Files
langgraph/docs
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
575401c78c chore(deps): bump hono from 4.9.7 to 4.10.3 in /docs/_scripts/js_translation/codeblocks (#6339)
Bumps [hono](https://github.com/honojs/hono) from 4.9.7 to 4.10.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.10.3</h2>
<h2>Securiy Fix</h2>
<p>A security issue in the CORS middleware has been fixed. In some
cases, a request header could affect the Vary response header. Please
update to the latest version if you are using the CORS middleware.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(aws-lambda): serve microsoft office files as binary in lambda
handler by <a
href="https://github.com/matthiasfeist"><code>@​matthiasfeist</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4469">honojs/hono#4469</a></li>
<li>fix(request-id): validation accepts <code>=</code> by <a
href="https://github.com/ryuapp"><code>@​ryuapp</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4478">honojs/hono#4478</a></li>
<li>refactor(jwt): reduce the size of the code generated by minification
by <a href="https://github.com/usualoma"><code>@​usualoma</code></a> in
<a
href="https://redirect.github.com/honojs/hono/pull/4480">honojs/hono#4480</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/matthiasfeist"><code>@​matthiasfeist</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/hono/pull/4469">honojs/hono#4469</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.10.2...v4.10.3">https://github.com/honojs/hono/compare/v4.10.2...v4.10.3</a></p>
<h2>v4.10.2</h2>
<h2>Security hardening improvement</h2>
<p>If you are using JWT middleware, please read the following and
consider applying the configuration.</p>
<h3>Improper Authorization in Hono (JWT Audience Validation)</h3>
<p>Hono’s JWT authentication middleware did not validate the aud
(Audience) claim by default. As a result, applications using the
middleware without an explicit audience check could accept tokens
intended for other audiences, leading to potential cross-service access
(token mix-up).</p>
<p>The issue is addressed by adding a new <code>verification.aud</code>
configuration option to allow RFC 7519–compliant audience validation.
This change is classified as a security hardening improvement, but the
lack of validation can still be considered a vulnerability in
deployments that rely on default JWT verification.</p>
<h3>Recommended secure configuration</h3>
<p>You can enable RFC 7519–compliant audience validation using the new
<code>verification.aud</code> option:</p>
<pre lang="ts"><code>import { Hono } from 'hono'
import { jwt } from 'hono/jwt'
<p>const app = new Hono()</p>
<p>app.use(<br />
'/api/*',<br />
jwt({<br />
secret: 'my-secret',<br />
verification: {<br />
// Require this API to only accept tokens with aud = 'service-a'<br />
aud: 'service-a',<br />
},<br />
})<br />
)<br />
</code></pre></p>
<h2>What's Changed</h2>
<ul>
<li>tests: Fix test case of handlers without a path by <a
href="https://github.com/IAmSSH"><code>@​IAmSSH</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4472">honojs/hono#4472</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/fcefd50c65144eda31e2bc6752c81904171d9629"><code>fcefd50</code></a>
4.10.3</li>
<li><a
href="https://github.com/honojs/hono/commit/95ae4d372119cddba32e4935d2bbc6f4e2768dab"><code>95ae4d3</code></a>
refactor(jwt): reduce the size of the code generated by minification (<a
href="https://redirect.github.com/honojs/hono/issues/4480">#4480</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282"><code>d9b8b4b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/52161170e83298fc3d13312bfceba3992916bfa2"><code>5216117</code></a>
fix(request-id): validation accepts <code>=</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4478">#4478</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/253ec2857a083595e52a446694923645084e9ecd"><code>253ec28</code></a>
fix(aws-lambda): serve microsoft office files as binary in lambda
handler (<a
href="https://redirect.github.com/honojs/hono/issues/4">#4</a>...</li>
<li><a
href="https://github.com/honojs/hono/commit/0c6455dc10db6428257bdd601eca559247e27de6"><code>0c6455d</code></a>
4.10.2</li>
<li><a
href="https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef"><code>45ba3bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/4cbad8b3e2a67d77849710ec400d9de020c435fd"><code>4cbad8b</code></a>
tests: Fix test case of handlers without a path (<a
href="https://redirect.github.com/honojs/hono/issues/4472">#4472</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/db764c2f1d8a2905d66c78c41aa47e47d3a4165d"><code>db764c2</code></a>
4.10.1</li>
<li><a
href="https://github.com/honojs/hono/commit/8774bf9a59278a9593d5e91cc85543d5a4bb518c"><code>8774bf9</code></a>
fix(types): cannot <code>.use</code> non-return mw from
<code>createMiddleware</code> (<a
href="https://redirect.github.com/honojs/hono/issues/4465">#4465</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.9.7...v4.10.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.9.7&new-version=4.10.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-04 13:52:15 -08:00
..
2025-06-25 15:55:17 -04:00
2025-07-03 16:50:51 +02:00
2025-07-31 22:57:32 -04:00
2025-07-30 02:18:30 +00:00
2025-02-03 20:13:58 +00:00
2025-07-30 02:18:30 +00:00

LangGraph Documentation

For more information on contributing to our documentation, see the Contributing Guide.

