_generateWithCache</code>'s <code>hasStreamingHandler</code>
branch). Previously, <code>llmOutput.tokenUsage</code> was overwritten
by each chunk in turn, so only the last chunk carrying
<code>usage_metadata</code> won — correct for providers that emit one
cumulative total on a final chunk, but wrong for providers (e.g.
<code>@langchain/google</code>, <code>@langchain/anthropic</code>) that
emit <code>usage_metadata</code> as a per-chunk delta across multiple
chunks, where the values must be summed.</p>
<p>Note for provider authors: this assumes each streamed chunk's
<code>usage_metadata</code> is either a per-chunk delta or appears only
on a single final chunk. A provider that instead repeats a cumulative
total on every chunk will now see it summed (and inflated) in
<code>llmOutput.tokenUsage</code>, matching the existing behavior of the
correctly-working <code>message.usage_metadata</code> field.</p>
<p>Also fixes <code>@langchain/google</code>'s <code>invoke({streaming:
true})</code> path (no streaming-preferring callback attached), where
<code>llmOutput</code> was never populated at all.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11590 ">#11590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ffebdc2f00f3290d19f85e5afd6a297920ae584c "><code>ffebdc2</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- Fix OpenAI Responses API replay under Zero Data Retention when a
response contains more than one reasoning item, for both v0 and v1. In
v0, the default replay path now reuses
<code>response_metadata.output</code> directly, preserving every
reasoning item's <code>id</code>/<code>encrypted_content</code> in
original order. In v1, <code>AIMessage.contentBlocks</code>
(<code>outputVersion: "v1"</code>) is fixed the same way.
<code>additional_kwargs.reasoning</code> is unchanged.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10047 ">#10047</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ff1248fd49dacdb35f5da128278cd777068481d7 "><code>ff1248f</code></a>
Thanks <a
href="https://github.com/afirstenberg "><code>@afirstenberg</code></a>!
- fix(core): BaseMessage.text use contentBlocks</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8d12783ecc31a0816f3a47da1040fbd3c08fdbc "><code>c8d1278</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11729 ">#11729</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5d509ad4b8a5ed9dd4b83020b4c103ac8a69859c "><code>5d509ad</code></a>
fix(openai): send in-memory prompt cache retention as in_memory (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11735 ">#11735</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/663b9a2076c5b274435c77524ad7730450b34f34 "><code>663b9a2</code></a>
feat(openai): support explicit prompt caching (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11232 ">#11232</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7735b219221d6ae63eb5445fb67d26c18fce9c46 "><code>7735b21</code></a>
chore(infra): drop held mcp-adapters 2.0 changeset to unblock main
releases (...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/34edee1153f0fa40ba6997c8ff7bd45834ca8ce8 "><code>34edee1</code></a>
fix(langchain): return failed returnDirect tool calls to the model (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11712 ">#11712</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0fcb98b4306a771c940e78d6881d0be9f88507c1 "><code>0fcb98b</code></a>
fix(textsplitters): use char length for loc.lines with custom
lengthFunction ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e4a3d1bd0c6753d4e1739a7f10064f48e6bc49ec "><code>e4a3d1b</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11683 ">#11683</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a9ada857f22c4b746801e7723ffaa4c4d59db771 "><code>a9ada85</code></a>
fix(openai): send tool result images so the model can see them (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11690 ">#11690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/485d030054ff599beea7d1070d87cac22bcef3cc "><code>485d030</code></a>
chore(mcp-adapters): hold the adapter out of releases until 2.0 is ready
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11 ">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1 "><code>a83dfb1</code></a>
fix(core): abbreviate long tool IDs in buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11714 ">#11714</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.9...@langchain/core@1.2.13 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.13 to 1.4.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.18-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0-rc.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.17</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861 ">#2861</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
Thanks <a href="https://github.com/casparb "><code>@casparb</code></a>!
- Add <code>GraphCallbackHandler</code> with typed
<code>handleInterrupt</code> and <code>handleResume</code> events
through normal callback configuration, matching Python graph lifecycle
behavior. Lifecycle callbacks are awaited before terminal chain
callbacks and work independently of stream mode.</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.16</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824 ">#2824</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- feat(langgraph): add <code>responseSchema</code> option to
<code>interrupt()</code></p>
<p><code>interrupt(value, { responseSchema })</code> lets a graph
declare the shape of the
value it expects on resume. A Zod schema validates the resume value and
the
parsed result is what <code>interrupt()</code> returns; a raw JSON
Schema object is passed
through as-is. The schema is surfaced on
<code>Interrupt.response_schema</code> so clients
such as Studio can render a typed form instead of a free-form JSON
editor.
Omitting the option keeps today's behavior.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.1</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.15</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
<p>Matches Python's callback-level behavior: transforms also affect
chain events and message streaming, so omitting outputs can suppress
messages returned directly by nodes and omitting inputs can affect
message deduplication.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a "><code>11a4535</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a "><code>4fc118f</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69 "><code>db4bdad</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22 "><code>55fa26b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.15-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>]:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0</li>
</ul>
</li>
</ul>
<h2>1.4.18-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0-rc.0</li>
</ul>
</li>
</ul>
<h2>1.4.17</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861 ">#2861</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
Thanks <a href="https://github.com/casparb "><code>@casparb</code></a>!
- Add <code>GraphCallbackHandler</code> with typed
<code>handleInterrupt</code> and <code>handleResume</code> events
through normal callback configuration, matching Python graph lifecycle
behavior. Lifecycle callbacks are awaited before terminal chain
callbacks and work independently of stream mode.</li>
</ul>
<h2>1.4.16</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824 ">#2824</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- feat(langgraph): add <code>responseSchema</code> option to
<code>interrupt()</code></p>
<p><code>interrupt(value, { responseSchema })</code> lets a graph
declare the shape of the
value it expects on resume. A Zod schema validates the resume value and
the
parsed result is what <code>interrupt()</code> returns; a raw JSON
Schema object is passed
through as-is. The schema is surfaced on
<code>Interrupt.response_schema</code> so clients
such as Studio can render a typed form instead of a free-form JSON
editor.
Omitting the option keeps today's behavior.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.1</li>
</ul>
</li>
</ul>
<h2>1.4.15</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
<p>Matches Python's callback-level behavior: transforms also affect
chain events and message streaming, so omitting outputs can suppress
messages returned directly by nodes and omitting inputs can affect
message deduplication.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a "><code>11a4535</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a "><code>4fc118f</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69 "><code>db4bdad</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22 "><code>55fa26b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.0</li>
</ul>
</li>
</ul>
<h2>1.4.15-rc.0</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec8cb378e3c7846b2a4aea31dfc4aff8f1cbf2fb "><code>ec8cb37</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2870 ">#2870</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/285ed3d60c51a90c2d5698f617d6ad7ce3048ef2 "><code>285ed3d</code></a>
chore: version packages (rc) (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2868 ">#2868</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3dd35b6d0c4d7e5d2499ce44d85ecb0c0a34e1fd "><code>3dd35b6</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2862 ">#2862</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
feat(langgraph): add graph lifecycle callbacks (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2861 ">#2861</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec67d5d70dc26341e92a0962d9d2f4018c310b39 "><code>ec67d5d</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2852 ">#2852</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
feat(langgraph): add responseSchema option to interrupt() (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2824 ">#2824</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/592fd0cab0fd9287fab1b7c7fcfd4abc44675700 "><code>592fd0c</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2832 ">#2832</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a3172e045b36b00244512260b041e472b915c39b "><code>a3172e0</code></a>
revert(langgraph): <code>tracePolicy</code> (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2834 ">#2834</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a97e6f4eaf8683cd67002bc42cf8dddf5255e29d "><code>a97e6f4</code></a>
chore(deps): patch vulnerable browser and example dependencies (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2822 ">#2822</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6fb9a3fe43d0e4d600fbf413392343d7242ccb63 "><code>6fb9a3f</code></a>
chore(deps): bump vitest from 4.1.10 to 4.1.11 (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2818 ">#2818</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.18/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/releases ">@eslint/eslintrc's
releases</a>.</em></p>
<blockquote>
<h2>eslintrc: v3.3.7</h2>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md ">@eslint/eslintrc's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslintrc/commit/7943fa6dd55b236a539f658b88c763a4f9fbb38d "><code>7943fa6</code></a>
chore: release 3.3.7 🚀 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/240 ">#240</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f "><code>bb0d97a</code></a>
fix: update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/5b4abc9c74dd92b9eb782ca81d559a88906509e9 "><code>5b4abc9</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 "><code>f27e7c9</code></a>
fix: Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/b75e1d2425deebfd1ec7f952dda7d0c4f4d65d5c "><code>b75e1d2</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/302c13310e148268f990df3edbfd10dab44f2678 "><code>302c133</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/e62e7661b0d9063e42a37af5551bbcb1897e188d "><code>e62e766</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/cf27f9fd8f775d94500f2569a5bfb6a7de9cdb33 "><code>cf27f9f</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/c7f4cdf1ffa86e28b5b8bf09f9e8bc7fadbf87ff "><code>c7f4cdf</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/3319822ac925e018c47fcafa351b20ea0bf6eeff "><code>3319822</code></a>
docs: Update README sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>Vinccool96</li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] add
rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12730 ">#12730</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
imported values used in object shorthand properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12780 ">#12780</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] no false
positive on RHS of a nested logical expression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12728 ">#12728</a>)</li>
<li><strong>eslint-plugin:</strong> [member-ordering] don't report
fields that read fields declared before them (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12729 ">#12729</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9d82e4b1d9011da31d62d14387bb5a539853fafa "><code>9d82e4b</code></a>
chore: expand eslint-plugin rules test files glob (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12878 ">#12878</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f7482f636b89b8eab966b4191ce4a53a3f4b4d9c "><code>f7482f6</code></a>
fix(eslint-plugin): [no-misused-promises] handle multiple Promise
constituent...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/267304477e04538614fe72ad71e7e13082eb7a90 "><code>2673044</code></a>
docs(eslint-plugin): [prefer-promise-reject-errors] add option sections
and e...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f141a2ba63d539465eb4e4604f7d79f6f50ce14 "><code>8f141a2</code></a>
fix(eslint-plugin): [no-useless-default-assignment] convert the fixer to
a su...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/479cd85ff82b81dbec9989621681257ebc317a69 "><code>479cd85</code></a>
chore: enable assertion option <code>requireData</code> for all rule
tests (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12816 ">#12816</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f3c190c5b5cfa9edaba15fa3f944a76a7364b3ed "><code>f3c190c</code></a>
fix(eslint-plugin): [no-unnecessary-condition] handle union-keyed index
acces...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b1993dfd3c45b2c2d83058627499f1dfec5d6d2c "><code>b1993df</code></a>
fix(eslint-plugin): [unbound-method] treat
Intl.Collator.prototype.compare as...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/da394bc9c21afe97f456040da723d2c558f99658 "><code>da394bc</code></a>
fix(eslint-plugin): [no-unnecessary-parameter-property-assignment]
account fo...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4a742ff890b7cca8cbf79e78a9a3b345913094c6 "><code>4a742ff</code></a>
fix(eslint-plugin): [await-thenable] prevent autofix from breaking code
when ...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.69.0 (2026-08-31)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.69.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7ee76085c22e923c0036b8e0733a3ca7dfd82b60 "><code>7ee7608</code></a>
chore(release): publish 8.70.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9a6e546823e5d8f2dc015df2aa66c0230615e209 "><code>9a6e546</code></a>
chore(release): publish 8.69.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.9.1 to 10.11.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.11.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21271 ">#21271</a>)
(Pavel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/397b3b8134b8ce1a61cbf414d4c29c945ba25690 "><code>397b3b8</code></a>
feat: report unsafe labeled <code>continue</code> in
<code>no-unsafe-finally</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21316 ">#21316</a>)
(electrohyun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d3dd47f42e4cb5f9da27e3a2e741aa21e02ea1a4 "><code>d3dd47f</code></a>
feat: only exempt <code>new-cap</code> built-ins that reference the
global (<a
href="https://redirect.github.com/eslint/eslint/issues/21290 ">#21290</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b684bb1cd7e6be03ad1b7a951baead936d9c2166 "><code>b684bb1</code></a>
fix: make TimePass.parse optional in types and docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21313 ">#21313</a>)
(ntnyq)</li>
<li><a
href="https://github.com/eslint/eslint/commit/26d11bce3e0e21f223613d4bb4be3423839b229e "><code>26d11bc</code></a>
fix: don't report <code>__proto__</code> properties in
<code>object-shorthand</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21310 ">#21310</a>)
(xbinaryx)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)
(bytedoe)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6c789ff39bc5420e94e8dafeb328bf2b7e3d35ab "><code>6c789ff</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5997825635dc9c4e81434894607ef2e3887e0ea3 "><code>5997825</code></a>
docs: clarify preserve-caught-error known limitation (<a
href="https://redirect.github.com/eslint/eslint/issues/21294 ">#21294</a>)
(Akinyemi Toluwalase)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ac74e37322ebf122ada676f153dc55c81f3caab0 "><code>ac74e37</code></a>
chore: Add AGENTS.md with AI disclosure requirements (<a
href="https://redirect.github.com/eslint/eslint/issues/21221 ">#21221</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c8326608e710e670beaf982501aed80ea104919a "><code>c832660</code></a>
