15889 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dependabot[bot]	d972968b86	chore: bump langchain-core from 1.3.2 to 1.3.3 in /libs/partners/chroma (#37284) ... [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [langchain-core](https://github.com/langchain-ai/langchain) from 1.3.2 to 1.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.3.3</h2> <p>Changes since langchain-core==1.3.2</p> <p>release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>) fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>) fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>) chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37109">#37109</a>) chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37129">#37129</a>) fix(core): preserve structured <code>inputs</code> on tool runs in tracers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37108">#37108</a>) release(perplexity): 1.2.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37091">#37091</a>) chore(docs): update x handle references (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37081">#37081</a>) fix(core): make <code>removal</code> optional in <code>warn_deprecated</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37056">#37056</a>) fix(core): validate batch_size in _batch and _abatch to prevent infinite loop (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36663">#36663</a>) chore(core): mark stream_v2/astream_v2 as beta (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36992">#36992</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="5039dfec1f"><code>5039dfe</code></a> release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>)</li> <li><a href="55a7707837"><code>55a7707</code></a> fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>)</li> <li><a href="c979c6187b"><code>c979c61</code></a> fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>)</li> <li><a href="d7031101da"><code>d703110</code></a> docs: update README.md (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37190">#37190</a>)</li> <li><a href="4d50a2a68b"><code>4d50a2a</code></a> ci(infra): run pre-release checks before TestPyPI publish (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37194">#37194</a>)</li> <li><a href="9bd730e199"><code>9bd730e</code></a> fix(fireworks): require <code>api_key</code> in <code>FireworksEmbeddings</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37193">#37193</a>)</li> <li><a href="f475f4191f"><code>f475f41</code></a> release(mistralai): 1.1.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37191">#37191</a>)</li> <li><a href="7dbff48aff"><code>7dbff48</code></a> fix(mistralai): strip non-wire keys from <code>ToolMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37188">#37188</a>)</li> <li><a href="913816c440"><code>913816c</code></a> release(fireworks): 1.3.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37189">#37189</a>)</li> <li><a href="4498d3dc84"><code>4498d3d</code></a> fix(fireworks): strip non-wire keys from <code>ToolMessage</code> text content blocks (#...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.3.2...langchain-core==1.3.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:55 -04:00
dependabot[bot]	f5569e333d	chore: bump langsmith from 0.7.31 to 0.8.3 in /libs/partners/deepseek (#37283) ... [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.7.31 to 0.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.3</h2> <h2>What's Changed</h2> <ul> <li>fix(js): prevent sending [object Object] as span attribute when dealing with nested objects, send full langsmith.usage_metadata if present by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2845">langchain-ai/langsmith-sdk#2845</a></li> <li>release(js): bump to 0.6.2 by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2856">langchain-ai/langsmith-sdk#2856</a></li> <li>sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_seconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2853">langchain-ai/langsmith-sdk#2853</a></li> <li>sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2854">langchain-ai/langsmith-sdk#2854</a></li> <li>Fix push_agent URL owner for name-only identifiers by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2862">langchain-ai/langsmith-sdk#2862</a></li> <li>docs(langsmith): clarify trust boundaries when working with hub by <a href="https://github.com/eyurtsev"><code>@​eyurtsev</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2861">langchain-ai/langsmith-sdk#2861</a></li> <li>release(py): 0.8.3 by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2863">langchain-ai/langsmith-sdk#2863</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3</a></p> <h2>v0.8.2</h2> <h2>What's Changed</h2> <ul> <li>Bump JS SDK version to 0.6.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2847">langchain-ai/langsmith-sdk#2847</a></li> <li>fix: parse urllib3 version with packaging.Version by <a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> <li>Bump Python SDK version to 0.8.2 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2855">langchain-ai/langsmith-sdk#2855</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2</a></p> <h2>v0.8.1</h2> <h2>What's Changed</h2> <ul> <li>chore(js): remove experimental opencode integration by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2836">langchain-ai/langsmith-sdk#2836</a></li> <li>chore(deps-dev): bump google-adk from 1.10.0 to 1.28.1 in /python by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2823">langchain-ai/langsmith-sdk#2823</a></li> <li>chore(deps): bump postcss from 8.5.8 to 8.5.12 in /js by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2827">langchain-ai/langsmith-sdk#2827</a></li> <li>Add JS profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2834">langchain-ai/langsmith-sdk#2834</a></li> <li>Add Python profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2835">langchain-ai/langsmith-sdk#2835</a></li> <li>Extract JS profile auth service by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2846">langchain-ai/langsmith-sdk#2846</a></li> <li>Bump Python SDK version to 0.8.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2848">langchain-ai/langsmith-sdk#2848</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1</a></p> <h2>v0.8.0</h2> <h2>What's Changed</h2> <ul> <li>feat(js,py): JS 0.6.0, Py 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831">langchain-ai/langsmith-sdk#2831</a></li> <li>release(js): 0.6.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832">langchain-ai/langsmith-sdk#2832</a></li> <li>release(py): 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833">langchain-ai/langsmith-sdk#2833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0</a></p> <h2>v0.7.38</h2> <h2>What's Changed</h2> <ul> <li>feat(js): add tracing of opencode by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2776">langchain-ai/langsmith-sdk#2776</a></li> <li>chore(js): Remove types/uuid by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2814">langchain-ai/langsmith-sdk#2814</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="e2386ad8aa"><code>e2386ad</code></a> release(py): 0.8.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2863">#2863</a>)</li> <li><a href="11d51a370f"><code>11d51a3</code></a> docs(langsmith): clarify trust boundaries when working with hub (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2861">#2861</a>)</li> <li><a href="d98c3ed8a9"><code>d98c3ed</code></a> Fix push_agent URL owner for name-only identifiers (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2862">#2862</a>)</li> <li><a href="418fd415fc"><code>418fd41</code></a> sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2854">#2854</a>)</li> <li><a href="1baa2c197d"><code>1baa2c1</code></a> sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_second...</li> <li><a href="361c8dd869"><code>361c8dd</code></a> release(js): bump to 0.6.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2856">#2856</a>)</li> <li><a href="0d42882f2d"><code>0d42882</code></a> fix(js): prevent sending [object Object] as span attribute when dealing with ...</li> <li><a href="619818ba8d"><code>619818b</code></a> Bump Python SDK version to 0.8.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2855">#2855</a>)</li> <li><a href="8a7d3c1356"><code>8a7d3c1</code></a> fix: parse urllib3 version with packaging.Version (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2851">#2851</a>)</li> <li><a href="54f887704f"><code>54f8877</code></a> Bump JS SDK version to 0.6.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2847">#2847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.31...v0.8.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:48 -04:00
