Bumps [uv](https://github.com/astral-sh/uv) from 0.11.7 to 0.11.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">uv's releases</a>.</em></p> <blockquote> <h2>0.11.15</h2> <h2>Release Notes</h2> <p>Released on 2026-05-18.</p> <h3>Security</h3> <ul> <li>Fix a TAR parser differential, see <a href="https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm">GHSA-3cv2-h65g-fgmm</a> (<a href="https://redirect.github.com/astral-sh/uv/pull/19463">#19463</a>)</li> <li>Enforce that entry points cannot escape in the scripts directory, see <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph">GHSA-4gg8-gxpx-9rph</a> (<a href="https://redirect.github.com/astral-sh/uv/pull/19464">#19464</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/18741">#18741</a>)</li> <li>Add support for Azure request signing (<a href="https://redirect.github.com/astral-sh/uv/pull/19421">#19421</a>)</li> <li>Apply stricter validation to all wheel filename segments (<a href="https://redirect.github.com/astral-sh/uv/pull/19364">#19364</a>)</li> <li>Reject empty strings as an invalid package name (<a href="https://redirect.github.com/astral-sh/uv/pull/19435">#19435</a>)</li> <li>Use structured errors for signing authentication failures (<a href="https://redirect.github.com/astral-sh/uv/pull/19422">#19422</a>)</li> </ul> <h3>Preview</h3> <ul> <li>uv audit: Add JSON output (<a href="https://redirect.github.com/astral-sh/uv/pull/19305">#19305</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Respect <code>required-environments</code> in <code>uv pip compile</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19378">#19378</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid parsing JSON manifest when local Python is available (<a href="https://redirect.github.com/astral-sh/uv/pull/19398">#19398</a>)</li> <li>Avoid walking nested directories in linker conflict registration (<a href="https://redirect.github.com/astral-sh/uv/pull/19382">#19382</a>)</li> <li>Optimize async wheel ZIP writing (<a href="https://redirect.github.com/astral-sh/uv/pull/19383">#19383</a>)</li> <li>Fix dead "already trimmed" fast-path in <code>Version::only_release_trimmed</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19425">#19425</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Apply workspace-member <code>[tool.uv.sources]</code> credentials under <code>uv sync --frozen</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19423">#19423</a>)</li> <li>Skip empty directories in uv build outputs (<a href="https://redirect.github.com/astral-sh/uv/pull/19437">#19437</a>)</li> <li>Fix Git submodule handling when using relative paths (<a href="https://redirect.github.com/astral-sh/uv/pull/12156">#12156</a>)</li> <li>Fix line number reporting in netrc parsing (<a href="https://redirect.github.com/astral-sh/uv/pull/19452">#19452</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Move Bazel auth helper setup into integration guide (<a href="https://redirect.github.com/astral-sh/uv/pull/19392">#19392</a>)</li> </ul> <h2>Install uv 0.11.15</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.sh | sh </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">uv's changelog</a>.</em></p> <blockquote> <h2>0.11.15</h2> <p>Released on 2026-05-18.</p> <h3>Security</h3> <ul> <li>Fix a TAR parser differential, see <a href="https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm">GHSA-3cv2-h65g-fgmm</a> (<a href="https://redirect.github.com/astral-sh/uv/pull/19463">#19463</a>)</li> <li>Enforce that entry points cannot escape in the scripts directory, see <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph">GHSA-4gg8-gxpx-9rph</a> (<a href="https://redirect.github.com/astral-sh/uv/pull/19464">#19464</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/18741">#18741</a>)</li> <li>Add support for Azure request signing (<a href="https://redirect.github.com/astral-sh/uv/pull/19421">#19421</a>)</li> <li>Apply stricter validation to all wheel filename segments (<a href="https://redirect.github.com/astral-sh/uv/pull/19364">#19364</a>)</li> <li>Reject empty strings as an invalid package name (<a href="https://redirect.github.com/astral-sh/uv/pull/19435">#19435</a>)</li> <li>Use structured errors for signing authentication failures (<a href="https://redirect.github.com/astral-sh/uv/pull/19422">#19422</a>)</li> </ul> <h3>Preview</h3> <ul> <li>uv audit: Add JSON output (<a href="https://redirect.github.com/astral-sh/uv/pull/19305">#19305</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Respect <code>required-environments</code> in <code>uv pip compile</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19378">#19378</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid parsing JSON manifest when local Python is available (<a href="https://redirect.github.com/astral-sh/uv/pull/19398">#19398</a>)</li> <li>Avoid walking nested directories in linker conflict registration (<a href="https://redirect.github.com/astral-sh/uv/pull/19382">#19382</a>)</li> <li>Optimize async wheel ZIP writing (<a href="https://redirect.github.com/astral-sh/uv/pull/19383">#19383</a>)</li> <li>Fix dead "already trimmed" fast-path in <code>Version::only_release_trimmed</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19425">#19425</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Apply workspace-member <code>[tool.uv.sources]</code> credentials under <code>uv sync --frozen</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/19423">#19423</a>)</li> <li>Skip empty directories in uv build outputs (<a href="https://redirect.github.com/astral-sh/uv/pull/19437">#19437</a>)</li> <li>Fix Git submodule handling when using relative paths (<a href="https://redirect.github.com/astral-sh/uv/pull/12156">#12156</a>)</li> <li>Fix line number reporting in netrc parsing (<a href="https://redirect.github.com/astral-sh/uv/pull/19452">#19452</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Move Bazel auth helper setup into integration guide (<a href="https://redirect.github.com/astral-sh/uv/pull/19392">#19392</a>)</li> </ul> <h2>0.11.14</h2> <p>Released on 2026-05-12.