Structure

The primary documentation is located in the docs/ directory. This directory contains both the source files for the main documentation as well as the API reference doc build process.

Main Documentation

Main documentation files are located in docs/docs/ and are written in Markdown format. The site uses MkDocs with the Material theme and includes:

  • Concepts: Core LangGraph concepts and explanations
  • Tutorials: Step-by-step learning guides
  • How-tos: Task-focused guides for specific use cases
  • Examples: Real-world applications and use cases
  • Jupyter Notebooks: Interactive tutorials that are automatically converted to markdown

API Reference

API reference documentation is defined in docs/docs/reference/. Each .md file outlines the "template" that each page is built from. Reference content is automatically generated from docstrings in the codebase using the mkdocstrings plugin. Once generated, the content is plugged into the corresponding markdown file where it is referenced by using manual directives to specify which classes and/or functions are documented:

::: langgraph.graph.state.StateGraph
    options:
      show_if_no_docstring: true
      show_root_heading: true
      show_root_full_path: false
      members:
        - add_node
        - add_edge
        - add_conditional_edges
        - add_sequence
        - compile

Build Process

Docs are built following these steps:

  1. Content Processing:

    • _scripts/notebook_hooks.py - Main processing pipeline that:
      • Converts how-tos/tutorial Jupyter notebooks to markdown using notebook_convert.py
      • Adds automatic API reference links to code blocks using generate_api_reference_links.py
      • Handles conditional rendering for Python/JS versions
      • Processes highlight comments and custom syntax
  2. API Reference Generation:

    • mkdocstrings plugin extracts docstrings from Python source code
    • Manual ::: module.Class directives in reference pages (/docs/docs/*) specify what to document
    • Cross-references are automatically generated between docs and API
  3. Site Generation:

    • MkDocs processes all markdown files and generates static HTML
    • Custom hooks handle redirects and inject additional functionality
  4. Deployment:

    • Site is deployed with Vercel
    • make build-docs generates production build (also usable for local testing)
    • Automatic redirects handle URL changes between versions

Local Development

For local development, use the Makefile targets:

# Serve docs locally with hot reloading
make serve-docs

# Clean build for production testing
make build-docs

# Serve with clean build
make serve-clean-docs

The serve-docs command:

Standards

Docstring Format: The API reference uses Google-style docstrings with Markdown markup. The mkdocstrings plugin processes these to generate documentation.

Required format:

def example_function(param1: str, param2: int = 5) -> bool:
    """Brief description of the function.

    Longer description can go here. Use Markdown syntax for
    rich formatting like **bold** and *italic*.

    Args:
        param1: Description of the first parameter.
        param2: Description of the second parameter with default value.

    Returns:
        Description of the return value.

    Raises:
        ValueError: When param1 is empty.
        TypeError: When param2 is not an integer.

    !!! warning
        This function is experimental and may change.

    !!! version-added "Added in version 0.2.0"
    """

Special Markers:

  • MkDocs admonitions: !!! warning, !!! note, !!! version-added
  • Code blocks: Standard markdown ``` syntax
  • Cross-references: Automatic linking via generate_api_reference_links.py

Execute notebooks

If you would like to automatically execute all of the notebooks, to mimic the "Run notebooks" GitHub action, you can run:

python _scripts/prepare_notebooks_for_ci.py
./_scripts/execute_notebooks.sh

Note: if you want to run the notebooks without %pip install cells, you can run:

python _scripts/prepare_notebooks_for_ci.py --comment-install-cells
./_scripts/execute_notebooks.sh

prepare_notebooks_for_ci.py script will add VCR cassette context manager for each cell in the notebook, so that:

  • when the notebook is run for the first time, cells with network requests will be recorded to a VCR cassette file
  • when the notebook is run subsequently, the cells with network requests will be replayed from the cassettes

Adding new notebooks

If you are adding a notebook with API requests, it's recommended to record network requests so that they can be subsequently replayed. If this is not done, the notebook runner will make API requests every time the notebook is run, which can be costly and slow.

To record network requests, please make sure to first run prepare_notebooks_for_ci.py script.

Then, run

jupyter execute <path_to_notebook>

Once the notebook is executed, you should see the new VCR cassettes recorded in cassettes directory and discard the updated notebook.

Updating existing notebooks

If you are updating an existing notebook, please make sure to remove any existing cassettes for the notebook in cassettes directory (each cassette is prefixed with the notebook name), and then run the steps from the "Adding new notebooks" section above.

To delete cassettes for a notebook, you can run:

rm cassettes/<notebook_name>*