dependabot[bot]	d29a1804f5	chore: bump langsmith from 0.7.31 to 0.8.3 in /libs/partners/chroma (#37285) ... Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.7.31 to 0.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.3</h2> <h2>What's Changed</h2> <ul> <li>fix(js): prevent sending [object Object] as span attribute when dealing with nested objects, send full langsmith.usage_metadata if present by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2845">langchain-ai/langsmith-sdk#2845</a></li> <li>release(js): bump to 0.6.2 by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2856">langchain-ai/langsmith-sdk#2856</a></li> <li>sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_seconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2853">langchain-ai/langsmith-sdk#2853</a></li> <li>sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2854">langchain-ai/langsmith-sdk#2854</a></li> <li>Fix push_agent URL owner for name-only identifiers by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2862">langchain-ai/langsmith-sdk#2862</a></li> <li>docs(langsmith): clarify trust boundaries when working with hub by <a href="https://github.com/eyurtsev"><code>@​eyurtsev</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2861">langchain-ai/langsmith-sdk#2861</a></li> <li>release(py): 0.8.3 by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2863">langchain-ai/langsmith-sdk#2863</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3</a></p> <h2>v0.8.2</h2> <h2>What's Changed</h2> <ul> <li>Bump JS SDK version to 0.6.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2847">langchain-ai/langsmith-sdk#2847</a></li> <li>fix: parse urllib3 version with packaging.Version by <a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> <li>Bump Python SDK version to 0.8.2 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2855">langchain-ai/langsmith-sdk#2855</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2</a></p> <h2>v0.8.1</h2> <h2>What's Changed</h2> <ul> <li>chore(js): remove experimental opencode integration by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2836">langchain-ai/langsmith-sdk#2836</a></li> <li>chore(deps-dev): bump google-adk from 1.10.0 to 1.28.1 in /python by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2823">langchain-ai/langsmith-sdk#2823</a></li> <li>chore(deps): bump postcss from 8.5.8 to 8.5.12 in /js by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2827">langchain-ai/langsmith-sdk#2827</a></li> <li>Add JS profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2834">langchain-ai/langsmith-sdk#2834</a></li> <li>Add Python profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2835">langchain-ai/langsmith-sdk#2835</a></li> <li>Extract JS profile auth service by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2846">langchain-ai/langsmith-sdk#2846</a></li> <li>Bump Python SDK version to 0.8.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2848">langchain-ai/langsmith-sdk#2848</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1</a></p> <h2>v0.8.0</h2> <h2>What's Changed</h2> <ul> <li>feat(js,py): JS 0.6.0, Py 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831">langchain-ai/langsmith-sdk#2831</a></li> <li>release(js): 0.6.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832">langchain-ai/langsmith-sdk#2832</a></li> <li>release(py): 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833">langchain-ai/langsmith-sdk#2833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0</a></p> <h2>v0.7.38</h2> <h2>What's Changed</h2> <ul> <li>feat(js): add tracing of opencode by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2776">langchain-ai/langsmith-sdk#2776</a></li> <li>chore(js): Remove types/uuid by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2814">langchain-ai/langsmith-sdk#2814</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="e2386ad8aa"><code>e2386ad</code></a> release(py): 0.8.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2863">#2863</a>)</li> <li><a href="11d51a370f"><code>11d51a3</code></a> docs(langsmith): clarify trust boundaries when working with hub (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2861">#2861</a>)</li> <li><a href="d98c3ed8a9"><code>d98c3ed</code></a> Fix push_agent URL owner for name-only identifiers (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2862">#2862</a>)</li> <li><a href="418fd415fc"><code>418fd41</code></a> sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2854">#2854</a>)</li> <li><a href="1baa2c197d"><code>1baa2c1</code></a> sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_second...</li> <li><a href="361c8dd869"><code>361c8dd</code></a> release(js): bump to 0.6.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2856">#2856</a>)</li> <li><a href="0d42882f2d"><code>0d42882</code></a> fix(js): prevent sending [object Object] as span attribute when dealing with ...</li> <li><a href="619818ba8d"><code>619818b</code></a> Bump Python SDK version to 0.8.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2855">#2855</a>)</li> <li><a href="8a7d3c1356"><code>8a7d3c1</code></a> fix: parse urllib3 version with packaging.Version (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2851">#2851</a>)</li> <li><a href="54f887704f"><code>54f8877</code></a> Bump JS SDK version to 0.6.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2847">#2847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.31...v0.8.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:30 -04:00
dependabot[bot]	2d77aa4a89	chore: bump requests from 2.33.0 to 2.33.1 in /libs/partners/anthropic (#37286) ... Bumps [requests](https://github.com/psf/requests) from 2.33.0 to 2.33.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>.</em></p> <blockquote> <h2>v2.33.1</h2> <h2>2.33.1 (2026-03-30)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (<a href="https://redirect.github.com/psf/requests/issues/7305">#7305</a>)</li> <li>Fixed Content-Type header parsing for malformed values. (<a href="https://redirect.github.com/psf/requests/issues/7309">#7309</a>)</li> <li>Improved error consistency for malformed header values. (<a href="https://redirect.github.com/psf/requests/issues/7308">#7308</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ferdnyc"><code>@​ferdnyc</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7277">psf/requests#7277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30">https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>.</em></p> <blockquote> <h2>2.33.1 (2026-03-30)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (<a href="https://redirect.github.com/psf/requests/issues/7305">#7305</a>)</li> <li>Fixed Content-Type header parsing for malformed values. (<a href="https://redirect.github.com/psf/requests/issues/7309">#7309</a>)</li> <li>Improved error consistency for malformed header values. (<a href="https://redirect.github.com/psf/requests/issues/7308">#7308</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="111d2b7779"><code>111d2b7</code></a> v2.33.1</li> <li><a href="f0198e6dfc"><code>f0198e6</code></a> Fix malformed value parsing for Content-Type (<a href="https://redirect.github.com/psf/requests/issues/7309">#7309</a>)</li> <li><a href="bc7dd0fc4d"><code>bc7dd0f</code></a> Fix cosmetic header validity parsing regex (<a href="https://redirect.github.com/psf/requests/issues/7308">#7308</a>)</li> <li><a href="4443b1a847"><code>4443b1a</code></a> Fix unintended test extra (<a href="https://redirect.github.com/psf/requests/issues/7306">#7306</a>)</li> <li><a href="389eea58df"><code>389eea5</code></a> Cleanup extracted file after extract_zipped_path test (<a href="https://redirect.github.com/psf/requests/issues/7305">#7305</a>)</li> <li><a href="7407309c8a"><code>7407309</code></a> Packaging: DRY out extras definition (<a href="https://redirect.github.com/psf/requests/issues/7277">#7277</a>)</li> <li>See full diff in <a href="https://github.com/psf/requests/compare/v2.33.0...v2.33.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:22 -04:00
dependabot[bot]	81f59692aa	chore: bump langsmith from 0.7.31 to 0.8.3 in /libs/partners/anthropic (#37287) ... Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.7.31 to 0.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.3</h2> <h2>What's Changed</h2> <ul> <li>fix(js): prevent sending [object Object] as span attribute when dealing with nested objects, send full langsmith.usage_metadata if present by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2845">langchain-ai/langsmith-sdk#2845</a></li> <li>release(js): bump to 0.6.2 by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2856">langchain-ai/langsmith-sdk#2856</a></li> <li>sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_seconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2853">langchain-ai/langsmith-sdk#2853</a></li> <li>sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds by <a href="https://github.com/DanielKneipp"><code>@​DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2854">langchain-ai/langsmith-sdk#2854</a></li> <li>Fix push_agent URL owner for name-only identifiers by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2862">langchain-ai/langsmith-sdk#2862</a></li> <li>docs(langsmith): clarify trust boundaries when working with hub by <a href="https://github.com/eyurtsev"><code>@​eyurtsev</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2861">langchain-ai/langsmith-sdk#2861</a></li> <li>release(py): 0.8.3 by <a href="https://github.com/vishnu-ssuresh"><code>@​vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2863">langchain-ai/langsmith-sdk#2863</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3</a></p> <h2>v0.8.2</h2> <h2>What's Changed</h2> <ul> <li>Bump JS SDK version to 0.6.