chore: Upgrade Stylelint to the latest version in docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21245 ">#21245</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f9f88fcccd965fdc162b89c4615dd4018e3cabdf "><code>f9f88fc</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21308 ">#21308</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fc81076a5b8145360654d81cbc130cf7d25dca77 "><code>fc81076</code></a>
ci: add more types integration tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20395 ">#20395</a>)
(Nitin Kumar)</li>
</ul>
<h2>v10.10.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/264b4346d1963701df0c398b4aeb2f6e8b2af93e "><code>264b434</code></a>
feat: add <code>d</code> and <code>v</code> flags to
<code>no-unexpected-multiline</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21305 ">#21305</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c6cc6c592f30901345d94ef75e0d42c1894fae6c "><code>c6cc6c5</code></a>
feat: check <code>Object.prototype</code> property names in
<code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21269 ">#21269</a>)
(crimsonjay0)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5661fa65fde9fd4c14f0b730e3cee6a42fc657c1 "><code>5661fa6</code></a>
feat: no-extra-bind false negatives with class fields and static blocks
(<a
href="https://redirect.github.com/eslint/eslint/issues/21260 ">#21260</a>)
(synthex-byte)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bb47dc6da2399a8f76c0c0c3273e6bc314c480e5 "><code>bb47dc6</code></a>
fix: update dependency file-entry-cache to v11 (<a
href="https://redirect.github.com/eslint/eslint/issues/20801 ">#20801</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/427ac0a014066c36aa57fa8fa9af20fd9fb591e1 "><code>427ac0a</code></a>
fix: use format strings in debug calls (<a
href="https://redirect.github.com/eslint/eslint/issues/21247 ">#21247</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9d8153223dbf47b9aecdc1474202aaee4845f146 "><code>9d81532</code></a>
fix: support <code>__proto__</code> in <code>/* exported */</code>
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21261 ">#21261</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/87e0a082438264ad90b87fd74165ab4fd90f63ef "><code>87e0a08</code></a>
fix: prefer-object-has-own autofix breaks when Object is shadowed (<a
href="https://redirect.github.com/eslint/eslint/issues/21282 ">#21282</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8e2cb142217f2efee1d10dcc02bfb75145ae775d "><code>8e2cb14</code></a>
fix: <code>new-cap</code> false positive for <code>UTC</code> calls with
<code>properties: false</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21275 ">#21275</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9f4a364ab0ade048dfce1f37792b1d461d866e55 "><code>9f4a364</code></a>
fix: Ignore static imports in no-unreachable (<a
href="https://redirect.github.com/eslint/eslint/issues/21276 ">#21276</a>)
(Taha Kotil)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2417cad57d7d1bc4cf3ecf0f0575cfb10ff2011c "><code>2417cad</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9cecb8a0a2348070abf72321965d41919c7cc626 "><code>9cecb8a</code></a>
docs: document <code>\c</code> control letter escapes in
no-control-regex (<a
href="https://redirect.github.com/eslint/eslint/issues/21286 ">#21286</a>)
(한국)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8724829f69f8ed80c876e3a5a017da199ce78739 "><code>8724829</code></a>
docs: update compat table links (<a
href="https://redirect.github.com/eslint/eslint/issues/21263 ">#21263</a>)
(fnx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5634542be580750ffb1a5766470f9e9c72719696 "><code>5634542</code></a>
docs: Clarify eqeqeq suggestion behavior (<a
href="https://redirect.github.com/eslint/eslint/issues/21256 ">#21256</a>)
(Müslüm Yılmaz)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b3d876b46083d67899eb1d9613118c1c583632a2 "><code>b3d876b</code></a>
chore: disable npm audit in ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21306 ">#21306</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1696682791661c13167eb905da2f38d1b8f4a3bf "><code>1696682</code></a>
ci: restore EMFILE test on Node.js 26 (<a
href="https://redirect.github.com/eslint/eslint/issues/21297 ">#21297</a>)
(Marry (Subin Yang))</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/3c0b7c6e1fe2dec778b97a996018126f22d437ae "><code>3c0b7c6</code></a>
10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/321f0a70dd908ed461b11142e17fbdc0c0f1f198 "><code>321f0a7</code></a>
Build: changelog update for 10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21 ">#21</a>...</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.9.1...v10.11.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `jest` from 30.5.0 to 30.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases ">jest's
releases</a>.</em></p>
<blockquote>
<h2>v30.5.2</h2>
<h2>Features</h2>
<ul>
<li><code>[@jest/transform]</code> Strip TypeScript types with Node when
no transformer claims a <code>.ts</code>, <code>.mts</code> or
<code>.cts</code> file (<a
href="https://redirect.github.com/jestjs/jest/pull/16421 ">#16421</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[jest-core, jest-haste-map, jest-transform]</code> Keep
<code>require('../package.json')</code> external when bundling, so
<code>jest --version</code> and the transform and haste-map cache keys
report the released version instead of the previous one (<a
href="https://redirect.github.com/jestjs/jest/pull/16422 ">#16422</a>)</li>
<li><code>[jest-each]</code> Escape a table row's keys before building
the <code>$variable</code> interpolation <code>RegExp</code>, so a
column name such as <code>count(*)</code> no longer fails the whole
table with <code>Invalid regular expression</code>, and a <code>.</code>
or <code>|</code> in a column name is matched literally (<a
href="https://redirect.github.com/jestjs/jest/pull/16345 ">#16345</a>)</li>
<li><code>[@jest/source-map]</code> Resolve absolute Windows paths in a
source map's <code>sources</code> and <code>sourceRoot</code> again,
instead of appending them to the transformed file's directory (<a
href="https://redirect.github.com/jestjs/jest/pull/16439 ">#16439</a>)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/winklemad "><code>@winklemad</code></a>
made their first contribution in <a
href="https://redirect.github.com/jestjs/jest/pull/16345 ">jestjs/jest#16345</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2 ">https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2 </a></p>
<h2>v30.5.1</h2>
<h2>Fixes</h2>
<ul>
<li><code>[jest-config]</code> Don't warn about global-only options in
the config that supplies the global config - the root config a project
resolves to, or the first entry of <code>--projects</code> when no root
config is passed (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-config, jest-types]</code> Stop accepting
<code>reporters</code>, <code>coverageReporters</code>,
<code>workerIdleMemoryLimit</code>, <code>cwd</code> and
<code>runnerOptions</code> in a project config - they were silently
ignored, and now warn like the other global-only options (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-config, jest-validate]</code> Warn about
<code>maxWorkers</code> and <code>coverageThreshold</code> in a project
config instead of dropping them without a word (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-resolve]</code> Match <code>moduleNameMapper</code>
patterns against the specifier as written again (reverting <a
href="https://redirect.github.com/jestjs/jest/pull/16390 ">#16390</a>)
(<a
href="https://redirect.github.com/jestjs/jest/pull/16417 ">#16417</a>)</li>
<li><code>[jest-runtime]</code> Resolve package <code>imports</code>
specifiers like <code>#dep</code> under ESM again (<a
href="https://redirect.github.com/jestjs/jest/pull/16413 ">#16413</a>)</li>
</ul>
<h2>Chore & Maintenance</h2>
<ul>
<li><code>[jest-util]</code> Name the
<code>testEnvironmentOptions.globalsCleanup</code> option and link the
docs from the <code>JEST-01</code> deprecation warning, and document the
option's modes (<a
href="https://redirect.github.com/jestjs/jest/pull/16404 ">#16404</a>)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/HuzaifaChaudary "><code>@HuzaifaChaudary</code></a>
made their first contribution in <a
href="https://redirect.github.com/jestjs/jest/pull/16413 ">jestjs/jest#16413</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1 ">https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md ">jest's
changelog</a>.</em></p>
<blockquote>
<h2>30.5.2</h2>
<h3>Features</h3>
<ul>
<li><code>[@jest/transform]</code> Strip TypeScript types with Node when
no transformer claims a <code>.ts</code>, <code>.mts</code> or
<code>.cts...
_Description has been truncated_
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-10-17 18:27:10 -07:00
beb6fe2ffb
chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in /libs/cli/js-examples in the major group ( #9154 )
...
Bumps the major group in /libs/cli/js-examples with 1 update:
[dotenv](https://github.com/motdotla/dotenv ).
Updates `dotenv` from 17.4.2 to 18.0.4
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md ">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.3...v18.0.4 ">18.0.4</a>
(2026-09-25)</h2>
<h3>Changed</h3>
<ul>
<li><code>import dotenv/config</code> should default quiet: true (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1063 ">#1063</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.2...v18.0.3 ">18.0.3</a>
(2026-09-22)</h2>
<h3>Changed</h3>
<ul>
<li>Patch <code>DOTENV_QUIET</code> setting when inside .env file (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1059 ">#1059</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.1...v18.0.2 ">18.0.2</a>
(2026-09-21)</h2>
<h3>Changed</h3>
<ul>
<li>Patch additional edge cases for the fast parser (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1056 ">#1056</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.0...v18.0.1 ">18.0.1</a>
(2026-09-18)</h2>
<h3>Changed</h3>
<ul>
<li>Handle file urls in config logging (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1054 ">#1054</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.0 ">18.0.0</a>
(2026-09-17)</h2>
<h3>Added</h3>
<ul>
<li>NEW: Dotenv now has a CLI. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1022 ">#1022</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<ul>
<li>NEW: Dotenv now has a fast parser thanks to <a
href="https://github.com/homanp "><code>@homanp</code></a> of <a
href="https://superagent.sh ">superagent.sh</a>. Pass <code>config({
fast: true })</code>, flag <code>--fast</code>, or set
<code>DOTENV_FAST=true</code> to opt-in to ~2x faster character-scanner
parser. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1010 ">#1010</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<p><a href="https://dotenvx.com/blog/2026/09/28/dotenv-fast.html ">faster
than Node native parseEnv!</a></p>
<h3>Changed</h3>
<ul>
<li>Injecting message sent to stderr rather than stdout and tips removed
(<a
href="https://redirect.github.com/motdotla/dotenv/pull/1037 ">#1037</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/86804c0507aff98d3a82204759729af3bc2ce1a9 "><code>86804c0</code></a>
18.0.4</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/2403db57c3f8b01123d69a8b441a5f8b828fab3c "><code>2403db5</code></a>
changelog</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/75b775eda45af3085fb7a7de6ae2613eb646807e "><code>75b775e</code></a>
npm audit</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/7e1750ce8034b3c9485f1e1722587a40890449e1 "><code>7e1750c</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1064 ">#1064</a>
from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/a6ade63b6fa94a78fdc68f815c4e88cfe8781774 "><code>a6ade63</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1063 ">#1063</a>
from motdotla/import</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/288b0d7cd85d8deba3f91a995abd033786626a8d "><code>288b0d7</code></a>
patch test</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/00da9125dd7633a121d169a3a55b62a686b64ef8 "><code>00da912</code></a>
Bump ip-address from 10.2.0 to 10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/e6b58161d2f2b1448c735b1f6555bde7a20443b7 "><code>e6b5816</code></a>
import 'dotenv/config' should still be defaulting to quiet</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/3646ac5e5d000f5f68fe83db52399010f9cb781f "><code>3646ac5</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1061 ">#1061</a>
from motdotla/fast</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/83fc961f92f6c330833da4a5f5dc7093d539501e "><code>83fc961</code></a>
report dotenv vs native vs dotenv.fast</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-18 00:49:00 +00:00
0eb194fe60
chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 6 updates ( #9150 )
...
Bumps the minor-and-patch group in /libs/prebuilt with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.1`
| `1.6.5` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [syrupy](https://github.com/syrupy-project/syrupy ) | `6.0.0` | `6.1.1`
|
| [psycopg-binary](https://github.com/psycopg/psycopg ) | `3.3.4` |
`3.3.6` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
Updates `langchain-core` from 1.6.1 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.5</h2>
<p>Changes since langchain-core==1.6.4</p>
<p>release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</p>
<h2>langchain-core==1.6.4</h2>
<p>Changes since langchain-core==1.6.3</p>
<p>release(core): 1.6.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40718 ">#40718</a>)
chore(core): deprecate chat message history (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40711 ">#40711</a>)
chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40634 ">#40634</a>)
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40574 ">#40574</a>)</p>
<h2>langchain-core==1.6.3</h2>
<p>Changes since langchain-core==1.6.2</p>
<p>release(core): 1.6.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40407 ">#40407</a>)
feat(core): Allow model name and provider tracing metadata override
based on gateway response (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40406 ">#40406</a>)
test(core): cover the deprecated <code>.text()</code> access path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40243 ">#40243</a>)
docs(core): remove stale Args/Raises entries from
FileCallbackHandler._write and ChatGeneration.set_text (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40211 ">#40211</a>)</p>
<h2>langchain-core==1.6.2</h2>
<p>Changes since langchain-core==1.6.1</p>
<p>release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40209 ">#40209</a>)
feat(openai): support async tools (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40208 ">#40208</a>)
chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40150 ">#40150</a>)
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40113 ">#40113</a>)
fix(core): avoid mutation in google-genai standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40023 ">#40023</a>)
fix(core): avoid mutation in bedrock converse standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40022 ">#40022</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0 "><code>c5ab14d</code></a>
release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f "><code>5704d9d</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40804 ">#40804</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea "><code>7622d3d</code></a>
release(openai): 1.6.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40800 ">#40800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e "><code>2dd956b</code></a>
docs(infra): fix AGENTS.md root setup guidance and package doc accuracy
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40794 ">#40794</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621 "><code>49f4b40</code></a>
fix(openai): raise on error events in stream path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40791 ">#40791</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426 "><code>19cadaa</code></a>
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2 "><code>798441e</code></a>
chore(anthropic): fix integration test cassette (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40790 ">#40790</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1 "><code>a476942</code></a>
release(openai): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40787 ">#40787</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291 "><code>46c6bdf</code></a>
release(anthropic): 1.7.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40786 ">#40786</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8 "><code>290daba</code></a>
fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40785 ">#40785</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 6.0.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.1</h2>
<blockquote>
<p><strong>Note:</strong> 6.1.0 was skipped due to a CI issue. Use
<strong>6.1.1</strong>.</p>
</blockquote>
<h3>Experimental <code>--snapshot-file-lock</code> for pytest-xdist</h3>
<p><code>--snapshot-update</code> under pytest-xdist can race when
multiple workers rewrite the same multi-entry amber (<code>.ambr</code>)
file, silently dropping snapshots (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1237 ">#1237</a>).</p>
<p>This release adds an <strong>experimental</strong> opt-in:</p>
<ul>
<li><code>--snapshot-file-lock</code> — exclusive file lock + atomic
replace around amber writes</li>
<li><code>--snapshot-file-lock-timeout</code> — max wait for the lock
(default <strong>60s</strong>)</li>
</ul>
<p>Same-machine workers only; not reliable across remote workers / NFS.