</p> <h3>Enhancements</h3> <ul> <li>Add Astral mirror URL override (<a href="https://redirect.github.com/astral-sh/uv/pull/19206">#19206</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/3cffe97c2e48c9e49422c738da3af95919dd0bf5"><code>3cffe97</code></a> Fix crates.io publish script lockfile (<a href="https://redirect.github.com/astral-sh/uv/issues/19473">#19473</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/de16a7b1a30c54e3137db0d414ff250a1c0ae427"><code>de16a7b</code></a> Bump version to 0.11.15 (<a href="https://redirect.github.com/astral-sh/uv/issues/19472">#19472</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/cf826cc4e0feeafb23e4e52b85929848ab2d16a7"><code>cf826cc</code></a> Disable <code>test_simultaneous_create_set_then_move</code> on Linux (<a href="https://redirect.github.com/astral-sh/uv/issues/19469">#19469</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/2d566bced5152ba9da3aedbc02f1dd087bfeb8e9"><code>2d566bc</code></a> Allow retry of <code>custom-publish-crates</code> separately from <code>announce</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/19470">#19470</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0588b8fb3505235ed97fc511a874a3ce0cbd9b72"><code>0588b8f</code></a> Run release builds on maturin version bumps in CI (<a href="https://redirect.github.com/astral-sh/uv/issues/19466">#19466</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9a65753e9a8d0e99e7079114d78001311444c718"><code>9a65753</code></a> Enforce that entry points cannot escape in the scripts directory (<a href="https://redirect.github.com/astral-sh/uv/issues/19464">#19464</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d77d849816de6278f61d3f385b70b2735ca2f0fd"><code>d77d849</code></a> Revert "Update maturin to v1.13.2 (<a href="https://redirect.github.com/astral-sh/uv/issues/19445">#19445</a>)" (<a href="https://redirect.github.com/astral-sh/uv/issues/19465">#19465</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5373e96b15609291995a630704ef08cea31b4b08"><code>5373e96</code></a> Update Rust crate rustls to v0.23.40 (<a href="https://redirect.github.com/astral-sh/uv/issues/19250">#19250</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/fb8d3d46ac08ab5fc88f7a96c89f55860f343012"><code>fb8d3d4</code></a> Update Rust crate rustls-pki-types to v1.14.1 (<a href="https://redirect.github.com/astral-sh/uv/issues/19251">#19251</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/078480dc40fdc6d2e56145730dacfb2744da5940"><code>078480d</code></a> Configure maturin and uv so <code>uv run</code> can be used to work on uv itself (<a href="https://redirect.github.com/astral-sh/uv/issues/19461">#19461</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.11.7...0.11.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Low-level orchestration framework for building stateful agents.
Trusted by companies shaping the future of agents – including Klarna, Replit, Elastic, and more – LangGraph is a low-level orchestration framework for building, managing, and deploying long-running, stateful agents.
pip install -U langgraph
Tip
If you're looking to quickly build agents, check out Deep Agents — a higher-level package built on LangGraph for agents that can plan, use subagents, and leverage file systems for complex tasks.
For an equivalent JS/TS library, check out LangGraph.js and the JS docs.
Why use LangGraph?
LangGraph provides low-level supporting infrastructure for any long-running, stateful workflow or agent:
- Durable execution — Build agents that persist through failures and can run for extended periods, automatically resuming from exactly where they left off.
- Human-in-the-loop — Seamlessly incorporate human oversight by inspecting and modifying agent state at any point during execution.
- Comprehensive memory — Create truly stateful agents with both short-term working memory for ongoing reasoning and long-term persistent memory across sessions.
- Debugging with LangSmith — Gain deep visibility into complex agent behavior with visualization tools that trace execution paths, capture state transitions, and provide detailed runtime metrics.
- Production-ready deployment — Deploy sophisticated agent systems confidently with scalable infrastructure designed to handle the unique challenges of stateful, long-running workflows.
Tip
For developing, debugging, and deploying AI agents and LLM applications, see LangSmith.
LangGraph ecosystem
While LangGraph can be used standalone, it also integrates seamlessly with any LangChain product, giving developers a full suite of tools for building agents.
To improve your LLM application development, pair LangGraph with:
- Deep Agents – Build agents that can plan, use subagents, and leverage file systems for complex tasks.
- LangChain – Provides integrations and composable components to streamline LLM application development.
- LangSmith – Helpful for agent evals and observability. Debug poor-performing LLM app runs, evaluate agent trajectories, gain visibility in production, and improve performance over time.
- LangSmith Deployment – Deploy and scale agents effortlessly with a purpose-built deployment platform for long-running, stateful workflows. Discover, reuse, configure, and share agents across teams – and iterate quickly with visual prototyping in LangSmith Studio.
Documentation
- docs.langchain.com – Comprehensive documentation, including conceptual overviews and guides
- reference.langchain.com/python/langgraph – API reference docs for LangGraph packages
- LangGraph Quickstart – Get started building with LangGraph
- Chat LangChain – Chat with the LangChain documentation and get answers to your questions
Discussions: Visit the LangChain Forum to connect with the community and share all of your technical questions, ideas, and feedback.
Additional resources
- Guides – Quick, actionable code snippets for topics such as streaming, adding memory & persistence, and design patterns (e.g. branching, subgraphs, etc.).
- LangChain Academy – Learn the basics of LangGraph in our free, structured course.
- Case studies – Hear how industry leaders use LangGraph to ship AI applications at scale.
- Contributing Guide – Learn how to contribute to LangChain projects and find good first issues.
- Code of Conduct – Our community guidelines and standards for participation.
Acknowledgements
LangGraph is inspired by Pregel and Apache Beam. The public interface draws inspiration from NetworkX. LangGraph is built by LangChain Inc, the creators of LangChain, but can be used without LangChain.