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2847">langchain-ai/langsmith-sdk#2847</a></li> <li>fix: parse urllib3 version with packaging.Version by <a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> <li>Bump Python SDK version to 0.8.2 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2855">langchain-ai/langsmith-sdk#2855</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/justinwolfington"><code>@​justinwolfington</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2</a></p> <h2>v0.8.1</h2> <h2>What's Changed</h2> <ul> <li>chore(js): remove experimental opencode integration by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2836">langchain-ai/langsmith-sdk#2836</a></li> <li>chore(deps-dev): bump google-adk from 1.10.0 to 1.28.1 in /python by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2823">langchain-ai/langsmith-sdk#2823</a></li> <li>chore(deps): bump postcss from 8.5.8 to 8.5.12 in /js by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2827">langchain-ai/langsmith-sdk#2827</a></li> <li>Add JS profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2834">langchain-ai/langsmith-sdk#2834</a></li> <li>Add Python profile loading by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2835">langchain-ai/langsmith-sdk#2835</a></li> <li>Extract JS profile auth service by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2846">langchain-ai/langsmith-sdk#2846</a></li> <li>Bump Python SDK version to 0.8.1 by <a href="https://github.com/langchain-infra"><code>@​langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2848">langchain-ai/langsmith-sdk#2848</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1</a></p> <h2>v0.8.0</h2> <h2>What's Changed</h2> <ul> <li>feat(js,py): JS 0.6.0, Py 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831">langchain-ai/langsmith-sdk#2831</a></li> <li>release(js): 0.6.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832">langchain-ai/langsmith-sdk#2832</a></li> <li>release(py): 0.8.0 by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833">langchain-ai/langsmith-sdk#2833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0</a></p> <h2>v0.7.38</h2> <h2>What's Changed</h2> <ul> <li>feat(js): add tracing of opencode by <a href="https://github.com/dqbd"><code>@​dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2776">langchain-ai/langsmith-sdk#2776</a></li> <li>chore(js): Remove types/uuid by <a href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2814">langchain-ai/langsmith-sdk#2814</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="e2386ad8aa"><code>e2386ad</code></a> release(py): 0.8.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2863">#2863</a>)</li> <li><a href="11d51a370f"><code>11d51a3</code></a> docs(langsmith): clarify trust boundaries when working with hub (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2861">#2861</a>)</li> <li><a href="d98c3ed8a9"><code>d98c3ed</code></a> Fix push_agent URL owner for name-only identifiers (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2862">#2862</a>)</li> <li><a href="418fd415fc"><code>418fd41</code></a> sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2854">#2854</a>)</li> <li><a href="1baa2c197d"><code>1baa2c1</code></a> sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_second...</li> <li><a href="361c8dd869"><code>361c8dd</code></a> release(js): bump to 0.6.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2856">#2856</a>)</li> <li><a href="0d42882f2d"><code>0d42882</code></a> fix(js): prevent sending [object Object] as span attribute when dealing with ...</li> <li><a href="619818ba8d"><code>619818b</code></a> Bump Python SDK version to 0.8.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2855">#2855</a>)</li> <li><a href="8a7d3c1356"><code>8a7d3c1</code></a> fix: parse urllib3 version with packaging.Version (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2851">#2851</a>)</li> <li><a href="54f887704f"><code>54f8877</code></a> Bump JS SDK version to 0.6.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2847">#2847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.31...v0.8.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:15 -04:00
dependabot[bot]	5810dbdf29	chore: bump langchain-core from 1.3.2 to 1.3.3 in /libs/partners/anthropic (#37288) ... Bumps [langchain-core](https://github.com/langchain-ai/langchain) from 1.3.2 to 1.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.3.3</h2> <p>Changes since langchain-core==1.3.2</p> <p>release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>) fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>) fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>) chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37109">#37109</a>) chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37129">#37129</a>) fix(core): preserve structured <code>inputs</code> on tool runs in tracers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37108">#37108</a>) release(perplexity): 1.2.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37091">#37091</a>) chore(docs): update x handle references (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37081">#37081</a>) fix(core): make <code>removal</code> optional in <code>warn_deprecated</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37056">#37056</a>) fix(core): validate batch_size in _batch and _abatch to prevent infinite loop (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36663">#36663</a>) chore(core): mark stream_v2/astream_v2 as beta (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36992">#36992</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="5039dfec1f"><code>5039dfe</code></a> release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>)</li> <li><a href="55a7707837"><code>55a7707</code></a> fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>)</li> <li><a href="c979c6187b"><code>c979c61</code></a> fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>)</li> <li><a href="d7031101da"><code>d703110</code></a> docs: update README.md (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37190">#37190</a>)</li> <li><a href="4d50a2a68b"><code>4d50a2a</code></a> ci(infra): run pre-release checks before TestPyPI publish (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37194">#37194</a>)</li> <li><a href="9bd730e199"><code>9bd730e</code></a> fix(fireworks): require <code>api_key</code> in <code>FireworksEmbeddings</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37193">#37193</a>)</li> <li><a href="f475f4191f"><code>f475f41</code></a> release(mistralai): 1.1.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37191">#37191</a>)</li> <li><a href="7dbff48aff"><code>7dbff48</code></a> fix(mistralai): strip non-wire keys from <code>ToolMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37188">#37188</a>)</li> <li><a href="913816c440"><code>913816c</code></a> release(fireworks): 1.3.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37189">#37189</a>)</li> <li><a href="4498d3dc84"><code>4498d3d</code></a> fix(fireworks): strip non-wire keys from <code>ToolMessage</code> text content blocks (#...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.3.2...langchain-core==1.3.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:07 -04:00
langchain-model-profile-bot[bot]	7842258866	chore(model-profiles): refresh model profile data (#37247) ... Automated refresh of model profile data for all in-monorepo partner integrations via `langchain-profiles refresh`. 🤖 Generated by the `refresh_model_profiles` workflow. Co-authored-by: mdrxy <61371264+mdrxy@users.noreply.github.com>	2026-05-08 10:14:32 -04:00
ccurme	4c593b35fb	release(langchain): 1.2.18 (#37250) langchain==1.2.18	2026-05-08 09:57:27 -04:00
ccurme	9c48a120b9	revert: feat(langchain): ls_agent_type tag on create_agent calls (#37249)	2026-05-08 09:24:11 -04:00
dependabot[bot]	85a5a04210	chore: bump mistune from 3.1.4 to 3.2.1 in /libs/text-splitters (#37235) ... Bumps [mistune](https://github.com/lepture/mistune) from 3.1.4 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests  -  by <a href="https://github.com/Yuki9814"><code>@​Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math  -  by <a href="https://github.com/saschabuehrle"><code>@​saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text  -  by <a href="https://github.com/lawrence3699"><code>@​lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> <h2>v3.2.0</h2> <h3>   🚀 Features</h3> <ul> <li>Support footnotes that start on the next line.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/2677e2d"><!-- raw HTML omitted -->(2677e)<!-- raw HTML omitted --></a></li> <li>Properly handle code blocks inside footnotes.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/0516c9e"><!-- raw HTML omitted -->(0516c)<!-- raw HTML omitted --></a></li> <li>Support python 3.14  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/7e0eb65"><!-- raw HTML omitted -->(7e0eb)<!-- raw HTML omitted --></a></li> </ul> <h3>   🐞 Bug Fixes</h3> <ul> <li>Render ref links and footnotes in footnotes.  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/bd90e44"><!-- raw HTML omitted -->(bd90e)<!-- raw HTML omitted --></a></li> <li>Render ref links in TOC.  -  by <a href="https://github.com/lemon24"><code>@​lemon24</code></a> <a href="https://github.com/lepture/mistune/commit/a0a0148"><!-- raw HTML omitted -->(a0a01)<!-- raw HTML omitted --></a></li> <li>Update typing for mypy upgrades  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d49cba"><!-- raw HTML omitted -->(8d49c)<!-- raw HTML omitted --></a></li> <li>Render correct html for footnotes  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/9b62204"><!-- raw HTML omitted -->(9b622)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> <h2>Version 3.2.0</h2> <p><strong>Released on Dec 23, 2025</strong></p> <ul> <li>Announce supports for python 3.14</li> <li>Fix footnotes plugins for code blocks, ref links, blockquote and etc.</li> <li>Fix ref links in TOC.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="067f908610"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="bf5503067a"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="8d0cb7539a"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="5fa092e305"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="71ec9477eb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="0d6f3d8502"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="2855622d7f"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="04880a004c"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="7bd5709671"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="85eb54ff17"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-07 14:48:51 -04:00