See <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">#1239</a>.</p>
<blockquote>
<p><strong>Callout for pytest-xdist users:</strong> please try
<code>--snapshot-file-lock</code> with <code>--snapshot-update</code>
and <a href="https://github.com/syrupy-project/syrupy/issues ">open an
issue</a> if you hit problems. Locking is expected to become the default
in a future minor release.</p>
</blockquote>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.1 ">v6.1.1</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.0 ">v6.1.0</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2d251e73f1ebe47fe83ed71d835d3ae8580e8313 "><code>2d251e7</code></a>
chore(release): 6.1.1 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/9b64ec05752586c45d1097e9d25f9ee1d4e93219 "><code>9b64ec0</code></a>
chore(release): 6.1.0 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/5b4256eac8720075f25b0fa8491f75948001b983 "><code>5b4256e</code></a>
fix: opt-in file lock for concurrent amber writes under xdist (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1239 ">#1239</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/d4cb1513b5d2b1b18c3b407150db22d2d8604ddd "><code>d4cb151</code></a>
chore(deps): update dependency hypothesis to v6.168.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1238 ">#1238</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/16c4cb5b8785d89e49b8076a99f58d810e02fcce "><code>16c4cb5</code></a>
test: add coverage for read_snapshot_data_from_location returning None
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1236 ">#1236</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2e1d3ba0d39a1d87735213a32de9dd9cdb929690 "><code>2e1d3ba</code></a>
chore(deps): update dependency ruff to v0.16.6 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1235 ">#1235</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/fcc929d4deb2302f2d37e6511015ef43a0841bc2 "><code>fcc929d</code></a>
chore(deps): update actions/deploy-pages action to v5.0.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1234 ">#1234</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4f1bad75777ecc9d916a648dd3669b2844d08f7d "><code>4f1bad7</code></a>
chore(deps): update dependency hypothesis to v6.167.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1232 ">#1232</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/24eda28579f5761cbc64713ffcee41cc73602010 "><code>24eda28</code></a>
chore(deps): update dependency hypothesis to v6.167.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1231 ">#1231</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/0d7e46f9431e07810da4ef90dbe861b85fbc8469 "><code>0d7e46f</code></a>
chore(deps): update dependency hypothesis to v6.166.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1230 ">#1230</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `psycopg-binary` from 3.3.4 to 3.3.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst ">psycopg-binary's
changelog</a>.</em></p>
<blockquote>
<p>.. currentmodule:: psycopg</p>
<p>.. index::
single: Release notes
single: News</p>
<h1><code>psycopg</code> release notes</h1>
<h2>Future releases</h2>
<p>Psycopg 3.3.7 (unreleased)
^^^^^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix segfault fetching arrays of strings or timestamps after closing
the
connection
(🎫 <code>[#1428 ](https://github.com/psycopg/psycopg/issues/1428 )</code>).</li>
</ul>
<h2>Current release</h2>
<p>Psycopg 3.3.6
^^^^^^^^^^^^^</p>
<ul>
<li>Add support for Python 3.15
(🎫 <code>[#1245 ](https://github.com/psycopg/psycopg/issues/1245 )</code>).</li>
<li>Improve performance of async queries by reducing the overhead of the
<code>!wait_async()</code> function
(🎫 <code>[#1331 ](https://github.com/psycopg/psycopg/issues/1331 )</code>).</li>
<li>Don't wait forever for a query to terminate after interrupting it,
for
instance if the server is unresponsive. The fix requires libpq 17 or
newer
(🎫 <code>[#1371 ](https://github.com/psycopg/psycopg/issues/1371 )</code>).</li>
<li>Cancel a running query upon receiving <code>!SystemExit</code>
(🎫 <code>[#1384 ](https://github.com/psycopg/psycopg/issues/1384 )</code>).</li>
<li>Report <code>!None</code> instead of <code>65535</code> as the
<code>Column.precision</code> of an
:sql:<code>interval</code> column declared with a fields restriction and
no explicit
precision, such as e.g. :sql:<code>interval day to second</code>
(🎫 <code>[#1397 ](https://github.com/psycopg/psycopg/issues/1397 )</code>).</li>
<li>Fix dumping of nested subclasses of lists as arrays
(🎫 <code>[#1398 ](https://github.com/psycopg/psycopg/issues/1398 )</code>).</li>
<li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code>
(🎫 <code>[#1408 ](https://github.com/psycopg/psycopg/issues/1408 )</code>).</li>
<li>Better guards dumping large Python <code>!int</code> to binary
numeric
(🎫 <code>[#1414 ](https://github.com/psycopg/psycopg/issues/1414 )</code>).</li>
</ul>
<p>Psycopg 3.3.5
^^^^^^^^^^^^^</p>
<ul>
<li>Discard prepared statements upon :sql:<code>ALTER *</code> or
<code>DISCARD *</code>
(🎫 <code>[#1307 ](https://github.com/psycopg/psycopg/issues/1307 )</code>).</li>
<li>Fix <code>!ProgrammingError</code> when dumping
non-<code>!None</code> values with
no <code>!NoneType</code> dumper registered in python implementation
(🎫 <code>[#1325 ](https://github.com/psycopg/psycopg/issues/1325 )</code>).</li>
<li>Fix <code>!wait_selector</code> wait function to not raise
<code>!KeyError</code>
(🎫 <code>[#1327 ](https://github.com/psycopg/psycopg/issues/1327 )</code>).</li>
<li>Fix <code>!DataError</code> messages leaking the literal
<code>{...}</code> placeholder instead</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psycopg/psycopg/commit/a67654d1e7afbf9b3a619557838f62de1c790e7c "><code>a67654d</code></a>
chore: bump psycopg package version to 3.3.6</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/443814b3b111ac678a39fd523c1a826266fb69b5 "><code>443814b</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1416 ">#1416</a>
from dvarrazzo/wait-async-perf</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/42966e9ebbda3b9c69b15c5588543c15f2aae5dd "><code>42966e9</code></a>
test: add helpful comments to some tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/5e8797f0c8003d8cd12a1e5c13f05fbb94c1c1d2 "><code>5e8797f</code></a>
test: add reasonable connect_timeout to most tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/c81ba62442dfbd69e207d6914e6ae2aa27e56886 "><code>c81ba62</code></a>
perf: reduce the overhead of wait_async()</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/d2bbfe4e2b1e36a20e72a18097f35a3db27296e3 "><code>d2bbfe4</code></a>
refactor: use get_running_loop() in the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b1484a550e01c88fda077099678f0abb9217ecb "><code>2b1484a</code></a>
test: add a script to measure the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/573cf4aa70d8fdefc9d5f3eb69d5419cd6d3cd51 "><code>573cf4a</code></a>
test: fix incorrect wait timing test</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b68990874175b8d97269218d4963b2d5c8656f3 "><code>2b68990</code></a>
refactor: drop leftovers of waiting with inf interval in
wait_conn_async</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/60765dd8fc7d8df03cd75efcff485bfb3c83a0ed "><code>60765dd</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1414 ">#1414</a>
from dvarrazzo/fix-decimal-overflow</li>
<li>Additional commits viewable in <a
href="https://github.com/psycopg/psycopg/compare/3.3.4...3.3.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-17 16:17:52 +00:00
Elior Nataf Lackritz
41c9c22fdc
release(langgraph): 1.2.16 ( #9334 )
...
Bumps langgraph from 1.2.15 to 1.2.16.
Includes:
- Keep a DeltaChannel's value when its field changes to a plain reducer
(#9302 )
- Save a resumed exit run's pending writes once (#9314 )
- Stop a subgraph from rerunning its finished tasks on resume (#9315 )
- Apply a resumed `Command`'s update once (#9322 )
- Let other tasks finish when a resume value is invalid (#9265 )
2026-10-16 18:02:08 -04:00
Elior Nataf Lackritz
51018652a6
release(sdk-py): 0.4.8 ( #9335 )
...
Bumps the Python SDK version from 0.4.7 to 0.4.8. Thread streams now
report why they ended: a server's error frame becomes the error
`thread.output` raises, the sync client no longer blocks forever when
the server closes the stream, and a stream the server rejects with a 4xx
ends at once instead of being retried (#9317 ).
2026-10-16 18:01:53 -04:00
Elior Nataf Lackritz
9e6fc45c6f
fix(sdk-py): surface thread stream errors and stop retrying a rejected stream ( #9317 )
...
## Summary
Thread streams in `langgraph_sdk` now report why they ended. An `id:
null` error frame becomes the error `thread.output` raises, the sync
client no longer blocks forever when the server closes the stream, and a
stream the server rejects with a 4xx ends at once instead of being
retried.
## Problem
- A server sends `{"type": "error", "id": null, ...}` just before it
closes a thread stream whose read failed. The SDK dropped the frame, so
`thread.output` raised a generic "lifecycle stream ended before terminal
event" (async) or blocked forever (sync: the lifecycle watcher returned
without settling the run).
- A 403 or 404 on the stream request was retried like a network error,
then reported as `RuntimeError("Lifecycle transport failed: ...")` with
no status. A server that rejects a WebSocket after accepting it closes
with 4000 plus the HTTP status (4403, 4404, 4422), since a browser can't
read a refused upgrade's status. The shared stream counted each such
reconnect as a success and reconnected forever.
## Fix
- The lifecycle watcher fails the run with the frame's error on a clean
close (both clients). The shared stream logs the frame instead of
dropping it: projections still end when the stream closes, as before,
and `thread.output` carries the error.
- A 4xx other than 408 and 429, as a status or as a 4000+status close
code, ends the stream without retries. `thread.output` now raises that
`httpx.HTTPStatusError` or `websockets.exceptions.ConnectionClosedError`
instead of the generic `RuntimeError`.
- For a minted `thread_id`, the lifecycle watcher starts after
`run.start` creates the thread. Without this, the 4xx stop would turn a
stream opened under custom auth for a not-yet-created thread from
retried into failed. The sync client starts it under a lock, since
`run.start` can be called from several threads.
- Drops the first of two `SyncStreamController._reconnect_shared_stream`
definitions. It was shadowed by the second and never ran.
Not in this PR: over WebSocket the server closes with 1011 after an
error frame, which is still retried, while over SSE the close is clean
and fails the stream. Reconnecting after a clean close, as
`langchain-ai/langgraphjs#2812` does for the JS SDK, is a separate
change.
## Test plan
- [x] The 10 new behavior tests (async and sync: error frame, clean
close, 404, 4404 close, reconnect on 404, minted `thread_id`) fail on
`main` and pass here; a race test checks that two concurrent `run.start`
calls start one watcher.
- [x] `make test` in `libs/sdk-py`: 541 passed. `make lint` clean,
`check_sdk_methods.py` passes.
- [x] `RemoteGraph` v3 tests in `libs/langgraph`
(`test_remote_graph_v3.py`,
`test_stream_events_v3_kwarg_forwarding.py`): 94 passed against this
SDK.
- [x] Against a local server with custom auth: a thread the caller can't
read fails at once with 404 (SSE) or 4404 (WebSocket), and a new thread
works with a 1 s pause before `run.start`, which fails on `main`.
2026-10-16 15:29:34 -04:00
Baihao Wang
b0cabd93d0
fix(langgraph): let other tasks finish when a resume value is invalid ( #9265 )
...
Found while testing per-call human-in-the-loop
(langchain-ai/langchain#41062). The code depends only on #9232 , which is
already on `main`.
When one answer in a multi-answer resume fails `response_schema`
validation, the runner cancelled the other tasks in the step, so in
async runs a task cut off after its side effect kept its saved answer
and ran again on the next resume. Invalid resume values (already tagged
by `is_invalid_resume` from #9232 ) no longer stop the other tasks: the
error is raised once they finish, so their results are saved.
Hit by per-call human-in-the-loop: approving one tool call while giving
another an invalid edit, in one resume, sent the approved call's email
twice once the second answer was fixed.
## How to verify
- `test_invalid_resume_lets_other_answered_tasks_finish` fails on `main`
(the approved task is still pending after its side effect) and passes
with this change. Like the other async interrupt tests, it is skipped
before Python 3.11, where async nodes can't call `interrupt()`.
- The per-call HITL reproduction against this branch: the approved async
tool runs once (twice on `main` whenever it awaits after its side
effect).
- `make lint` passes. With `NO_DOCKER=true`, the full `libs/langgraph`
suite has the same failures as `main` locally (`test_prebuilt_tool_chat`
and `test_stream_mode_messages_command`, sync and async), and nothing
new.
2026-10-16 11:33:53 -07:00
raghavverma-langchain
4ac46ba186
release(cli): 0.4.36 ( #9330 )
...
## Summary
<!-- Write the summary yourself -->
## Notes for reviewers
- Includes [push through the active Docker
context](https://github.com/langchain-ai/langgraph/pull/9321 ) and
[accept serverless and dedicated deployment
aliases](https://github.com/langchain-ai/langgraph/pull/9325 ), the two
CLI changes merged since 0.4.35.
- Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`, as was done for 0.4.35.
## Test Plan
- [x] Only `__version__` in `libs/cli/langgraph_cli/__init__.py` changes
(0.4.35 → 0.4.36), like the 0.4.35 release PR
- [ ] After merge, the `release` workflow for `libs/cli` succeeds and
PyPI shows `langgraph-cli` 0.4.36
- [ ] `uvx --from langgraph-cli==0.4.36 langgraph deploy` pushes on
Docker Desktop without `DOCKER_HOST` set
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-16 12:29:42 -04:00
Elior Nataf Lackritz
e14f4277dc
fix(langgraph): apply a resumed Command's update once ( #9322 )
...
`Command(resume=..., update=...)` applied its update twice once the
resumed node called `interrupt()` again, with sync or async durability
(`invoke`'s default). A node that asks three times, resumed with
`Command(resume=str(i), update={"log": [f"u{i}"]})`, ends with `["u1",
"u1", "u2", "u3", "a:123"]`.
## Cause
The null task's writes are saved as one list, and savers key a regular
write by its position in that list. The Command's resume came first, so
its update was stored at index 1. The next Command saved the null task's
earlier writes again without the resume, which put the update at index
0, so it was stored twice and every later resume applied both copies.
`durability="exit"` saves after the resume is consumed, so it wasn't
affected.
## Fix
The null task's special writes (a resume) now go after its regular ones,
so each regular write keeps its index as the list grows.
`test_resume_with_update_applies_the_update_once` fails on `main` for
sync and async durability.
Found by @hntrl, and flagged by @soarez on #9314 .
2026-10-16 12:07:59 -04:00
hari-dhanushkodi
4e2dfe4a24
fix(cli): accept serverless and dedicated deployment aliases ( #9325 )
2026-10-16 08:02:43 -04:00
raghavverma-langchain
e77a5cb08c
fix(cli): push through the active Docker context in langgraph deploy ( #9321 )
...
## Summary
<!-- Write the summary yourself -->
## Notes for reviewers
- Known gap: `--host` carries only the context's endpoint, not its TLS
settings, so a remote context that uses client certificates still can't
push. That case was broken before this change too, and it's rare for
local builds.
- A context with no Docker endpoint (Docker prints `<no value>`) or a
missing `docker` binary falls back to today's behavior.
## Test Plan
- [x] `make lint` and `make test` pass in `libs/cli` (556 tests)
- [x] New tests: `login` and `push` get the active context's endpoint as
`--host`; with `DOCKER_HOST` set there's no lookup and no `--host`; when
the context lookup fails, or the context has no Docker endpoint, there's
no `--host` and the deploy still succeeds. The first fails without the
change.
