Bumps [hono](https://github.com/honojs/hono) from 4.9.7 to 4.10.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.10.3</h2> <h2>Securiy Fix</h2> <p>A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.</p> <h2>What's Changed</h2> <ul> <li>fix(aws-lambda): serve microsoft office files as binary in lambda handler by <a href="https://github.com/matthiasfeist"><code>@matthiasfeist</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4469">honojs/hono#4469</a></li> <li>fix(request-id): validation accepts <code>=</code> by <a href="https://github.com/ryuapp"><code>@ryuapp</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4478">honojs/hono#4478</a></li> <li>refactor(jwt): reduce the size of the code generated by minification by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4480">honojs/hono#4480</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/matthiasfeist"><code>@matthiasfeist</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/4469">honojs/hono#4469</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.10.2...v4.10.3">https://github.com/honojs/hono/compare/v4.10.2...v4.10.3</a></p> <h2>v4.10.2</h2> <h2>Security hardening improvement</h2> <p>If you are using JWT middleware, please read the following and consider applying the configuration.</p> <h3>Improper Authorization in Hono (JWT Audience Validation)</h3> <p>Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).</p> <p>The issue is addressed by adding a new <code>verification.aud</code> configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.</p> <h3>Recommended secure configuration</h3> <p>You can enable RFC 7519–compliant audience validation using the new <code>verification.aud</code> option:</p> <pre lang="ts"><code>import { Hono } from 'hono' import { jwt } from 'hono/jwt' <p>const app = new Hono()</p> <p>app.use(<br /> '/api/*',<br /> jwt({<br /> secret: 'my-secret',<br /> verification: {<br /> // Require this API to only accept tokens with aud = 'service-a'<br /> aud: 'service-a',<br /> },<br /> })<br /> )<br /> </code></pre></p> <h2>What's Changed</h2> <ul> <li>tests: Fix test case of handlers without a path by <a href="https://github.com/IAmSSH"><code>@IAmSSH</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4472">honojs/hono#4472</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/fcefd50c65144eda31e2bc6752c81904171d9629"><code>fcefd50</code></a> 4.10.3</li> <li><a href="https://github.com/honojs/hono/commit/95ae4d372119cddba32e4935d2bbc6f4e2768dab"><code>95ae4d3</code></a> refactor(jwt): reduce the size of the code generated by minification (<a href="https://redirect.github.com/honojs/hono/issues/4480">#4480</a>)</li> <li><a href="https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282"><code>d9b8b4b</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/52161170e83298fc3d13312bfceba3992916bfa2"><code>5216117</code></a> fix(request-id): validation accepts <code>=</code> (<a href="https://redirect.github.com/honojs/hono/issues/4478">#4478</a>)</li> <li><a href="https://github.com/honojs/hono/commit/253ec2857a083595e52a446694923645084e9ecd"><code>253ec28</code></a> fix(aws-lambda): serve microsoft office files as binary in lambda handler (<a href="https://redirect.github.com/honojs/hono/issues/4">#4</a>...</li> <li><a href="https://github.com/honojs/hono/commit/0c6455dc10db6428257bdd601eca559247e27de6"><code>0c6455d</code></a> 4.10.2</li> <li><a href="https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef"><code>45ba3bf</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/4cbad8b3e2a67d77849710ec400d9de020c435fd"><code>4cbad8b</code></a> tests: Fix test case of handlers without a path (<a href="https://redirect.github.com/honojs/hono/issues/4472">#4472</a>)</li> <li><a href="https://github.com/honojs/hono/commit/db764c2f1d8a2905d66c78c41aa47e47d3a4165d"><code>db764c2</code></a> 4.10.1</li> <li><a href="https://github.com/honojs/hono/commit/8774bf9a59278a9593d5e91cc85543d5a4bb518c"><code>8774bf9</code></a> fix(types): cannot <code>.use</code> non-return mw from <code>createMiddleware</code> (<a href="https://redirect.github.com/honojs/hono/issues/4465">#4465</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.9.7...v4.10.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
LangGraph Documentation
For more information on contributing to our documentation, see the Contributing Guide.
Structure
The primary documentation is located in the docs/ directory. This directory contains both the source files for the main documentation as well as the API reference doc build process.