dependabot[bot]	2fe237a0b0	chore: bump mistune from 3.1.4 to 3.2.1 in /libs/langchain (#37236) ... Bumps [mistune](https://github.com/lepture/mistune) from 3.1.4 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests  -  by <a href="https://github.com/Yuki9814"><code>@​Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math  -  by <a href="https://github.com/saschabuehrle"><code>@​saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text  -  by <a href="https://github.com/lawrence3699"><code>@​lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> <h2>v3.2.0</h2> <h3>   🚀 Features</h3> <ul> <li>Support footnotes that start on the next line.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/2677e2d"><!-- raw HTML omitted -->(2677e)<!-- raw HTML omitted --></a></li> <li>Properly handle code blocks inside footnotes.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/0516c9e"><!-- raw HTML omitted -->(0516c)<!-- raw HTML omitted --></a></li> <li>Support python 3.14  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/7e0eb65"><!-- raw HTML omitted -->(7e0eb)<!-- raw HTML omitted --></a></li> </ul> <h3>   🐞 Bug Fixes</h3> <ul> <li>Render ref links and footnotes in footnotes.  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/bd90e44"><!-- raw HTML omitted -->(bd90e)<!-- raw HTML omitted --></a></li> <li>Render ref links in TOC.  -  by <a href="https://github.com/lemon24"><code>@​lemon24</code></a> <a href="https://github.com/lepture/mistune/commit/a0a0148"><!-- raw HTML omitted -->(a0a01)<!-- raw HTML omitted --></a></li> <li>Update typing for mypy upgrades  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d49cba"><!-- raw HTML omitted -->(8d49c)<!-- raw HTML omitted --></a></li> <li>Render correct html for footnotes  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/9b62204"><!-- raw HTML omitted -->(9b622)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> <h2>Version 3.2.0</h2> <p><strong>Released on Dec 23, 2025</strong></p> <ul> <li>Announce supports for python 3.14</li> <li>Fix footnotes plugins for code blocks, ref links, blockquote and etc.</li> <li>Fix ref links in TOC.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="067f908610"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="bf5503067a"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="8d0cb7539a"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="5fa092e305"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="71ec9477eb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="0d6f3d8502"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="2855622d7f"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="04880a004c"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="7bd5709671"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="85eb54ff17"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-07 13:08:10 -04:00
dependabot[bot]	1662347879	chore: bump mistune from 3.1.4 to 3.2.1 in /libs/core (#37237) ... Bumps [mistune](https://github.com/lepture/mistune) from 3.1.4 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests  -  by <a href="https://github.com/Yuki9814"><code>@​Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math  -  by <a href="https://github.com/saschabuehrle"><code>@​saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text  -  by <a href="https://github.com/lawrence3699"><code>@​lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> <h2>v3.2.0</h2> <h3>   🚀 Features</h3> <ul> <li>Support footnotes that start on the next line.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/2677e2d"><!-- raw HTML omitted -->(2677e)<!-- raw HTML omitted --></a></li> <li>Properly handle code blocks inside footnotes.  -  by <a href="https://github.com/kylechui"><code>@​kylechui</code></a> <a href="https://github.com/lepture/mistune/commit/0516c9e"><!-- raw HTML omitted -->(0516c)<!-- raw HTML omitted --></a></li> <li>Support python 3.14  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/7e0eb65"><!-- raw HTML omitted -->(7e0eb)<!-- raw HTML omitted --></a></li> </ul> <h3>   🐞 Bug Fixes</h3> <ul> <li>Render ref links and footnotes in footnotes.  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/bd90e44"><!-- raw HTML omitted -->(bd90e)<!-- raw HTML omitted --></a></li> <li>Render ref links in TOC.  -  by <a href="https://github.com/lemon24"><code>@​lemon24</code></a> <a href="https://github.com/lepture/mistune/commit/a0a0148"><!-- raw HTML omitted -->(a0a01)<!-- raw HTML omitted --></a></li> <li>Update typing for mypy upgrades  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d49cba"><!-- raw HTML omitted -->(8d49c)<!-- raw HTML omitted --></a></li> <li>Render correct html for footnotes  -  by <a href="https://github.com/lepture"><code>@​lepture</code></a> <a href="https://github.com/lepture/mistune/commit/9b62204"><!-- raw HTML omitted -->(9b622)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> <h2>Version 3.2.0</h2> <p><strong>Released on Dec 23, 2025</strong></p> <ul> <li>Announce supports for python 3.14</li> <li>Fix footnotes plugins for code blocks, ref links, blockquote and etc.</li> <li>Fix ref links in TOC.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="067f908610"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="bf5503067a"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="8d0cb7539a"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="5fa092e305"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="71ec9477eb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="0d6f3d8502"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="2855622d7f"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="04880a004c"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="7bd5709671"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="85eb54ff17"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.1.4...v3.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-07 13:07:44 -04:00
Eugene Yurtsev	ec9a3c15ad	release(langchain-classic): 1.0.7 (#37240) ... release 1.0.7 langchain-classic==1.0.7	2026-05-07 11:44:10 -04:00
langchain-model-profile-bot[bot]	3de039a46a	chore(model-profiles): refresh model profile data (#37231) ... Automated refresh of model profile data for all in-monorepo partner integrations via `langchain-profiles refresh`. 🤖 Generated by the `refresh_model_profiles` workflow. Co-authored-by: mdrxy <61371264+mdrxy@users.noreply.github.com>	2026-05-07 11:13:12 -04:00
Eugene Yurtsev	cccefce0b1	chore(langchain-classic): deprecate hub, limit loads/dumps (#37234) ... deprecate hub classic and hub runnable. This code path isn't expected to be active for most users (it's dependent on having a very old version of the langsmith sdk). harden usage of loads/dumps.	2026-05-07 10:37:33 -04:00
Nick Hollon	1519ed5afb	release(langchain-classic): 1.0.6 (#37211) langchain-classic==1.0.6	2026-05-05 16:59:12 -04:00
dependabot[bot]	16b7e43ef4	chore: bump jupyter-server from 2.17.0 to 2.18.0 in /libs/text-splitters (#37202) ... Bumps [jupyter-server](https://github.com/jupyter-server/jupyter_server) from 2.17.0 to 2.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/releases">jupyter-server's releases</a>.</em></p> <blockquote> <h2>v2.18.0</h2> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>Security patches</h3> <ul> <li>CVE-2026-40110 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p</a></li> <li>CVE-2025-61669 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w</a></li> <li>CVE-2026-40934 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f</a></li> <li>CVE-2026-35397 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3</a></li> </ul> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix context pollution <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1561">#1561</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Fix gateway cookie handling <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1558">#1558</a> (<a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>, <a href="https://github.com/RRosio"><code>@​RRosio</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix connection exception cause high cpu load <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1484">#1484</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Start to test on Python 3.13 and 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1623">#1623</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump actions/create-github-app-token from 2 to 3 in the actions group across 1 directory <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1621">#1621</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1615">#1615</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix package spec for jupytext <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1614">#1614</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>chore: update pre-commit hooks <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1607">#1607</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>try to fix ci on windows <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1600">#1600</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>run prerelease tests on 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1599">#1599</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Pin sphinx to an older version (&lt;9) to fix docs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1597">#1597</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md">jupyter-server's changelog</a>.