- [x] On a Mac running Docker Desktop with no `/var/run/docker.sock`:
`docker --config <temp dir> version` fails with `failed to connect to
the docker API at unix:///var/run/docker.sock`, and adding `--host
<active context endpoint>` reaches the daemon
- [x] Reproduced end to end on LangSmith AWS: `langgraph deploy`
(0.4.35) failed at the push with that error, then passed with
`DOCKER_HOST` set to the context's endpoint, which this change does
automatically
- [ ] After release, `langgraph deploy` pushes on Docker Desktop without
`DOCKER_HOST` set
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-15 16:14:01 -04:00
Elior Nataf Lackritz and Connor Imes
b0482d0627
fix(langgraph): stop a subgraph from rerunning its finished tasks on resume ( #9315 )
...
Fixes #9106
When a subgraph pauses in several parallel interrupts and they're answered one at a time, each resume ran the nodes that were already answered again. Their saved answers carried them straight through `interrupt()`, so whatever they do after it (an API write, say) ran once more per later answer, while the final state still looked right. A `@task` that finished before an interrupt in a nested graph reran the same way, which is the rerun reported in #6792 .
## Cause
Every task config sets `checkpoint_id` to None, and `PregelLoop` treats a config with that key as a replay, so a nested graph replayed on every resume. A replaying loop doesn't hand saved writes back to the tasks that made them, so finished tasks ran again.
## Fix
`PregelLoop` now notes whether the run points it at a checkpoint (a truthy `checkpoint_id`, its own `checkpoint_map` entry, or a parent that is replaying), the test `__enter__` already uses to pick the checkpoint to load. `_first` then decides once whether finished tasks rerun: only on time travel, or on a resume at a checkpoint the thread has moved past. A plain resume of a subgraph is neither, so it hands finished tasks their writes back the way a top-level resume does.
The same rule fixes the top level, which @hntrl pointed out: a resume sent with the head's `checkpoint_id`, as Studio sends it, or with `checkpoint_id: None` reran finished siblings too. A resume at an older checkpoint still reruns them, as the checkpoint migration tests expect. Telling the two apart costs one more checkpoint read for a run sent with a `checkpoint_id`. `test_addressed_resume_keeps_a_rerun_tasks_write_to_a_new_channel` relied on a resume at the head rerunning a task, so it now resumes a checkpoint the thread has moved past.
Most subgraph time travel forks first, which gives tasks new ids, so saved writes can't match them anyway. `test_subgraph_replay_reasks_answered_parallel_interrupt` replays an update checkpoint, which runs in place: it passes on `main` and fails if subgraphs never replay.
The counters added to `test_parallel_interrupts_double` and the three new tests in `test_interrupt_state.py` fail on `main`.
## Not in this PR
- With `durability="exit"` and three or more parallel interrupts, a subgraph now hits a bug top-level graphs already have: a finished task's output is applied twice. #9314 fixes it.
- #6792 also reports the interrupt of a `@task` inside a nested `@entrypoint` coming back twice. That's a separate bug.
Thanks @connorimes for the report, the root cause and the fix, which this applies as proposed. The same change was opened as #9113 by @AnvitDevadiga, and @morehardy found the root cause for #6792 in #6793 .
JS: langchain-ai/langgraphjs#3028
Co-authored-by: Connor Imes <5701850+connorimes@users.noreply.github.com >
2026-10-15 15:51:21 -04:00
Elior Nataf Lackritz
889a5ff16f
fix(langgraph): save a resumed exit run's pending writes once ( #9314 )
...
With `durability="exit"`, resuming three or more parallel interrupts one
at a time applied the earlier answers twice. Nodes `a`, `b` and `c` each
return `{"log": [f"{name}:{interrupt(name)}"]}`, and the run ends with
`{"log": ["a:yes", "a:yes", "b:yes", "c:yes"]}`.
## Cause
An exit-mode run saves its pending writes when it ends, and that save
took all of them, including the ones loaded with the checkpoint. Savers
key a task's writes by their position in the list they're given. A task
that finished in an earlier run comes back with its old interrupt next
to its output, so saving its list again put the output under a new
index, and the next load applied both copies.
## Fix
The save at exit keeps only the writes of tasks that wrote during this
run. The rest are already stored on the checkpoint, which is what sync
and async durability do.
`test_finished_task_output_applies_once` fails on `main` in exit mode
for every saver and passes for sync and async.
The #9106 fix needs this too: once a subgraph stops rerunning its
finished tasks, it hits this bug in exit mode.
JS: langchain-ai/langgraphjs#3027
2026-10-15 15:26:01 -04:00
Baihao Wang
5eb60aef6f
release(prebuilt): 1.1.1 ( #9316 )
...
Bumps langgraph-prebuilt from 1.1.0 to 1.1.1.
Includes:
- Stop `ToolNode` from swallowing a resume value that fails an
interrupt's `response_schema` (#9232 ). This needs langgraph 1.2.15 or
later, which marks those errors; with an older langgraph, `ToolNode`
keeps today's behavior.
- Keep tool results out of v3 messages (#7838 )
Managed Deep Agents (langchain-ai/managed-deepagents-sdk#710 ) will raise
its `langgraph-prebuilt` minimum to this release, so an invalid answer
to an interrupt raised inside a tool, such as a subagent, fails the
resume instead of reaching the model.
After merge, run the Release workflow with
`working-directory=libs/prebuilt`.
---
This PR was written with help from an AI coding agent (Claude Code); a
human reviewed and directed the changes.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
2026-10-14 18:31:09 -07:00
Elior Nataf Lackritz
d4149cc1f5
release(checkpoint-postgres): 3.2.0 ( #9313 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointpostgres==3.1.3`:
- #9290 - add `prune` / `aprune` to `PostgresSaver` and
`AsyncPostgresSaver`
Minor version for the new public API. It needs nothing beyond the
`langgraph-checkpoint>=4.3.0` floor 3.1.3 already set.
2026-10-14 15:41:43 -04:00
Elior Nataf Lackritz
36bf3887f0
feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver ( #9290 )
...
Closes #8531 .
`PostgresSaver` and `AsyncPostgresSaver` inherited `prune` / `aprune`
from the base class, which raises `NotImplementedError`, so long-lived
threads had no supported way to drop old checkpoints. This adds both
strategies. Thanks to @wangjiawei-vegetable for proposing this scope in
#8531 and #9247 .
- **`delete`** removes every checkpoint, write and blob of the threads,
in one transaction.
- **`keep_latest`** keeps the latest checkpoint of each namespace (the
one `get_tuple` loads), with its pending writes and the blobs it
references, and deletes the rest, including blobs only the deleted
checkpoints used. A kept checkpoint whose parent is deleted is left with
no parent. A subgraph call's namespace goes with the root checkpoint the
call started from; a `checkpointer=True` subgraph keeps its latest
checkpoint, since its state outlives each call.
- **Each thread is pruned on one snapshot.** Its transaction runs at
`REPEATABLE READ` and deletes everything that snapshot sees except the
kept checkpoints, so a run appending to the thread at the same time is
safe, whatever its checkpoint IDs.
- **`keep_latest` refuses threads that use a `DeltaChannel`**
(`NotImplementedError` naming them, nothing pruned). A `DeltaChannel`
rebuilds its latest value from older checkpoints, so deleting them would
empty it. The saver can't see channel types, so it detects one by what
only a `DeltaChannel` leaves: `counters_since_delta_snapshot` in
metadata, a snapshot (an inline `true` with a blob behind it), or
`delta_writes_versioned`, which LangGraph.js sets on threads its
`DeltaChannel` graphs start. The check runs for the whole batch first
and again in each thread's transaction, so a thread that starts using a
`DeltaChannel` mid-batch is refused at its turn.
Unlike the `prune` in #6883 , `keep_latest` here deletes the blobs older
checkpoints no longer share with the kept ones (most of the storage on a
long thread), and guards `DeltaChannel` threads.
Measured locally, with or without planner statistics: a 6,000-checkpoint
thread prunes in 100 to 200 ms, and one with 1,500 finished subgraph
calls in about 110 ms.
## Known limitations
- Two prunes of the same thread at once can fail one of them with a
serialization failure or a deadlock; retrying is safe.
- Forking or replaying from a checkpoint while it's being pruned is not
safe.
- Threads written by older releases can escape the `DeltaChannel` check:
before #9142 (Python 1.2.13) and langchain-ai/langgraphjs#2973 (JS
1.5.0), some `update_state` paths saved checkpoints with neither
counters nor a snapshot.
- Postgres reuses the freed space but doesn't shrink the table files;
that takes `VACUUM FULL` or `pg_repack`.
- `DeltaChannel`-aware pruning (keeping ancestors back to the last
snapshot) is a follow-up.
## Test plan
- [x] `libs/checkpoint-postgres/tests/test_prune.py`: 71 tests over the
sync and async savers (single connection, pool, pipeline), including the
conformance `prune` capability. Passes on Postgres 15 and 16.
- [x] `libs/langgraph/tests/test_prune_postgres.py`: 39 graph tests. A
pruned thread loads the same state and keeps running like an unpruned
twin (sync, async and exit durability, interrupts, a failed parallel
step, interrupted and `checkpointer=True` subgraphs), plus deterministic
races: a turn saved mid-prune, and threads switching to a `DeltaChannel`
before and after their own check.
- [x] Each guard (the snapshot, the writes and blob scopes, the subgraph
call rules, the parent reset, the `DeltaChannel` checks, the
single-string check, the pre-v4 pending sends, the pipeline sync) broken
one at a time: every break fails at least one test.
- [x] A thread pruned in a loop while it runs, in each durability mode,
ends identical to its twin; threads written by LangGraph.js 1.5.0 and
pruned from Python behave like their twins.
2026-10-14 15:09:51 -04:00
gethin-langchain
e5b422455d
release(cli): 0.4.35 ( #9310 )
...
Bumping the CLI to 0.4.35 to cut a release including #9305
(--image-pull-secret).
2026-10-14 17:07:39 +01:00
gethin-langchain
6cd26d0e21
feat(cli): add --image-pull-secret for deploying through a private registry ( #9305 )
...
## Summary
Deployments created with `--push-to` or `--image-uri` had no way to tell
the control plane which Kubernetes secret to use for pulling the image,
so deploying through a private registry that requires authentication
(e.g. an ECR repository gated by an imagePullSecret) wasn't possible at
all.
The control plane's `resource_spec` already supports
`image_pull_secrets` (a list of references to
`kubernetes.io/dockerconfigjson` secrets); the CLI just never exposed a
way to set it. This adds a repeatable `--image-pull-secret <name>` flag
that populates it.
```bash
langgraph deploy --push-to 123456789.dkr.ecr.us-east-1.amazonaws.com/agents/my-agent \
--image-pull-secret regcred
```
Validation follows the same pattern already used for
`--listener-id`/`--k8s-namespace`: only valid when creating a deployment
with `--push-to` or `--image-uri`, and rejected on an existing
`--deployment-id` (the secret list is fixed at creation, same as
listener placement).
## Test plan
- [x] Added unit tests for the new `_resource_spec` helper (empty list
keeps today's default, secrets become the expected `{"name": ...}` list)
- [x] Added CLI-level tests: secret(s) land in
`source_config.resource_spec.image_pull_secrets` on create (for both
`--push-to` and `--image-uri`), rejected without
`--push-to`/`--image-uri`, rejected on an existing `--deployment-id`
- [x] `make format && make lint` clean
- [x] `make test` passes, 539 passed (9 new), no regressions
2026-10-14 16:11:04 +01:00
raghavverma-langchain
53cf85bece
feat(cli): log in with the registry username the control plane returns ( #9301 )
...
## Summary
<!-- Write the summary yourself -->
## Test Plan
- [x] `make format`, `make lint` and `make test` pass in `libs/cli` (534
tests)
- [x] New tests cover the opt-in request body, logging in with the
returned `username`, and pushing to exactly `repository_url`; they fail
without the change
- [x] Backward compatible: without `username` or `repository_url` in the
response, the CLI logs in as `oauth2accesstoken` and pushes to
`registry_url/<name>` as before, and control planes that don't read the
request body ignore it
- [ ] With the LangSmith AWS change (langchain-ai/langchainplus#49248 )
live: `langgraph deploy` builds locally, pushes to the deployment's ECR
repository, and deploys
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-14 10:31:24 -04:00
Saad Farooq
69d98cc0d9
fix(cli): preserve failed deployment build logs ( #9308 )
2026-10-14 09:05:38 -04:00
dependabot[bot]
ccb851effb
chore(deps): bump handlebars from 4.7.9 to 4.7.10 in /libs/cli/js-examples ( #9286 )
...
Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js )
from 4.7.9 to 4.7.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/releases ">handlebars's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.10</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code><!--</code> and <code><script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md ">handlebars's
changelog</a>.</em></p>
<blockquote>
<h2>v4.7.10 - October 5th, 2026</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code><!--</code> and <code><script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e "><code>45ce152</code></a>
v4.7.10</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8 "><code>e47b236</code></a>
Update release notes</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0 "><code>f37c599</code></a>
Sanitize the source map URL when minifying</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca "><code>812c226</code></a>
Iterate lazily in #each and strip whitespace in linear time</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 "><code>609d1b1</code></a>
Escape <code><!--</code> and <code><script</code> in precompiled
output</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa "><code>ceec388</code></a>
Don't trust special properties on context data</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98 "><code>c28ee7a</code></a>
Only compile partials that are template strings</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1 "><code>7d501a5</code></a>
Only dispatch known node types in the Compiler and Visitor</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 "><code>703fdcc</code></a>
Validate AST values in the compiler instead of the parser</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d "><code>0fcf25c</code></a>
Clarify that --root does not restrict filesystem access</li>
<li>Additional commits viewable in <a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-14 16:39:24 +09:00
Elior Nataf Lackritz
a6731f4367
fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer ( #9302 )
...
Changing a field from a `DeltaChannel` to a plain reducer, for example
to `Annotated[list, add_messages]`, made threads written under the
`DeltaChannel` read that field as empty. The next run saved its writes
over the empty value, so continuing an old thread replaced its history.
The writes were still stored: the read only rebuilt fields whose current
annotation is a `DeltaChannel`.
- A `BinaryOperatorAggregate` stores its value at every version, so one
with a version and nothing stored was written as a `DeltaChannel`. It's
now rebuilt from the same history walk, one `update` per write, since a
single call would reject a second `Overwrite` and drop the writes after
one.
- `BinaryOperatorAggregate.from_checkpoint` unwraps a stored
`_DeltaSnapshot`.
- The next run saves the full value, so later reads are plain reads, and
switching back to a `DeltaChannel` keeps everything.
Threads written under a plain reducer never walk. A rebuilt read costs
the walk plus one reducer call per write since the last snapshot: with
`add_messages` on `InMemorySaver`, 25 ms at 2,048 messages with a
snapshot every 50 writes, and 0.3 s at 1,998 or 0.9 s at 4,998 messages
with the default 1000. After one run, reads take 6 to 16 ms.