Main Documentation
Main documentation files are located in docs/docs/ and are written in Markdown format. The site uses MkDocs with the Material theme and includes:
- Concepts: Core LangGraph concepts and explanations
- Tutorials: Step-by-step learning guides
- How-tos: Task-focused guides for specific use cases
- Examples: Real-world applications and use cases
- Jupyter Notebooks: Interactive tutorials that are automatically converted to markdown
API Reference
API reference documentation is defined in docs/docs/reference/. Each .md file outlines the "template" that each page is built from. Reference content is automatically generated from docstrings in the codebase using the mkdocstrings plugin. Once generated, the content is plugged into the corresponding markdown file where it is referenced by using manual directives to specify which classes and/or functions are documented:
::: langgraph.graph.state.StateGraph
options:
show_if_no_docstring: true
show_root_heading: true
show_root_full_path: false
members:
- add_node
- add_edge
- add_conditional_edges
- add_sequence
- compile
Build Process
Docs are built following these steps:
-
Content Processing:
_scripts/notebook_hooks.py- Main processing pipeline that:- Converts how-tos/tutorial Jupyter notebooks to markdown using
notebook_convert.py - Adds automatic API reference links to code blocks using
generate_api_reference_links.py - Handles conditional rendering for Python/JS versions
- Processes highlight comments and custom syntax
- Converts how-tos/tutorial Jupyter notebooks to markdown using
-
API Reference Generation:
- mkdocstrings plugin extracts docstrings from Python source code
- Manual
::: module.Classdirectives in reference pages (/docs/docs/*) specify what to document - Cross-references are automatically generated between docs and API
-
Site Generation:
- MkDocs processes all markdown files and generates static HTML
- Custom hooks handle redirects and inject additional functionality
-
Deployment:
- Site is deployed with Vercel
make build-docsgenerates production build (also usable for local testing)- Automatic redirects handle URL changes between versions
Local Development
For local development, use the Makefile targets:
# Serve docs locally with hot reloading
make serve-docs
# Clean build for production testing
make build-docs
# Serve with clean build
make serve-clean-docs
The serve-docs command:
- Watches source files for changes
- Includes dirty builds for faster iteration
- Serves on http://127.0.0.1:8000/langgraph/
Standards
Docstring Format:
The API reference uses Google-style docstrings with Markdown markup. The mkdocstrings plugin processes these to generate documentation.
Required format:
def example_function(param1: str, param2: int = 5) -> bool:
"""Brief description of the function.
Longer description can go here. Use Markdown syntax for
rich formatting like **bold** and *italic*.
Args:
param1: Description of the first parameter.
param2: Description of the second parameter with default value.
Returns:
Description of the return value.
Raises:
ValueError: When param1 is empty.
TypeError: When param2 is not an integer.
!!! warning
This function is experimental and may change.
!!! version-added "Added in version 0.2.0"
"""
Special Markers:
- MkDocs admonitions:
!!! warning,!!! note,!!! version-added - Code blocks: Standard markdown ``` syntax
- Cross-references: Automatic linking via
generate_api_reference_links.py
Execute notebooks
If you would like to automatically execute all of the notebooks, to mimic the "Run notebooks" GitHub action, you can run:
python _scripts/prepare_notebooks_for_ci.py
./_scripts/execute_notebooks.sh
Note: if you want to run the notebooks without %pip install cells, you can run:
python _scripts/prepare_notebooks_for_ci.py --comment-install-cells
./_scripts/execute_notebooks.sh
prepare_notebooks_for_ci.py script will add VCR cassette context manager for each cell in the notebook, so that:
- when the notebook is run for the first time, cells with network requests will be recorded to a VCR cassette file
- when the notebook is run subsequently, the cells with network requests will be replayed from the cassettes
Adding new notebooks
If you are adding a notebook with API requests, it's recommended to record network requests so that they can be subsequently replayed. If this is not done, the notebook runner will make API requests every time the notebook is run, which can be costly and slow.
To record network requests, please make sure to first run prepare_notebooks_for_ci.py script.
Then, run
jupyter execute <path_to_notebook>
Once the notebook is executed, you should see the new VCR cassettes recorded in cassettes directory and discard the updated notebook.
Updating existing notebooks
If you are updating an existing notebook, please make sure to remove any existing cassettes for the notebook in cassettes directory (each cassette is prefixed with the notebook name), and then run the steps from the "Adding new notebooks" section above.
To delete cassettes for a notebook, you can run:
rm cassettes/<notebook_name>*