</em></p> <blockquote> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.9.1...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Avoid redundant call to <code>_get_os_path</code> in <code>_dir_model</code> <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1547">#1547</a> (<a href="https://github.com/joeyutong"><code>@​joeyutong</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow specifying extra params to scrub from logs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1538">#1538</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Add a logger to the ExtensionPoint API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1523">#1523</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow user to update identity values <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1518">#1518</a> (<a href="https://github.com/brichet"><code>@​brichet</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>If ServerApp.ip is ipv6 use [::1] as local_url <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1495">#1495</a> (<a href="https://github.com/manics"><code>@​manics</code></a>, <a href="https://github.com/afshin"><code>@​afshin</code></a>)</li> <li>Better error message when starting kernel for session. <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1478">#1478</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Add a traitlet to disable recording HTTP request metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1472">#1472</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>prometheus: Expose 3 activity metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1471">#1471</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus info metrics listing server extensions + versions <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1470">#1470</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus metric with version information <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1467">#1467</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Don't hide .so,.dylib files by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1457">#1457</a> (<a href="https://github.com/nokados"><code>@​nokados</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Better hash format error message <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1442">#1442</a> (<a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Removing excessive logging from reading local files <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1420">#1420</a> (<a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>)</li> <li>Add async start hook to ExtensionApp API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1417">#1417</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/Darshan808"><code>@​Darshan808</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Do not include token in dashboard link, when available <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1406">#1406</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Add an option to have authentication enabled for all endpoints by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1392">#1392</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>websockets: add configurations for ping interval and timeout <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1391">#1391</a> (<a href="https://github.com/oliver-sanders"><code>@​oliver-sanders</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>log extension import time at debug level unless it's actually slow <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1375">#1375</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>Add support for async Authorizers (part 2) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1374">#1374</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support async Authorizers <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1373">#1373</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support get file(notebook) md5 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1363">#1363</a> (<a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Update kernel env to reflect changes in session <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1354">#1354</a> (<a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="0ceed45a80"><code>0ceed45</code></a> Publish 2.18.0</li> <li><a href="49b34392fe"><code>49b3439</code></a> Move check origin into a util function and add it to websocket (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1630">#1630</a>)</li> <li><a href="e2e08c845d"><code>e2e08c8</code></a> Add test case for bad next URL format</li> <li><a href="624d6c0daf"><code>624d6c0</code></a> Delete outdated patch code</li> <li><a href="d825b93d9c"><code>d825b93</code></a> Apply suggestion from <a href="https://github.com/minrk"><code>@​minrk</code></a></li> <li><a href="789fed081a"><code>789fed0</code></a> patch open redirect in /login</li> <li><a href="2ee51eccf3"><code>2ee51ec</code></a> fix(CVE-2026-35397): path traversal when target dir starts with root dir</li> <li><a href="057869a327"><code>057869a</code></a> Fix allow_origin_pat to do full matching instead of prefix matching</li> <li><a href="4862199a0f"><code>4862199</code></a> Add resolvePath API for resolving kernel-relative paths</li> <li><a href="e31d51406d"><code>e31d514</code></a> Bump actions/create-github-app-token from 2 to 3 in the actions group across ...</li> <li>Additional commits viewable in <a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...v2.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 16:41:57 -04:00
dependabot[bot]	ad305571ba	chore: bump jupyter-server from 2.17.0 to 2.18.0 in /libs/langchain (#37203) ... [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [jupyter-server](https://github.com/jupyter-server/jupyter_server) from 2.17.0 to 2.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/releases">jupyter-server's releases</a>.</em></p> <blockquote> <h2>v2.18.0</h2> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>Security patches</h3> <ul> <li>CVE-2026-40110 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p</a></li> <li>CVE-2025-61669 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w</a></li> <li>CVE-2026-40934 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f</a></li> <li>CVE-2026-35397 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3</a></li> </ul> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix context pollution <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1561">#1561</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Fix gateway cookie handling <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1558">#1558</a> (<a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>, <a href="https://github.com/RRosio"><code>@​RRosio</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix connection exception cause high cpu load <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1484">#1484</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Start to test on Python 3.13 and 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1623">#1623</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump actions/create-github-app-token from 2 to 3 in the actions group across 1 directory <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1621">#1621</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1615">#1615</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix package spec for jupytext <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1614">#1614</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>chore: update pre-commit hooks <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1607">#1607</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>try to fix ci on windows <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1600">#1600</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>run prerelease tests on 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1599">#1599</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Pin sphinx to an older version (&lt;9) to fix docs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1597">#1597</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md">jupyter-server's changelog</a>.</em></p> <blockquote> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.9.1...