`test_delta_channel_to_plain.py` covers every saver; all but the
plain-thread test fail on main.
JS: langchain-ai/langgraphjs#3017
2026-10-13 20:47:19 -04:00
gethin-langchain
8a77332d0d
release(cli): 0.4.34 ( #9300 )
...
Bumping the CLI to 0.4.34 to cut a release including #9243 (--json on
deploy listeners list).
2026-10-13 16:32:51 +01:00
gethin-langchain
a1ce197234
feat(cli): add --json to deploy listeners list ( #9243 )
...
## Summary
`deploy listeners list` only prints a human-readable table, which a
deploy automation pipeline can't reliably parse to extract a listener's
id for `--listener-id`.
Adds `--json`, which prints the listeners as a JSON array instead of the
table. An empty workspace prints `[]` rather than the "No listeners
found" sentence, so callers never need to special-case the no-results
path when scripting against it.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] `test_deploy_listeners_list_command_json` and
`test_deploy_listeners_list_command_json_no_results` in `test_cli.py`,
mirroring the existing table-output test pair
- [x] Full `libs/cli` suite: 529 passed, no regressions
2026-10-13 15:43:03 +01:00
Elior Nataf Lackritz
afbe7e48b1
release(checkpoint-postgres): 3.1.3 ( #9287 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointpostgres==3.1.2`:
- #8617 - widen `Store` `put` value type to `Mapping[str, Any]`
- #8556 - derive the delta walk cursor once the target loads
- #8544 - order delta channel replay by task path
- #9217 - validate namespace labels before store dispatch
- #9248 - start the delta walk at the target
- #9262 - treat an empty `checkpoint_id` as the latest in delta history
Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised
the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it.
2026-10-12 22:57:04 +00:00
Elior Nataf Lackritz
1074714c26
release(checkpoint-sqlite): 3.1.2 ( #9288 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointsqlite==3.1.1`:
- #8617 - widen `Store` `put` value type to `Mapping[str, Any]`
- #8557 - walk delta ancestors by parent pointer
- #8544 - order delta channel replay by task path
- #9217 - validate namespace labels before store dispatch
- #9262 - treat an empty `checkpoint_id` as the latest in delta history
Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised
the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it.
2026-10-12 22:47:17 +00:00
Elior Nataf Lackritz
740461ed50
release(sdk-py): 0.4.7 ( #9289 )
...
Bumps the Python SDK version from 0.4.6 to 0.4.7. A thread stream's run
now ends only on the root graph's `completed` or `failed` event, not a
subgraph's, so `thread.output` no longer reads the state too early and a
run that fails after a subgraph finishes is reported as failed (#9228 ).
2026-10-12 22:47:05 +00:00
Igor Soarez
08a345637f
release(langgraph): 1.2.15 ( #9283 )
...
Bumps langgraph from 1.2.14 to 1.2.15. It now requires
langgraph-checkpoint 4.3.0 or later (#8544 ).
Also includes:
- Order delta channel replay by task path (#8544 )
- Replay a resumed exit-mode run's delta writes in live order (#9114 )
- Give each `bulk_update_state` update its own task id (#9128 )
- Stop `astream_events` dropping control/interrupts on v1/v2 (#9219 )
- Never store exit-mode delta writes under the null task id (#9229 )
- Mark a resume value that fails an interrupt's `response_schema`, so
`ToolNode` can stop swallowing it once langgraph-prebuilt is released
(#9232 )
- Don't save a checkpoint past a failed DeltaChannel write (#9235 )
- Keep a fork's DeltaChannel snapshot from starting nodes that never ran
(#9264 )
- Snapshot a DeltaChannel that an `update_state` Overwrite resets
(#9263 )
- Read a run's DeltaChannel input back only on its own checkpoints
(#9260 )
- Store an `update_state` input's writes on the checkpoint it updates
(#9258 )
- Keep an exit run from a checkpoint the thread moved past out of its
newer branch (#9269 )
- Stop at an `interrupt_before` breakpoint when a drain is requested
before it (#9281 )
- Save a cached node's writes like a node that ran (#9259 )
- Give every message written to a messages DeltaChannel an id (#9275 )
2026-10-12 18:34:01 -04:00
Elior Nataf Lackritz and Harsh Shroff
b7d053b256
fix(langgraph): give every message written to a messages DeltaChannel an id ( #9275 )
...
A DeltaChannel replays its saved writes on every read, and
`_messages_delta_reducer` doesn't fill in missing ids, so the loop gives
messages their ids before saving them (`ensure_message_ids`). That
missed several cases:
- Strings and `(role, content)` tuples, alone or in a list (`[("user",
"hi")]`), and messages inside an `Overwrite` were saved with no id, so
nothing could target them by id, for example `RemoveMessage`. A regular
messages channel gives them ids.
- A raw `Pregel` graph's input to a DeltaChannel got its ids after it
was applied, and none with exit durability or on a new thread; a dict
given as input read back with an id its nodes never saw. A
`Command(update=...)` sent to an older checkpoint got none either.
Now, in a DeltaChannel whose reducer is `_messages_delta_reducer`, every
message-like the reducer accepts becomes a message with an id before the
writes are saved or applied: in `put_writes`, before input is applied,
for a forked `Command`, and in `update_state`. Anything that can't
become a message is left as it is, so it fails where it always has.
Other DeltaChannels keep the rule they had (message objects, and message
dicts in a list, get ids), since they may hold other data and
deepagents' messages channel, which uses its own copy of the reducer,
relies on it; the dicts in an `Overwrite` there are left as they are.
Lists and dicts the caller passed in are never changed: a write that
changes is replaced. So the id step can recognize the reducer without an
import cycle, `_messages_delta_reducer` now lives in
`langgraph.pregel._messages`; `langgraph.graph.message` re-exports it.
Visible changes: in a messages DeltaChannel, a node's update streams as
messages with ids, and a string is stored as a message (about 170 bytes
more each).
JS twin: langchain-ai/langgraphjs#2992 . Thanks to @HarshShroff for
testing every `Overwrite` form and for the tuple fix.
## Tests
`test_delta_channel_id_stability.py` and
`test_delta_channel_update_state.py`: a write of every shape the reducer
accepts gets an id that every read keeps, as input, from a node and
through `update_state` (sync, async and as input); a list written twice
adds its messages twice and stays as it was; a forked `Command` gets an
id; a message dict the reducer rejects in a list still fails the run
before it's saved; a raw `Pregel` input gets an id on a new thread with
every durability, and its nodes see the ids that are saved; another
DeltaChannel keeps the dicts in an `Overwrite`. 36 of the 87 tests in
these files fail on main. The langgraph and prebuilt suites pass, and
lint is clean.
---------
Co-authored-by: Harsh Shroff <29751900+HarshShroff@users.noreply.github.com >
2026-10-12 20:33:45 +00:00
Elior Nataf Lackritz
395c145c04
fix(langgraph): save a cached node's writes like a node that ran ( #9259 )
...
A node served from the node cache had its writes applied but never
saved: the loop only streamed them. Plain channels didn't notice, since
the next checkpoint stores their value, but a `DeltaChannel` is rebuilt
from the saved writes, so its saved state lost the cached node's write
for good, under every durability. With `a -> b -> c` and `b` cached, a
second thread read back `log` as `a, c` next to `plain` as `a, b, c`.
The loop now saves a cache hit with `put_writes`, like a node that ran,
in all six places it matches cached writes. A new `cached` flag keeps
the hit streamed as cached and stops `put_writes` from writing it back
to the cache, which would also restart its TTL. A hit now costs the
saver write the node makes when it runs, and a cached `@task` call's
result is saved the same way.
The sync loop also stops caching a node that failed or was interrupted,
as the async loop already did: a cached error made the next run with the
same input skip the node without raising.
Found in review of langchain-ai/langgraphjs#2969 . JS twin:
langchain-ai/langgraphjs#2980
## Tests
- `test_delta_channel_node_cache.py`: `b` runs on the first thread and
is a cache hit on the second, under every durability, with `invoke` and
`ainvoke`. Every checkpoint of the second thread reads the same in the
DeltaChannel and a plain channel, and the cache is written once. All 6
cases fail on main; without the `cached` check in `put_writes`, they
fail on the cache count.
- `test_a_node_that_fails_is_not_cached`, with `invoke` and `ainvoke`: a
cached node that raises raises again on the next thread. The sync case
fails on main.
- The two tests that spy on `PregelLoop.put_writes` pass the new keyword
through.
- `make format`, `make lint_package`, `make lint_tests`, and the
`langgraph`, `prebuilt` and `cli` suites pass (without Redis).
2026-10-12 14:24:38 -04:00
Igor Soarez
10f1fabb3b
fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it ( #9281 )
...
When a drain is requested during the step right before an
interrupt_before breakpoint, the run stops with GraphDrained and the
breakpoint is lost: resuming the run skips it unintentionally.
The fix moves the drain check in tick() after the breakpoint check, so
breakpoints win over draining.
JS twin: langchain-ai/langgraphjs#3009
2026-10-12 18:29:56 +03:00
Elior Nataf Lackritz
799c2f04fd
fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch ( #9269 )
...
An exit-durability run that starts from a checkpoint the thread has
moved past, addressed by `checkpoint_id`, stores its DeltaChannel writes
on that checkpoint. The branch that already grew from it reads the
writes stored there, so its checkpoints picked up this run's writes too:
```python
graph.invoke({"log": ["in1"]}, config) # nodes a and b add "a1", "b1"
turn_1 = graph.get_state(config).config
graph.invoke({"log": ["in2"]}, config)
turn_2 = graph.get_state(config).config
graph.invoke({"log": ["in3"]}, turn_1, durability="exit")
graph.get_state(turn_2).values["log"]
# ["in1", "a1", "b1", "in3", "a3", "b3", "in2", "a2", "b2"], was ["in1", "a1", "b1", "in2", "a2", "b2"]
```
Sync and async durability store each step's writes on the run's own
checkpoints, so they weren't affected. The run now snapshots the
DeltaChannels it wrote instead, as a run's input already does on a
checkpoint a `checkpoint_id` addressed (#9260 ). That costs one snapshot
of each channel the run wrote, even when the addressed checkpoint is the
latest one. Threads that already hit this keep the wrong values on the
existing branch.
Found by @hntrl in review of langchain-ai/langgraphjs#2974
([repro](https://gist.github.com/hntrl/2185e489abe22147b3f6f77010c18264 )).
JS twin: langchain-ai/langgraphjs#2989
## Tests
`test_delta_channel_exit_mode.py`: one and two exit runs from the end of
turn 1, after turn 2, leave every checkpoint's DeltaChannel equal to a
plain reducer channel. Both fail on main on every saver in the fixture.
The `langgraph` suite passes (without Redis), and lint is clean.
2026-10-11 08:51:09 -04:00
Elior Nataf Lackritz
b4991f1ba3
fix(langgraph): store an update_state input's writes on the checkpoint it updates ( #9258 )
...
`update_state(..., as_node="__input__")` stored its writes on the
checkpoint it saved. A DeltaChannel reads the writes stored on a
checkpoint's ancestors, not its own, so that checkpoint read back
without the input unless the channel snapshotted there, and once a later
checkpoint snapshotted, the input was gone for good. Only a raw `Pregel`
graph whose input channel is a DeltaChannel hits it, since a
`StateGraph`'s input goes to its start channel.
The input's writes now go on the checkpoint the update builds on, as a
node update's do. An update on a checkpoint the thread has moved past
stores nothing there and snapshots the DeltaChannels it writes on its
own checkpoint instead, the rule a node update already follows (#9165 ).
Both kinds of update now go through one helper, which also gives a
message an id before saving it, as the loop's `put_writes` does with
`ensure_message_ids`. Before, a message saved through `update_state`
without an id read back with id `None`, on the node path too, while the
same message from a node got one.
JS twin: langchain-ai/langgraphjs#2973 , where review found it.
## Tests
`test_delta_channel_update_state.py`, sync and async: an update as input
reads back on its checkpoint and after the next run, with
`snapshot_frequency` 1 and 2, and an update as input to an older
checkpoint stays out of its other branch. The frequency 2 and
older-checkpoint cases fail on main. Five more check that a message
saved through `update_state` gets an id every read keeps, on the node
path (latest and older checkpoint) and the input path, sync and async;
they fail on main. The langgraph suite passes, and `lint_package` and
`lint_tests` are clean.
2026-10-10 11:57:46 +00:00
Elior Nataf Lackritz
6aa0afba68
fix(checkpoint): default InMemorySaver delta history to the latest checkpoint ( #9257 )
...
`InMemorySaver.get_delta_channel_history` looked its target up by
`config["configurable"].get("checkpoint_id", "")`, so a config without a
`checkpoint_id` matched no checkpoint, and every channel came back with
no seed and no writes, which a `DeltaChannel` reads as empty. The base
implementation, `PostgresSaver` and `SqliteSaver` read from the thread's
latest checkpoint instead, as `get_tuple` does.
A missing id now resolves to the namespace's newest checkpoint id, with
the same `max` that `InMemorySaver.get_tuple` uses. Graphs always pass a
checkpoint id here, so only direct callers of the saver API were
affected, and a call with an id does the same work as before.
Thanks @Hotragn, who pinned this down on #8242 , where @longquanzheng's
branch had already fixed it.
JS twin: langchain-ai/langgraphjs#2979
## Tests
- `test_get_channel_writes_without_checkpoint_id_reads_the_latest` fails
on main (`{'messages': {'writes': []}}`).
- The `checkpoint`, `checkpoint-conformance`, `checkpoint-sqlite`,
`checkpoint-postgres` (Postgres 16), `prebuilt` and `langgraph` suites
pass, the last two without their Redis cases. The DeltaChannel
conformance suite also passes against `InMemorySaver`; CI skips that run
in `libs/checkpoint`, where the conformance package isn't installed, so
the new test lives in `test_memory.py`.
2026-10-10 00:59:20 +00:00
Elior Nataf Lackritz
12aeb0fddb
fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints ( #9260 )
...
A raw `Pregel` graph whose input channel is a DeltaChannel saved a run's
input to it as a `NULL_TASK_ID` write on the checkpoint the run started
from, under `"sync"` and `"async"` durability. Readers apply a
checkpoint's `NULL_TASK_ID` writes as its own state, so:
- on a new thread that checkpoint is never saved, and the first run's
input was lost for good: after `{"log": [0], "plain": [0], ...}`, `log`
read `[2]` next to `plain` `[0, 2]`;
- the last checkpoint of a run read the next run's input;
- a run with input from an older checkpoint (`checkpoint_id`) leaked its
input into the branch that already grew from it, and read that branch's
input when it had one.