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Avoid redundant call to <code>_get_os_path</code> in <code>_dir_model</code> <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1547">#1547</a> (<a href="https://github.com/joeyutong"><code>@​joeyutong</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow specifying extra params to scrub from logs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1538">#1538</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Add a logger to the ExtensionPoint API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1523">#1523</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow user to update identity values <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1518">#1518</a> (<a href="https://github.com/brichet"><code>@​brichet</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>If ServerApp.ip is ipv6 use [::1] as local_url <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1495">#1495</a> (<a href="https://github.com/manics"><code>@​manics</code></a>, <a href="https://github.com/afshin"><code>@​afshin</code></a>)</li> <li>Better error message when starting kernel for session. <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1478">#1478</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Add a traitlet to disable recording HTTP request metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1472">#1472</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>prometheus: Expose 3 activity metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1471">#1471</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus info metrics listing server extensions + versions <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1470">#1470</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus metric with version information <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1467">#1467</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Don't hide .so,.dylib files by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1457">#1457</a> (<a href="https://github.com/nokados"><code>@​nokados</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Better hash format error message <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1442">#1442</a> (<a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Removing excessive logging from reading local files <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1420">#1420</a> (<a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>)</li> <li>Add async start hook to ExtensionApp API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1417">#1417</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/Darshan808"><code>@​Darshan808</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Do not include token in dashboard link, when available <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1406">#1406</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Add an option to have authentication enabled for all endpoints by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1392">#1392</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>websockets: add configurations for ping interval and timeout <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1391">#1391</a> (<a href="https://github.com/oliver-sanders"><code>@​oliver-sanders</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>log extension import time at debug level unless it's actually slow <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1375">#1375</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>Add support for async Authorizers (part 2) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1374">#1374</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support async Authorizers <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1373">#1373</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support get file(notebook) md5 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1363">#1363</a> (<a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Update kernel env to reflect changes in session <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1354">#1354</a> (<a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="0ceed45a80"><code>0ceed45</code></a> Publish 2.18.0</li> <li><a href="49b34392fe"><code>49b3439</code></a> Move check origin into a util function and add it to websocket (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1630">#1630</a>)</li> <li><a href="e2e08c845d"><code>e2e08c8</code></a> Add test case for bad next URL format</li> <li><a href="624d6c0daf"><code>624d6c0</code></a> Delete outdated patch code</li> <li><a href="d825b93d9c"><code>d825b93</code></a> Apply suggestion from <a href="https://github.com/minrk"><code>@​minrk</code></a></li> <li><a href="789fed081a"><code>789fed0</code></a> patch open redirect in /login</li> <li><a href="2ee51eccf3"><code>2ee51ec</code></a> fix(CVE-2026-35397): path traversal when target dir starts with root dir</li> <li><a href="057869a327"><code>057869a</code></a> Fix allow_origin_pat to do full matching instead of prefix matching</li> <li><a href="4862199a0f"><code>4862199</code></a> Add resolvePath API for resolving kernel-relative paths</li> <li><a href="e31d51406d"><code>e31d514</code></a> Bump actions/create-github-app-token from 2 to 3 in the actions group across ...</li> <li>Additional commits viewable in <a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...v2.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 16:41:53 -04:00
dependabot[bot]	2ca920cf82	chore: bump jupyter-server from 2.17.0 to 2.18.0 in /libs/core (#37204) ... Bumps [jupyter-server](https://github.com/jupyter-server/jupyter_server) from 2.17.0 to 2.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/releases">jupyter-server's releases</a>.</em></p> <blockquote> <h2>v2.18.0</h2> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>Security patches</h3> <ul> <li>CVE-2026-40110 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p</a></li> <li>CVE-2025-61669 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w</a></li> <li>CVE-2026-40934 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f</a></li> <li>CVE-2026-35397 <a href="https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3">https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3</a></li> </ul> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix context pollution <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1561">#1561</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Fix gateway cookie handling <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1558">#1558</a> (<a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>, <a href="https://github.com/RRosio"><code>@​RRosio</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>fix connection exception cause high cpu load <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1484">#1484</a> (<a href="https://github.com/dualc"><code>@​dualc</code></a>, <a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Start to test on Python 3.13 and 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1623">#1623</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump actions/create-github-app-token from 2 to 3 in the actions group across 1 directory <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1621">#1621</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1615">#1615</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix package spec for jupytext <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1614">#1614</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>chore: update pre-commit hooks <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1607">#1607</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>try to fix ci on windows <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1600">#1600</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>run prerelease tests on 3.14 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1599">#1599</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Pin sphinx to an older version (&lt;9) to fix docs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1597">#1597</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md">jupyter-server's changelog</a>.