The input's writes now go on the checkpoint the run starts from under a
task id of their own, `uuid5(checkpoint_id, INPUT)`, the one
`update_state` uses for an input update. On a new thread, or a
checkpoint a `checkpoint_id` addressed, which may already have children
that would read them, nothing is stored there and the input checkpoint
snapshots the channel instead. A normal run stores the same write as
before, and `durability="exit"`, which already kept the input right, is
unchanged. Threads saved before this keep the input writes already
stored on their checkpoints.
A `StateGraph` routes its input through its start channel, so only raw
`Pregel` graphs hit this.
JS twin: langchain-ai/langgraphjs#2981
## Tests
`test_delta_channel_run_input.py`, under every durability, with `invoke`
and `ainvoke`: two runs on a new thread, and a run with input from an
older checkpoint whose other branch had DeltaChannel input or none.
Every checkpoint reads the same in the DeltaChannel and a plain channel.
The 12 sync and async cases fail on main, and dropping the task id, the
new-thread snapshot or the addressed-checkpoint snapshot each fails its
own cases. The `langgraph` and `prebuilt` suites pass (without Redis),
and `lint_package` and `lint_tests` are clean.
2026-10-09 15:59:10 -04:00
Elior Nataf Lackritz
d05236f805
fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets ( #9263 )
...
A node that writes an `Overwrite` to a DeltaChannel makes the loop
snapshot the channel on the checkpoint that superstep saves, so no read
replays across the reset. The same write through `update_state`, as a
node or as input, didn't snapshot: the value read back right, but reads
of the update's checkpoint and the ones after it walked back past the
reset to the last snapshot. `update_state` now snapshots a DeltaChannel
an `Overwrite` resets, as the loop does.
Raised in review of langchain-ai/langgraphjs#2973 . JS twin:
langchain-ai/langgraphjs#2982
## Tests
`test_delta_channel_update_overwrite.py`, sync and async: an `Overwrite`
through `update_state` as a node, and as input to a raw `Pregel` graph,
snapshots the channel on the checkpoint the update saves, and the value
reads back as the overwrite. All four fail on main. The `langgraph`
suite passes (without Redis), and `lint_package` and `lint_tests` are
clean.
2026-10-09 15:26:16 -04:00
Elior Nataf Lackritz
9d92f33cca
fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran ( #9264 )
...
A fork from a checkpoint with pending writes to a DeltaChannel snapshots
the channel on the fork's first checkpoint, so the fork doesn't replay
the other branch's writes. If the channel had never been written there,
the snapshot also gives it its first version, and `_mark_bumps_seen`
only marked the bump seen for nodes that already have a `versions_seen`
entry. A node subscribed to the channel that never ran has none, so the
bump started it, and it read the empty value before the node that writes
the channel had run:
```python
graph.invoke("go", config) # writer writes [1] to d, reader reads [1]
fork = graph.update_state(first_checkpoint, {"a": "go"}, as_node="__input__")
graph.get_state(fork).next # ("writer", "reader"): resuming runs reader on [] first
```
A replay from that checkpoint saves the same kind of fork from the loop.
A channel bumped from no version was never written, so
`create_checkpoint` now also marks the bump seen for the nodes the
channel triggers, from the graph's `trigger_to_nodes`, at every call
that can bump. Only raw `Pregel` graphs hit this: `StateGraph` nodes
trigger on their `branch:to:*` channels, not on state keys. An
`as_node="__copy__"` fork still starts such a node, with a plain list
channel as well, so that case isn't DeltaChannel-specific and isn't
changed here.
Raised in review of langchain-ai/langgraphjs#2974 . JS twin:
langchain-ai/langgraphjs#2983
## Tests
`test_delta_channel_seal_subscribers.py`: an update as input (sync and
async) and a replay from the checkpoint before a DeltaChannel's first
write leave only the writer next, and the reader then reads the written
value once. All three fail on main. The `langgraph` suite passes
(without Redis), and `lint_package` and `lint_tests` are clean.
2026-10-09 14:36:27 -04:00
Elior Nataf Lackritz
26356227c4
test(checkpoint): run the delta conformance suite against InMemorySaver in CI ( #9261 )
...
The conformance self-test in `libs/checkpoint-conformance` ran every
capability against `InMemorySaver` but asserted only the base ones.
`libs/checkpoint/tests/test_conformance_delta.py`, which ran the delta
conformance tests against it, always skips in CI: `libs/checkpoint`
can't depend on the conformance package, which depends on it. So no CI
job checked `InMemorySaver.get_delta_channel_history` against the delta
conformance tests.
The self-test now asserts every capability `InMemorySaver` implements,
and the skipped copy is gone.
## Tests
- With `InMemorySaver.get_delta_channel_history` broken to return no
history, the self-test now fails on 7 of the 10 delta conformance tests;
on main it still passes.
- `make format`, `make lint` and `make test` pass in
`libs/checkpoint-conformance`.
2026-10-09 13:44:55 -04:00
Elior Nataf Lackritz
a5dbacae0d
fix(checkpoint-postgres,checkpoint-sqlite): treat an empty checkpoint_id as the latest in delta history ( #9262 )
...
`PostgresSaver` and `SqliteSaver`, sync and async, read a DeltaChannel's
history from the latest checkpoint only when the config's
`checkpoint_id` was missing or `None`. An empty one was looked up as an
id, matched nothing, and came back with no seed and no writes, while
their own `get_tuple` treats an empty id as the latest checkpoint, as
the default implementation does. They now check for a missing or empty
id the way `get_tuple` does. The in-memory saver gets the same in #9257 .
Graphs always pass the id of a saved checkpoint, so only direct callers
of the saver API hit this.
## Tests
-
`test_{sync,async}_empty_checkpoint_id_reads_from_the_latest_checkpoint`
in `checkpoint-postgres/tests/test_delta_pagination.py` and
`checkpoint-sqlite/tests/test_delta_parent_walk.py`: all four fail on
main.
- The `checkpoint-postgres` (Postgres 16) and `checkpoint-sqlite` suites
pass, and `lint_package` and `lint_tests` are clean in both.
2026-10-09 13:44:51 -04:00
Elior Nataf Lackritz and iroiro147
cba111d8d6
fix(langgraph): don't save a checkpoint past a failed DeltaChannel write ( #9235 )
...
A DeltaChannel is rebuilt from its writes along the parent chain, so a
checkpoint saved without one of them reads back short for good. If
saving a DeltaChannel write failed (a database blip, say), the next
checkpoints were saved anyway and the channel lost that write, while
plain channels kept it. Three things let that happen:
- the sync loop waited for the delta writes before saving a checkpoint,
but never checked that they succeeded;
- both loops saved a checkpoint even when the previous save had failed,
so it pointed at a parent that was never saved;
- each save took the pending write list only when it started in the
background, and saves can start out of order, so a save could take a
later checkpoint's writes and not wait for its own. Waiting on writes
queued behind it, a save could also hang a sync run with
`durability="async"` (the default) once every worker was such a save: on
a 15-core machine a loop of 100 fast steps hung every time with default
settings, and with `max_concurrency=1` three steps are enough.
Now `_put_checkpoint` hands each save the writes submitted before it,
and a save fails if one of them or the previous save failed. The run
raises the write's error as before, the thread stays at its last
checkpoint that has all its writes, and running it again reruns the
task. For graphs without a DeltaChannel, a failed save now also stops
the later saves of that run, as JS already does, instead of saving
checkpoints whose parent is missing.
Thanks @shivangsharma01 for reproducing this in #8234 , and @iroiro147,
whose #8299 had the first two changes before the issue-assignment check
closed it. Thanks also to @HarshShroff for the failed-save test case.
JS twin: langchain-ai/langgraphjs#2969
## Tests
`test_delta_channel_write_failures.py`:
- a saver fails one delta write once; on every durability, with `invoke`
and `ainvoke`, every saved checkpoint matches a plain channel and a
retry gets the write back. The `invoke` cases and `ainvoke` with
`durability="async"` fail on main.
- a saver fails the save of the checkpoint after `a` once; with `invoke`
and `ainvoke`, every saved checkpoint matches a plain channel and a
retry finishes the run. The `durability="async"` cases fail on main,
which saves the later checkpoints on top of the missing one.
- a delta graph run with `max_concurrency=1` finishes. It hangs on main.
Reverting any one of the three changes fails at least one of these.
`make format`, `make lint` and the langgraph suite pass. A 100-step
benchmark (delta and plain channels, every durability, with and without
1 ms of saver latency) makes the same saver calls and runs in the same
time as main, except for the case that hangs on main.
---------
Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com >
2026-10-09 12:48:24 +00:00
Elior Nataf Lackritz
93a5a28008
perf(checkpoint-postgres): start the delta walk at the target ( #9248 )
...
Reading a DeltaChannel at an older checkpoint (the state at a past
checkpoint, each entry of `get_state_history`, a fork or replay from
one) walked `checkpoints` down from the newest row, so every newer row
was read before the target's chain. A checkpoint's ancestors have
smaller ids, the order `get_tuple` already relies on to find the latest
checkpoint, so the walk now starts at the target: the first page is
`checkpoint_id <= target`, later pages stay `< cursor`.
The cursor is never NULL anymore, so the `(cursor IS NULL OR
checkpoint_id < cursor)` predicate goes too. Once Postgres caches a
generic plan for the prepared statement (`from_conn_string` sets
`prepare_threshold=0`), that predicate is a filter rather than an index
condition, and each later page re-read every newer row.
`get_delta_channel_history` on a 6,000-checkpoint thread with a snapshot
every 200 checkpoints, median of three runs of 60 reads each, same
results before and after:
| target | main | this PR |
|---|---|---|
| newest | 3.1 ms | 2.7 ms |
| 1,000 back | 4.5 ms | 2.9 ms |
| 3,000 back | 8.9 ms | 2.8 ms |
| 5,000 back | 15.7 ms | 2.8 ms |
The target is now always the first row read, so the pagination tests
from #8556 can no longer leave it off the first page; they are renamed
for what they still cover, a walk that continues across pages.
## Test plan
- [x] `test_{sync,async}_walk_reads_nothing_newer_than_the_target`
record the rows the walk reads; both fail on main, which also reads the
three newer checkpoints.
- [x] `checkpoint-postgres` suite on Postgres 16: 281 passed, 3 skipped.
- [x] `langgraph` DeltaChannel tests against this saver (`-k "delta and
not redis"`): 1,154 passed, 1 skipped.
2026-10-09 08:31:15 -04:00
bfcfea554e
fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate namespace labels before store dispatch ( #9217 )
...
The SQLite and Postgres stores save a namespace as its labels joined
with `.`, so a label containing `.` could resolve to a different
namespace: `("foo.bar",)` and `("foo", "bar")` share the same row. This
rejects those labels at every entry point.
- `BaseStore` and `AsyncBatchedBaseStore`: `get`, `search`, `delete`,
and `list_namespaces` (sync and async) reject labels that are empty, not
strings, or contain `.`. The check runs before an op is queued, so one
caller's bad label can't fail other callers' concurrent requests.
- New `langgraph.store.base.validate_op_namespace(op)` applies the same
label checks to a single op. `SqliteStore`/`AsyncSqliteStore` and
`PostgresStore`/`AsyncPostgresStore` call it from `_group_ops` before
any SQL runs, which covers direct `batch`/`abatch` calls. Other stores
that serialize namespaces as delimited text can call it too.
- Unchanged: hierarchical prefix search, empty-prefix `search(())`, `*`
wildcards in `list_namespaces`, and the existing `put` rules.
## Release note
`get`, `search`, `delete`, and `list_namespaces` now raise
`InvalidNamespaceError` for labels that are empty, not strings, or
contain `.`, where they previously returned `None` or `[]` (or, on the
SQLite and Postgres stores, matched a different namespace). `put`
already rejected these labels, so nothing written through `put` becomes
unreachable.
## Release order
Release `langgraph-checkpoint` first. `langgraph-checkpoint-sqlite` and
`langgraph-checkpoint-postgres` import `validate_op_namespace`, so they
need the `langgraph-checkpoint` release that ships it. `main` already
has `libs/checkpoint` at 4.3.0 and requires
`langgraph-checkpoint>=4.3.0` in both stores (from #8544 ), so this must
merge before 4.3.0 is released; if 4.3.0 ships first, bump to the next
version and raise both requirements to it. That also guarantees the
pre-queue checks are installed: with an older `langgraph-checkpoint`, an
invalid op would fail inside the shared `abatch` and reject the calls
batched with it.
---------
Co-authored-by: Baihao Wang <byhow@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-08 16:10:55 -07:00
Elior Nataf Lackritz
93f5eaff21
fix(checkpoint): keep serialized data when an object can't be rebuilt ( #9251 )
...
Fixes #6970
If a checkpointed object can't be rebuilt on load (its module was
removed or renamed, or its constructor now rejects the stored fields),
`JsonPlusSerializer` returned `None` for it, so the value silently
disappeared from restored state. The constructor and method ext codes
now return the serialized payload instead, the same thing the pydantic
and blocked-type paths already do, and log a one-time warning per type.
The warning names the exception type only, since exception messages can
echo the stored value.
Thanks @yangbaechu for the report and repro. This takes the same
direction as #6972 by @pandego and #7152 by @SinzoL.
2026-10-08 16:01:46 -04:00
Baihao Wang
5965d72ff7
fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values ( #9232 )
...
**Problem.** `interrupt(response_schema=...)` checks a human's answer
when the graph resumes. If the answer doesn't match the schema, the
resume fails, nothing is saved, and the human can answer again (#8886 ).
That works when the interrupt runs in a graph node, but not when it runs
inside a tool: either the tool calls `interrupt()` itself, or it starts
a graph that does, such as a subagent called as a tool. There, the
resume returns normally and the interrupt disappears.
**Why.** `interrupt()` raises a `pydantic.ValidationError` for an
invalid answer. When one comes out of a tool, `ToolNode` assumes the
model passed bad arguments, so it hands the error to the model ("Error
invoking tool … Please fix the error and try again") and the run carries
on. The human never sees the error, the model is blamed for it, and the
interrupt is no longer pending.
**Fix.** `interrupt()` still raises the same `ValidationError`, but
marks it so a new helper, `langgraph.errors.is_invalid_resume(error)`,
can recognize it. `ToolNode` re-raises these errors instead of handing
them to the model, whatever `handle_tool_errors` is set to, so a bad
answer fails the resume the same way inside a tool as outside one:
nothing is saved and the interrupt can be answered again. Every other
`ValidationError` from a tool is handled as before.
**Also fixed, in the same error handling.** With `wrap_tool_call` set
and a `handle_tool_errors` other than the default (for example `True`),
`ToolNode` turned any exception from the wrapper into an error
`ToolMessage`, including `GraphInterrupt`. So an interrupt in that setup
never paused: the model got `Error: GraphInterrupt(...)` instead.
Interrupts now propagate there too, as they already do without a
wrapper. `create_agent` uses the default handler, so it was not
affected.
**Compatibility.** Not a breaking change: the error type is unchanged.
Worth a careful look: a wrapped `ToolNode` with a non-default
`handle_tool_errors` now pauses on interrupts instead of returning them
to the model as errors. With an older `langgraph` that doesn't have
`is_invalid_resume`, `ToolNode` keeps today's behavior.
2026-10-08 12:59:25 -07:00
Elior Nataf Lackritz
40a2e6d845
fix(langgraph): never store exit-mode delta writes under the null task id ( #9229 )
...
In exit mode, a run stores its DeltaChannel writes on the checkpoint it
started from, under synthetic task ids that put the superstep first. For
a `Command`'s writes in a run whose first superstep is 0, that id came
out as `NULL_TASK_ID` itself. Readers take writes under `NULL_TASK_ID`
for the checkpoint's own pending writes, so after
`invoke(Command(update=...), durability="exit")`:
- on a new thread, `get_state` on the empty first checkpoint showed the
update in the DeltaChannel but not in a plain channel;
- on a thread whose first checkpoint came from `update_state(...,
as_node="__input__")`, `get_state` on that checkpoint showed the update
the same way, and a replay or fork from it applied the update to the
DeltaChannel only.
`exit_delta_task_id` now never returns `NULL_TASK_ID`. Threads already
saved this way stay as they are.
## Tests
- `test_command_update_on_an_input_checkpoint_matches_a_plain_channel`
compares every checkpoint in the history, and a replay from the input
checkpoint, with a plain channel, on every checkpointer and durability.
The exit cases fail without the fix.
- `test_exit_command_update_on_a_new_thread_matches_a_plain_channel`
compares every checkpoint in a new thread's history with a plain
channel, on every checkpointer, and fails without the fix. It runs in
exit mode only: in sync and async the two channels already differ on
`main`, because of a separate bug that applies a new thread's `Command`
update twice.
`make format`, `make lint` and the langgraph suite pass.
2026-10-07 19:17:02 -04:00
Elior Nataf Lackritz
a0053bb616
fix(sdk-py): end a thread stream's run only on a root lifecycle event ( #9228 )
...
The thread stream's lifecycle watcher ended the run on any `completed`
or `failed` lifecycle event, including the one a subgraph sends when it
finishes. So `thread.output` could read the thread state before the
parent stored the step that ran the subgraph, and a run that failed
after a subgraph completed was reported as completed. The async and sync
watchers now end the run only on a root event, with the
`_is_root_terminal_lifecycle` check the fanout already uses. The JS SDK
checks the root namespace here too.
This is the `sdk-py integration` flake where the final `items` comes
back as `['streamed', 'tool', 'asked']` without `'sub'`: the example
graph's last node runs a subgraph.
## Tests
New async and sync tests send a subgraph `completed` and then a root
`failed`. Without the fix the run ends as completed. `make lint` and
`make test` in `libs/sdk-py` pass.
2026-10-07 19:03:46 -04:00
Igor Soarez
87f1c8eb9a
fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 ( #9219 )
...
### Problem
`Pregel.astream_events` declared `interrupt_before`, `interrupt_after`
and
`control` as keyword-only parameters, but forwarded them only on the
`version="v3"` branch. On async `version="v1"`/`"v2"` the values were
bound to
named parameters and never entered `**kwargs`, so they were silently
dropped
on the way to `astream` — no error, no effect:
- `request_drain()` on a caller-supplied `RunControl` did nothing; the
graph
created its own control and ran to completion.
- Static interrupts passed as `astream_events(...,
interrupt_before=[...])`
never fired.
This is a regression introduced by #7677 (first released in `1.2.0a3`).
Before that, `Pregel` did not override `astream_events`, and these
keywords
reached `astream` through `**kwargs` — langchain-core's v1 and v2 event
implementations both forward caller kwargs to `astream`
(`tracers/log_stream.py`, `tracers/event_stream.py`).
Downstream impact: langgraph-api passes run-level `interrupt_before` /
`interrupt_after` into `graph.astream_events(..., version="v2",
**kwargs)` for
runs with `stream_mode="events"` (`models/run.py`, `stream.py`), so
server
runs using that stream mode have silently dropped static interrupts
since
langgraph 1.2.0a3.
Sync `stream_events(version="v1"/"v2")` is unaffected: langchain-core
raises
`NotImplementedError` there, so there was no working sync path to break.
### Fix
Remove the three parameters from the public runtime implementations of
`stream_events` / `astream_events` (and from the explicit passing in
their v3
dispatch calls), so the values travel through `**kwargs` again:
- **v1/v2** recover the pre-#7677 passthrough. `astream` receives
exactly what
the caller passed — a supplied value, an explicit `None`, or nothing for
an
omitted argument.
- **v3** is unchanged. The values bind on `_pregel_stream_v3` /
`_apregel_stream_v3`, which keep their named parameters and
since-inception
(#7519 , `1.2.0a1`) explicit-`None` defaults: an omitted argument arrives
at
`astream` as `None`, exactly as before.
What `astream` receives after this change:
| caller supplies | async v1/v2 | v3 (sync and async) |
|---|---|---|
| nothing | argument absent | explicit `None` |
| explicit `None` | `None` | `None` |
| a value | the value | the value |
The typed `version="v3"` `@overload` stubs are untouched, so v3 call
sites
keep their static types (invalid values still fail `ty` there, same as
on
`main`). `RemoteGraph` and the v3-only `transformers` parameter are
untouched.
Complexity: net −24 lines in `main.py` with no branches, sentinels or
wrappers added. The public capture-and-drop pattern that caused the bug
is
gone; the two private helpers each have a single call path and forward
unconditionally, so they cannot drop anything.
Docstrings now describe the three parameters as honored on every async
version (type-checked only on the v3 overloads), and no longer promise
synchronous v1/v2 event streaming, which langchain-core does not
implement.
### Compatibility notes
- The three parameters were keyword-only, so no caller can break;
keyword
callers bind through `**kwargs` identically.
- The names leave the runtime signatures (`inspect.signature`), while
the v3
overloads keep the typing.
- v3 is unchanged: `_pregel_stream_v3`/`_apregel_stream_v3` still
default all
three to `None` and pass them explicitly, so an override's non-`None`
default never applied on v3 and still doesn't. The only behavior change
beyond restoring the pre-#7677 passthrough is on v1/v2 with an explicit
`None`: since 1.2.0a3 the named-parameter capture dropped it, so an
override's non-`None` default was silently applied instead; now the
explicit `None` reaches `astream`, as it did before 1.2.0 and as it does
on
v3.
### Testing
New tests in `tests/test_stream_events_v3_kwarg_forwarding.py`:
- `interrupt_before` / `interrupt_after` / pre-drained `control`
parametrized
over v1/v2/v3 (12 of them fail on unpatched `main`).
- Sync v3 static interrupts.
- Mid-run drain: a node calls `request_drain()`; asserts `GraphDrained`
propagates, the caller's own `RunControl` was used, and the checkpoint
keeps the pending step.
- Recording tests pin, for all three names and on both the async and
sync v3
paths, exactly what `(a)stream` receives: supplied values (with
`control`
identity), explicit `None`, and absence for omitted arguments.
Verified by mutation: replacing the implementation with each rejected
alternative (unpatched parent; injecting `None` for omitted kwargs on
v1/v2;
dropping explicit `None` on v1/v2; kwargs-only private helpers) makes
the
corresponding tests fail.
Suites: 246 passed on the four adjacent streaming test files; 906 passed
/
1 skipped across every test file calling `(a)stream_events` plus
`test_runtime.py`. `ruff check` / `format --check` clean; `ty check
langgraph`
clean.
Not verifiable locally (CI please): Python 3.10 (the new tests carry no
version skip), minimum supported langchain-core, and a live
langgraph-api
server run.
### Release note
> Fixed a regression since 1.2.0a3: `Pregel.astream_events` silently
dropped
> `interrupt_before`, `interrupt_after` and `control` for
> `version="v1"`/`"v2"`. Static interrupts and `RunControl` drains now
work on
> every async version. Server runs using `stream_mode="events"` were
affected
> and get their static interrupts back.
2026-10-07 12:26:50 -04:00
gethin-langchain
736a18eaab
release(cli): 0.4.33 ( #9227 )
...
Bumping the CLI to 0.4.33 to cut a release including #9221 (deploy
listeners list) and #9222 (--image-uri).
2026-10-07 09:19:34 -04:00
gethin-langchain
ec4f8535f8
feat(cli): add --image-uri to deploy an already-pushed image ( #9222 )
...
## Summary
`--push-to` always builds (or retags a local `--image`) and pushes, even
when the image already exists at the destination. That breaks CI/CD
pipelines where the build/push step and the deploy step run in separate
jobs: the deploy job has no local copy of the image to retag, and
`--image` requires one (it runs `docker image inspect`, which needs the
image present in the local Docker daemon).
This adds `--image-uri`, which takes a full image reference already in a
registry and deploys it directly via `source_revision_config.image_uri`,
with no local Docker involvement at all: no inspect, no build, no tag,
no push. It gets the same placement behavior as `--push-to`
(`--listener-id`/`--k8s-namespace`, or auto-selecting the sole listener)
and the same update-in-place semantics, since both produce an
`external_docker` deployment and are interchangeable on the same
deployment.
`--image-uri` requires a digest (`repo@sha256:...`) and rejects
empty/blank input. `--push-to` always resolves to a digest after
pushing; `--image-uri` has no push step to resolve one from, so a
mutable tag (or an unvalidated empty string) could let Kubernetes
silently keep running a previously cached image while the CLI reports
success.
Implementation: `CustomerRegistrySource`'s image-acquisition step is
split into two variants, `BuildAndPush` (the existing
`--push-to`/`--image` flow, unchanged behavior) and `PublishedImage`
(the new flag), so create/update/placement logic stays shared. Also
reworded `_ensure_customer_registry_source`'s error, which previously
mentioned only `--push-to` even though it's reachable from `--image-uri`
too.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] Unit tests in `test_deploy_helpers.py` for `_select_source`
selecting `PublishedImage` (by digest, trimmed), requiring no local
Docker, carrying placement, and the mutual-exclusivity + validation
errors (`--push-to`, `--image`, `--tag`, `--remote`, empty/blank input,
missing digest)
- [x] CLI-level tests in `test_deploy_command.py`: create and update an
external deployment via `--image-uri` with zero Docker calls, listener
auto-placement, rejecting a non-external existing deployment (now
mentioning both flags), and the conflicting-flag cases end to end
- [x] Full `libs/cli` suite: 524 passed, no regressions
2026-10-07 13:32:46 +01:00
gethin-langchain
ce14d33687
feat(cli): add 'langgraph deploy listeners list' ( #9221 )
...
## Summary
Originally this auto-selected a workspace's sole listener for
self-hosted/hybrid control planes the same way #9056 already does for
Cloud. Per review, that's reverted: in self-hosted environments, leaving
placement blank is the deliberate signal to deploy to the bundled
operator, not an unresolved default. Auto-selecting a sole listener
there would silently take that option away from anyone who has both a
bundled operator and one listener configured, with no way to get it
back.
The actual need behind this was simpler: a way to find a listener's id
without hardcoding it, so it can be passed to `--listener-id`
explicitly. `HostBackendClient.list_listeners()` already existed and is
used internally for placement resolution, but had no CLI surface of its
own.
This adds `langgraph deploy listeners list`, mirroring the existing
`deploy list` / `deploy revisions list` pattern, to look up a
workspace's listeners and their namespaces. No change to default
placement behavior.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] `format_listeners_table` unit test in `test_util.py`
- [x] CLI-level tests for `deploy listeners list` (with and without
results) in `test_cli.py`
- [x] Full `libs/cli` suite: 508 passed, no regressions
2026-10-07 13:32:26 +01:00
dependabot[bot]
708aaa4ebc
chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph ( #9206 )
...