</em></p> <blockquote> <h2>2.18.0</h2> <p>(<a href="https://github.com/jupyter-server/jupyter_server/compare/v2.9.1...49b34392feaa97735b3b777e3baf8f22f2a14ed8">Full Changelog</a>)</p> <h3>API and Breaking Changes</h3> <ul> <li>Add query param to sanitize HTML in GET /nbconvert/html <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1618">#1618</a> (<a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> </ul> <h3>Enhancements made</h3> <ul> <li>Update handlers.py to fix ioloop blockers(sync file operations) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1617">#1617</a> (<a href="https://github.com/zolyfarkas-fb"><code>@​zolyfarkas-fb</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Avoid redundant call to <code>_get_os_path</code> in <code>_dir_model</code> <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1547">#1547</a> (<a href="https://github.com/joeyutong"><code>@​joeyutong</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow specifying extra params to scrub from logs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1538">#1538</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Add a logger to the ExtensionPoint API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1523">#1523</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Allow user to update identity values <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1518">#1518</a> (<a href="https://github.com/brichet"><code>@​brichet</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>If ServerApp.ip is ipv6 use [::1] as local_url <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1495">#1495</a> (<a href="https://github.com/manics"><code>@​manics</code></a>, <a href="https://github.com/afshin"><code>@​afshin</code></a>)</li> <li>Better error message when starting kernel for session. <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1478">#1478</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Add a traitlet to disable recording HTTP request metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1472">#1472</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>prometheus: Expose 3 activity metrics <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1471">#1471</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus info metrics listing server extensions + versions <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1470">#1470</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add prometheus metric with version information <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1467">#1467</a> (<a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Don't hide .so,.dylib files by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1457">#1457</a> (<a href="https://github.com/nokados"><code>@​nokados</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/vidartf"><code>@​vidartf</code></a>)</li> <li>Better hash format error message <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1442">#1442</a> (<a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Removing excessive logging from reading local files <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1420">#1420</a> (<a href="https://github.com/lresende"><code>@​lresende</code></a>, <a href="https://github.com/kevin-bates"><code>@​kevin-bates</code></a>)</li> <li>Add async start hook to ExtensionApp API <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1417">#1417</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/Darshan808"><code>@​Darshan808</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/fcollonval"><code>@​fcollonval</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Do not include token in dashboard link, when available <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1406">#1406</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Add an option to have authentication enabled for all endpoints by default <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1392">#1392</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>websockets: add configurations for ping interval and timeout <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1391">#1391</a> (<a href="https://github.com/oliver-sanders"><code>@​oliver-sanders</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>log extension import time at debug level unless it's actually slow <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1375">#1375</a> (<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/yuvipanda"><code>@​yuvipanda</code></a>)</li> <li>Add support for async Authorizers (part 2) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1374">#1374</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support async Authorizers <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1373">#1373</a> (<a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> <li>Support get file(notebook) md5 <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1363">#1363</a> (<a href="https://github.com/Wh1isper"><code>@​Wh1isper</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Update kernel env to reflect changes in session <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1354">#1354</a> (<a href="https://github.com/blink1073"><code>@​blink1073</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Add resolvePath API for resolving kernel-relative paths <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1331">#1331</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/blink1073"><code>@​blink1073</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Move check origin into a util function and add it to websocket <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1630">#1630</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/Yann-P"><code>@​Yann-P</code></a>)</li> <li>Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1628">#1628</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>, <a href="https://github.com/claude"><code>@​claude</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li> <li>Try to fix flaky test &quot;test_restart_kernel&quot; <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1625">#1625</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Fix potential unraisable pytest error <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1624">#1624</a> (<a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1620">#1620</a> (<a href="https://github.com/terminalchai"><code>@​terminalchai</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/ptch314"><code>@​ptch314</code></a>)</li> <li>Fix three file descriptor leaks in kernel connection lifecycle (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1506">#1506</a>) <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1619">#1619</a> (<a href="https://github.com/tonyx93"><code>@​tonyx93</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Use web.HTTPError for kernel restart failures <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1616">#1616</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li> <li>Handle EADDRINUSE and EACCES in _bind_http_server_tcp <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1613">#1613</a> (<a href="https://github.com/YDawn"><code>@​YDawn</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Use st_birthtime for file created timestamp on macOS/BSD <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1594">#1594</a> (<a href="https://github.com/ktaletsk"><code>@​ktaletsk</code></a>, <a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix double write when refusing hidden files in contents handler <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1585">#1585</a> (<a href="https://github.com/Krish-876"><code>@​Krish-876</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Close all sockets in _find_http_port explicitly <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1584">#1584</a> (<a href="https://github.com/MaryushSoroka"><code>@​MaryushSoroka</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> <li>Fix writing on remote file systems with attribute cache <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1574">#1574</a> (<a href="https://github.com/krassowski"><code>@​krassowski</code></a>, <a href="https://github.com/Zsailer"><code>@​Zsailer</code></a>)</li> <li>Add IdentityProvider.cookie_secret_hook <a href="https://redirect.github.com/jupyter-server/jupyter_server/pull/1569">#1569</a> (<a href="https://github.com/emin63"><code>@​emin63</code></a>, <a href="https://github.com/minrk"><code>@​minrk</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="0ceed45a80"><code>0ceed45</code></a> Publish 2.18.0</li> <li><a href="49b34392fe"><code>49b3439</code></a> Move check origin into a util function and add it to websocket (<a href="https://redirect.github.com/jupyter-server/jupyter_server/issues/1630">#1630</a>)</li> <li><a href="e2e08c845d"><code>e2e08c8</code></a> Add test case for bad next URL format</li> <li><a href="624d6c0daf"><code>624d6c0</code></a> Delete outdated patch code</li> <li><a href="d825b93d9c"><code>d825b93</code></a> Apply suggestion from <a href="https://github.com/minrk"><code>@​minrk</code></a></li> <li><a href="789fed081a"><code>789fed0</code></a> patch open redirect in /login</li> <li><a href="2ee51eccf3"><code>2ee51ec</code></a> fix(CVE-2026-35397): path traversal when target dir starts with root dir</li> <li><a href="057869a327"><code>057869a</code></a> Fix allow_origin_pat to do full matching instead of prefix matching</li> <li><a href="4862199a0f"><code>4862199</code></a> Add resolvePath API for resolving kernel-relative paths</li> <li><a href="e31d51406d"><code>e31d514</code></a> Bump actions/create-github-app-token from 2 to 3 in the actions group across ...</li> <li>Additional commits viewable in <a href="https://github.com/jupyter-server/jupyter_server/compare/v2.17.0...v2.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 16:41:09 -04:00
Nick Hollon	c0e1d1366e	fix(langchain): restrict deserialization in langchain_classic.storage._lc_store (#37208)	2026-05-05 16:29:22 -04:00
Nick Hollon	69fb89f873	fix(langchain): use langchain-classic version for hub.pull deprecation (#37199)	2026-05-05 15:00:47 -04:00
Nick Hollon	5039dfec1f	release(core): 1.3.3 (#37198) langchain-core==1.3.3	2026-05-05 15:00:01 -04:00
Nick Hollon	55a7707837	fix(core): set deprecation since to 1.3.3 to match release (#37200)	2026-05-05 14:59:47 -04:00
Nick Hollon	c979c6187b	fix(core, langchain): harden load() against untrusted manifests (#37197)	2026-05-05 14:36:58 -04:00
Naomi Pentrel	d7031101da	docs: update README.md (#37190)	2026-05-05 17:58:15 +02:00