Bumps [notebook](https://github.com/jupyter/notebook ) from 7.5.7 to
7.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/releases ">notebook's
releases</a>.</em></p>
<blockquote>
<h2>v7.6.3</h2>
<h2>7.6.3</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.2...9c8d7c24006554dda8c5fc02c69f91d6449c712a ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.4 <a
href="https://redirect.github.com/jupyter/notebook/pull/8066 ">#8066</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-08-11&to=2026-09-21&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-08-11..2026-09-21&type=Issues ">activity</a>)</p>
<h2>v7.6.2</h2>
<h2>7.6.2</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.1...2f1f1622fc64e09b90ade87ed886fdfe1bc653fb ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Add nvd.nist.gov to the check_links ignore list <a
href="https://redirect.github.com/jupyter/notebook/pull/8032 ">#8032</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Backport JupyterLab dependency updater improvements <a
href="https://redirect.github.com/jupyter/notebook/pull/8031 ">#8031</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.6.3 <a
href="https://redirect.github.com/jupyter/notebook/pull/8030 ">#8030</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Switch local pre-commit hooks to language: system <a
href="https://redirect.github.com/jupyter/notebook/pull/8002 ">#8002</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Documentation improvements</h3>
<ul>
<li>Update 'notebook v7 proposal' link in doc <a
href="https://redirect.github.com/jupyter/notebook/pull/8004 ">#8004</a>
(<a href="https://github.com/brichet "><code>@brichet</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-07-22&to=2026-08-11&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/brichet "><code>@brichet</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Abrichet+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)
| <a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)</p>
<h2>v7.6.1</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/blob/@jupyter-notebook/tree@7.6.3/CHANGELOG.md ">notebook's
changelog</a>.</em></p>
<blockquote>
<h2>7.6.3</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.2...9c8d7c24006554dda8c5fc02c69f91d6449c712a ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.4 <a
href="https://redirect.github.com/jupyter/notebook/pull/8066 ">#8066</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-08-11&to=2026-09-21&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-08-11..2026-09-21&type=Issues ">activity</a>)</p>
<!-- raw HTML omitted -->
<h2>7.6.2</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.1...2f1f1622fc64e09b90ade87ed886fdfe1bc653fb ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Add nvd.nist.gov to the check_links ignore list <a
href="https://redirect.github.com/jupyter/notebook/pull/8032 ">#8032</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Backport JupyterLab dependency updater improvements <a
href="https://redirect.github.com/jupyter/notebook/pull/8031 ">#8031</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.6.3 <a
href="https://redirect.github.com/jupyter/notebook/pull/8030 ">#8030</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Switch local pre-commit hooks to language: system <a
href="https://redirect.github.com/jupyter/notebook/pull/8002 ">#8002</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Documentation improvements</h3>
<ul>
<li>Update 'notebook v7 proposal' link in doc <a
href="https://redirect.github.com/jupyter/notebook/pull/8004 ">#8004</a>
(<a href="https://github.com/brichet "><code>@brichet</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-07-22&to=2026-08-11&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/brichet "><code>@brichet</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Abrichet+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)
| <a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)</p>
<h2>7.6.1</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.0...72c228d76d1a9e5aa81531f7cf3c6af410c5e53f ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.2 <a
href="https://redirect.github.com/jupyter/notebook/pull/7996 ">#7996</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/notebook/commit/dc710245bf156f11bafc6e7d283695253d6b5cd7 "><code>dc71024</code></a>
Publish 7.6.3</li>
<li><a
href="https://github.com/jupyter/notebook/commit/9c8d7c24006554dda8c5fc02c69f91d6449c712a "><code>9c8d7c2</code></a>
Update to JupyterLab v4.6.4 (<a
href="https://redirect.github.com/jupyter/notebook/issues/8066 ">#8066</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/ffc52152951a52ef4885f12521d7a5f8ebd2f9c1 "><code>ffc5215</code></a>
Publish 7.6.2</li>
<li><a
href="https://github.com/jupyter/notebook/commit/2f1f1622fc64e09b90ade87ed886fdfe1bc653fb "><code>2f1f162</code></a>
Update to JupyterLab v4.6.3 (<a
href="https://redirect.github.com/jupyter/notebook/issues/8030 ">#8030</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/63df75281ec7226826877f2e77dc68670b109c33 "><code>63df752</code></a>
Backport JupyterLab dependency updater improvements (<a
href="https://redirect.github.com/jupyter/notebook/issues/8031 ">#8031</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/66101117b79c92baf364d95647242f490807f18c "><code>6610111</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8032 ">#8032</a>:
Add nvd.nist.gov to the check_links ignore list (<a
href="https://redirect.github.com/jupyter/notebook/issues/8033 ">#8033</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/75a02cb28e7ed7a58358b69323be3d9e4800f941 "><code>75a02cb</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8004 ">#8004</a>:
Update 'notebook v7 proposal' link in doc (<a
href="https://redirect.github.com/jupyter/notebook/issues/8005 ">#8005</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/2b0ebe6584d3f6d59d458a9414f00c985ead4feb "><code>2b0ebe6</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8002 ">#8002</a>:
Switch local pre-commit hooks to language: system (<a
href="https://redirect.github.com/jupyter/notebook/issues/8003 ">#8003</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/e058ab3a0d98a4698f201e10d7de723c70150d34 "><code>e058ab3</code></a>
Publish 7.6.1</li>
<li><a
href="https://github.com/jupyter/notebook/commit/72c228d76d1a9e5aa81531f7cf3c6af410c5e53f "><code>72c228d</code></a>
Update to JupyterLab v4.6.2 (<a
href="https://redirect.github.com/jupyter/notebook/issues/7996 ">#7996</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/tree@7.5.7...@jupyter-notebook/tree@7.6.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-07 17:21:37 +09:00
Elior Nataf Lackritz
39c523eb0a
fix(langgraph): give each bulk_update_state update its own task id ( #9128 )
...
`bulk_update_state` stores each update's writes on the checkpoint it
updates, under a task id. An update whose node has no pending task to
reuse got `uuid5(checkpoint_id, INTERRUPT)`, so every such update in one
superstep shared an id. Savers keep one write per `(task_id, idx)`, so
all but the first update's writes were dropped.
Plain channels don't notice, since their value is stored in the new
checkpoint. A `DeltaChannel` rebuilds its value from those writes, so it
lost every update after the first, on memory, sqlite and postgres:
```python
graph.bulk_update_state(config, [[
StateUpdate({"d": ["u1"], "p": ["u1"]}, as_node="a"),
StateUpdate({"d": ["u2"], "p": ["u2"]}, as_node="m"),
]])
# plain: [..., 'u1', 'u2']
# delta: [..., 'u1']
```
The existing multi-update test only passed because it gave each update
an explicit `task_id`, and its docstring said so.
## Fix
The `i`th update gets `uuid5(checkpoint_id, f"{INTERRUPT}:{i}")`. The
first keeps the old id, so a single `update_state` stores exactly what
it did before. Updates that reuse a pending task's id, or pass their
own, are unchanged.
Each update also gets the task path `(__interrupt__, i)`, stored with
its writes. Live execution applies a superstep's updates in the order
given, and a saver that replays a checkpoint's writes by task path
(#8544 ) now gives them back in that order instead of by task id. Savers
whose `put_writes` takes no `task_path` get the old call.
## Limits
- On savers that order a checkpoint's writes by task id only (the
released ones, until #8544 ), several updates in one superstep still
replay in task id order.
- langgraphjs has the same shared id in `bulkUpdateState` and loses the
same update; fixed in langchain-ai/langgraphjs#2923 with the same ids.
## Tests
`test_delta_channel_update_state.py` adds sync, async and
next-to-a-pending-task cases across the checkpointer fixtures, with no
explicit task ids, on a thread that already has history (a fresh thread
snapshots every delta channel and hides the bug). All 19 fail on main.
Two more (sync and async) give six updates in one superstep and check
that `get_state` returns them in that order, on a saver that replays by
task path; they fail without the path.
2026-10-07 01:04:58 +00:00
3a1796ecf0
fix(langgraph): replay a resumed exit-mode run's delta writes in live order ( #9114 )
...
Depends on #8544
Resuming an exit-durability run after a parallel interrupt replays the
resumed checkpoint's `DeltaChannel` writes wrong: twice on `main`, out
of order if the duplicate is simply dropped. `p` finished before `q`
interrupted, and `r` runs after `q`:
```
live: ['in1', 'p', 'r']
main, reload: ['in1', 'p', 'r', 'p']
```
No fork is involved. Any exit-mode run that starts from a checkpoint
with pending delta writes hits it: resuming an interrupt, or retrying
after a task error.
## Cause
Exit durability stores a run's delta writes on the checkpoint it started
from, under step-prefixed task ids (`exit_delta_task_id`), so they
replay in superstep order. On a resume, that checkpoint already holds
the finished tasks' writes under their real task ids. The accumulator
stored those loaded writes again under a step-prefixed id, so they
replayed twice. Skipping them alone reorders the replay, because the
real ids sort after the step-prefixed ones.
## Fix
At exit:
- writes loaded with the checkpoint are skipped, since they are already
stored on it: `NULL_TASK_ID` writes by task id (this run's own `Command`
writes are recorded separately in `_first`), the rest by `(task_id,
channel)`;
- the checkpoint's own superstep keeps its real task paths, so it
interleaves with the loaded writes as live execution did, but gets a
step-prefixed task id. Under the real id, a resume whose final
checkpoint fails to save would leave the resumed task looking done, and
the retry would skip it and lose its other writes;
- a resume addressed by `checkpoint_id` reruns tasks whose writes are
already stored on the checkpoint; their writes to those channels are
skipped, and a write to a channel the task did not write before is kept;
- later supersteps get task id `ffffffff-<step>-...` and task path
`~~<step>...`, which sort after every real task id and every real task
path, in step order.
So superstep order holds whether a saver orders by task path (#8544 ) or
only by task id.
## Limits
- Within the resumed superstep, a saver that orders only by task id
replays this run's writes before the ones loaded from the checkpoint.
#8544 fixes that for the OSS savers.
- If the final checkpoint fails to save, the writes of supersteps after
the resumed one stay on the checkpoint and replay once more after the
retry (on `main`, every write does). That comes from exit durability
storing its writes before its checkpoint, not from this change.
## Tests
`test_delta_channel_exit_mode.py`, on the shared checkpointer fixture
(memory, sqlite, postgres) in all three durabilities:
- resume after a parallel interrupt with a later write, plain and with
the head's `checkpoint_id`
- the resumed superstep interleaved by task path: `a_asks` resumes after
`z_done` finished, and live order puts `a` first
- the same runs on a saver that orders writes by task id only
- a resume retried after its final checkpoint failed to save
- a resume with `Command(resume=..., update=...)` that writes the delta
channel replays that write once, in live order
- an addressed resume whose rerun task writes a delta channel it did not
write before keeps that write
The exit cases fail without the change, except the last one, which
guards against skipping by task id alone (an earlier version of this PR
did); sync and async pass either way.
#8548 marked exit durability in
`test_resume_on_an_interrupted_head_consumes_its_writes_without_a_snapshot`
as a strict expected failure for this bug; this PR drops the mark.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
---------
Co-authored-by: ErenAta16 <149434812+ErenAta16@users.noreply.github.com >
Co-authored-by: ragnarok268 <58264829+ragnarok268@users.noreply.github.com >
2026-10-06 22:05:55 +00:00
2b93e8b79f
fix: order delta channel replay by task path ( #8544 )
...
Fixes langchain-ai/langgraph#8382
`DeltaChannel` rebuilds its value by replaying ancestor writes through
the reducer. Every saver ordered a checkpoint's writes by `(task_id,
idx)`, but live execution applies a super-step's writes in task-path
order (`apply_writes` sorts tasks by `task_path_str(task.path[:3])`).
`task_id` is a hash of the path, so when two or more tasks write one
`DeltaChannel` in the same super-step, replay applies them in an
arbitrary permutation.
Reducers must be batching-invariant, not order-invariant, so the
permutation changes the value: `get_state` disagrees with what `invoke`
returned, and continuing the thread saves the reordered value as the
base for every later write.
## Fix
Replay orders by `(task_path, task_id, idx)`, the order
`SELECT_PENDING_SENDS_SQL` already uses for sends. `apply_writes` and
every saver now sort with one `writes_sort_key` from
`langgraph.checkpoint.base`, in Python, so live and replay can't drift
apart and don't depend on a database collation. `apply_writes` sorts by
the full task path, the string `put_writes` stores, instead of
`path[:3]`. The paths that reach `apply_writes` no longer carry task
ids, so the live order doesn't change.
`BaseCheckpointSaver`'s default `get_delta_channel_history` can't sort
by path, since `PendingWrite` has no task path, so it replays each
checkpoint's writes in `get_tuple` order. `get_tuple` now has to return
`pending_writes` in `writes_sort_key` order, and memory, SQLite and
Postgres do, so the default walk is right for any saver that follows
that. `AsyncPostgresSaver` also gets the sync
`get_delta_channel_history` that `AsyncSqliteSaver` already had; sync
reads used to fall back to the default walk.
Memory and Postgres already stored `task_path`. SQLite accepted it on
`put_writes` and dropped it, so `writes` gains the column and `setup()`
adds it to existing databases.
Writes without a task path (graph input, `update_state` updates, rows
written before the column existed) sort first by `task_id`, which is
also where live execution applies input.
## Compatibility
- Memory and Postgres already had `task_path` on disk, so existing
threads replay in the corrected order after upgrade.
- On SQLite, rows from before the upgrade read back as `''` and keep
their old order. Only new writes get the corrected order, since there is
no stored path to recover.
- SQLite has no `ADD COLUMN IF NOT EXISTS`, so `setup()` runs the
`ALTER` and treats `duplicate column name` as success, which also covers
two processes migrating one file. That error comes while SQLite prepares
the statement, before it asks for the write lock, so `setup()` on an
up-to-date database doesn't wait on other writers. A read-only database
from before the column is read with empty paths instead of failing
setup.
- Downgrade is safe: older code's `INSERT` omits the column and the
column has a default.
- `get_tuple` and `list` return `pending_writes` in `writes_sort_key`
order instead of task id order (SQLite, Postgres) or put order (memory).
Nothing in langgraph depends on the old order.
- Postgres reads `task_path` and `idx` with each pending write, so a
subclass that pairs `SELECT_SQL` with its own `_load_writes`, or the
other way round, has to match the new row shape.
- A third-party saver has to replay in `writes_sort_key` order: in its
own `get_delta_channel_history` if it has one, otherwise by returning
`pending_writes` from `get_tuple` in that order. Otherwise it fails the
new conformance tests; the `get_tuple` one is a base test, so it runs
for every saver.
- langgraph, checkpoint-sqlite and checkpoint-postgres import
`writes_sort_key` from langgraph-checkpoint, so this bumps
langgraph-checkpoint to 4.3.0 and requires it there. 4.3.0 has to be
released first.
## Limits
- Several updates in one `bulk_update_state` super-step share a task id,
so the saver keeps only the first one's writes and the `DeltaChannel`
loses the rest (plain channels are fine). That's on main too; #9128
fixes it and stores a task path per update, so with this PR those
updates also replay in the order given.
- Exit durability stores its writes differently; resume ordering there
is fixed in #9114 , stacked on this PR.
- langgraphjs applies `DeltaChannel` writes in task id order, live and
on replay (langchain-ai/langgraphjs#2544 ), so its reads match too.
Moving JS to task path order is a follow-up.
## Tests
Each fails on main and passes here:
- `test_delta_channel_parallel_order.py`, across memory, SQLite and
Postgres: parallel writers and a `Send` fan-out, comparing `get_state`
with the live result, including sync `get_state` on the async savers.
- Three conformance tests whose task ids sort opposite to their task
paths, so they cannot pass by chance: two on
`get_delta_channel_history`, one on `get_tuple`'s `pending_writes`
order.
- SQLite migration tests from a pre-column database, sync and async,
including a read-only file.
One more that passes on main too: SQLite `setup()` while another
connection holds the write lock, with no busy timeout, sync and async.
It keeps the `ALTER` from waiting on that lock.
Thanks to @ErenAta16 for the report, the reproduction, and for tracing
`task_path` through all three backends, and to @ragnarok268 for the
conformance-test design with task ids ordered opposite to their paths.
---------
Co-authored-by: ErenAta16 <149434812+ErenAta16@users.noreply.github.com >
Co-authored-by: ragnarok268 <58264829+ragnarok268@users.noreply.github.com >
2026-10-06 17:55:04 -04:00
Nick Hollon
70dd64065b
release(langgraph): 1.2.14 ( #9215 )
...
Bumps langgraph from 1.2.13 to 1.2.14.
Raises the minimum `langgraph-sdk` to 0.4.6, which percent-encodes
`thread_id` and `assistant_id` in thread stream requests (#9213 ). Remote
graph streaming uses those thread stream classes, so this keeps it on a
version with the fix.
Also includes:
- Keep DeltaChannel counters on every `update_state` path (#9142 )
- Keep an `update_state` on an older checkpoint out of its other
branches (#9165 )
- Fork before replaying an update checkpoint the thread moved past
(#9170 )
2026-10-06 10:35:44 -04:00
Saad Farooq