Mason Daugherty	4d50a2a68b	ci(infra): run pre-release checks before TestPyPI publish (#37194) ... Reorder the release pipeline so `pre-release-checks` runs before `test-pypi-publish`. The original ordering existed because `pre-release-checks` used to `pip install` from TestPyPI; that dependency was removed in #28492 (Dec 2024), which switched checks to install from the locally-built `dist/*.whl`. Since then, the TestPyPI upload was running ahead of checks for no functional reason — and a failed checks job left a TestPyPI version burned, with `skip-existing: true` papering over the resulting collision on re-runs.	2026-05-05 11:56:18 -04:00
Mason Daugherty	9bd730e199	fix(fireworks): require api_key in FireworksEmbeddings (#37193) langchain-fireworks==1.3.1	2026-05-05 11:39:16 -04:00
Mason Daugherty	f475f4191f	release(mistralai): 1.1.4 (#37191) langchain-mistralai==1.1.4	2026-05-05 11:25:50 -04:00
Mason Daugherty	7dbff48aff	fix(mistralai): strip non-wire keys from ToolMessage (#37188) ... Same as https://github.com/langchain-ai/langchain/pull/37187	2026-05-05 11:24:09 -04:00
Mason Daugherty	913816c440	release(fireworks): 1.3.1 (#37189)	2026-05-05 11:18:18 -04:00
Mason Daugherty	4498d3dc84	fix(fireworks): strip non-wire keys from ToolMessage text content blocks (#37187) ... Fireworks's chat completions endpoint rejects unknown fields on tool message content blocks — specifically the `id` key that LangChain auto-generates on `TextContentBlock`. Add `_sanitize_chat_completions_content` to strip those extra keys before the payload hits the wire, preventing `Extra inputs are not permitted` errors on tool message round-trips.	2026-05-05 11:10:55 -04:00
langchain-model-profile-bot[bot]	afa7e992ef	chore(model-profiles): refresh model profile data (#37182) ... Automated refresh of model profile data for all in-monorepo partner integrations via `langchain-profiles refresh`. 🤖 Generated by the `refresh_model_profiles` workflow. Co-authored-by: mdrxy <61371264+mdrxy@users.noreply.github.com>	2026-05-05 10:32:51 -04:00
Mason Daugherty	1c08d478d9	release(anthropic): 1.4.3 (#37166) langchain-anthropic==1.4.3	2026-05-03 13:30:08 -04:00
Mason Daugherty	71708c660a	release(langchain-classic): 1.0.5 (#37165) langchain-classic==1.0.5	2026-05-03 13:29:37 -04:00
Mason Daugherty	5a9b1ec2dc	refactor(langchain-classic): retarget deprecations to create_agent, other chores (#37164) ... Sweep classic deprecations so every removal lands on `2.0.0`, runtime warnings carry the auto-generated since/removal/alternative line, and replacements steer at `langchain.agents.create_agent` and `with_structured_output(...)` instead of pre-v1 LangGraph + `python.langchain.com` links. ## Changes - **Bump removal targets from `1.0` / `1.0.0` to `2.0.0`** across agents, chains, memory, retrievers, structured-output, vectorstore toolkits, and the `langchain_classic._api.module_import` shim — gives users a real runway now that v1 has shipped. - **Move bespoke `message=` strings onto `addendum=`** (or split into `alternative=` + `addendum=`). `warn_deprecated` skips the auto-generated since/removal/alternative line whenever `message=` is set, so the prior pattern silently dropped that info from the runtime `LangChainDeprecationWarning`. Matches the pattern already used in `HTMLHeaderTextSplitter.split_text_from_url`, which is updated for consistency. - **Repoint `alternative=` at v1 replacements**: chains/memory/agent toolkits → `langchain.agents.create_agent` (with checkpointer or retrieval-tool guidance in the addendum); `openai_functions` and `chains/structured_output` → `ChatModel.with_structured_output(...)`; `openapi` chains → `ChatModel.bind_tools(...)` + HTTP client. `ConversationChain` no longer points at `RunnableWithMessageHistory`. - **Refresh `AGENT_DEPRECATION_WARNING`** in `langchain_classic._api.deprecation` — drop stale LangGraph and `python.langchain.com` links in favor of `langchain.agents.create_agent` and the `docs.langchain.com/oss/python/migrate/langchain-v1` guide. Propagates to all 13 caller sites in `agents/`. - **Newly deprecate `langchain_classic.chat_models.init_chat_model` and `langchain_classic.embeddings.init_embeddings`** with the framing *"maintained in `langchain`; `langchain-classic` retains this entry point for import-compatibility only"*. The classic docstring examples and the warning admonition both point at `langchain.chat_models`. - **Improve `init_chat_model` docstrings** in both `langchain_v1` and the classic copy: clarify `provider:model` prefix vs. `model_provider=`, recommend pinned IDs over moving aliases, add the `upstage` provider row, and refresh examples to GA models (`gpt-5.5`, `claude-opus-4-7`). - **Standardize partner Anthropic deprecations**: replace `AnthropicLLM`'s `model_validator(raise_warning)` with `@deprecated(since="0.1.0", removal="2.0.0", alternative="ChatAnthropic")`, and pin the `ChatAnthropic` `output_format` runtime warning at `langchain-anthropic 2.0.0` instead of "a future version".	2026-05-03 13:15:59 -04:00
Mason Daugherty	255f227541	chore(langchain,langchain-classic): uncomment optional deps (#37163) ... Re-enable the `[community]`, `[azure-ai]`, and `[cohere]` extras on `langchain-classic`, and the `[cohere]` extra on `langchain` (v1). These had been commented out as a temporary workaround during the `langchain` -> `langchain-classic` rename so the renamed package could ship before downstream partners were re-released against it. Now that `langchain-community` 0.4.1, `langchain-cohere` 0.5.1, and `langchain-azure-ai` 1.2.3 are published with the correct dependency targets, the extras can be restored.	2026-05-03 11:19:55 -04:00
langchain-model-profile-bot[bot]	c42b0800ee	chore(model-profiles): refresh model profile data (#37162) ... Automated refresh of model profile data for all in-monorepo partner integrations via `langchain-profiles refresh`. 🤖 Generated by the `refresh_model_profiles` workflow. Co-authored-by: mdrxy <61371264+mdrxy@users.noreply.github.com>	2026-05-03 08:07:37 -04:00
langchain-model-profile-bot[bot]	e411a4e853	chore(model-profiles): refresh model profile data (#37148) ... Automated refresh of model profile data for all in-monorepo partner integrations via `langchain-profiles refresh`. 🤖 Generated by the `refresh_model_profiles` workflow. Co-authored-by: mdrxy <61371264+mdrxy@users.noreply.github.com>	2026-05-02 04:32:59 -04:00
Mason Daugherty	934d9e25f3	release(openrouter): 0.2.3 (#37146) langchain-openrouter==0.2.3	2026-05-01 17:57:11 -04:00
Xi Zhang	70f5626579	fix(openrouter): merge fragmented reasoning_details in streaming (#36401) ... ## Description Fixes #36400 During streaming, `AIMessageChunk.__add__` list-concatenates `reasoning_details` in `additional_kwargs`, fragmenting a single entry into many. When `_convert_message_to_dict()` serializes conversation history back to the OpenRouter API for the next turn, these fragmented entries cause `BadRequestResponseError`. ### Changes - Add `_merge_reasoning_details()` helper that merges consecutive entries sharing the same `type` and `index` (streaming fragments) while preserving distinct entries (legitimate non-streaming data) - Metadata from later fragments (e.g. `signature`) is preserved in the merged result - Entries without `index` are never merged (safe for non-streaming responses) - Call `_merge_reasoning_details()` in `_convert_message_to_dict()` before serializing `reasoning_details` ### Why merge instead of drop? Non-streaming users (`invoke()`) rely on `reasoning_details` for structured metadata (`type`, `signature`, `format`, `index`). Dropping it entirely would be a regression. This approach fixes streaming while preserving non-streaming functionality, similar to `langchain-openai`'s `_implode_reasoning_blocks()`. ## Test plan - [x] Fragmented entries (same type + same index) are merged into one - [x] Distinct entries (different index) are preserved separately - [x] Entries without index are never merged - [x] Metadata from later fragments (e.g. signature) is preserved - [x] Single-entry lists pass through unchanged - [x] Round-trip (dict → message → dict) works correctly - [x] All 210 unit tests pass --------- Co-authored-by: Mason Daugherty <github@mdrxy.com> Co-authored-by: Mason Daugherty <mason@langchain.dev>	2026-05-01 17:57:00 -04:00
Mason Daugherty	2ed935956a	release(mistralai): 1.1.3 (#37145) langchain-mistralai==1.1.3	2026-05-01 17:08:22 -04:00
Akash Choudhary	d1a3c3d0a5	feat(mistralai): add image input support for human messages (#37112) ... Closes #37007 --- `ChatMistralAI` was POSTing `HumanMessage` content lists verbatim, so canonical `ImageContentBlock` dicts (`{"type": "image", "url"/"base64": ...}`) reached the Mistral API unchanged and were rejected — the API expects OpenAI-shape `{"type": "image_url", "image_url": {"url": "..."}}`. Multimodal inputs failed for both URL and base64 images. ## Changes - Introduce `_format_message_content` in `langchain_mistralai.chat_models`, which delegates to `is_data_content_block` and `convert_to_openai_data_block(api="chat/completions")` from `langchain-core`. Reuses the same translator `langchain-openai` and `langchain-fireworks` (#37090) use, so v0 `source_type` blocks, v1 `url`/`base64` blocks, and `file_id` references are all handled by one canonical path. - Route `HumanMessage` content through `_format_message_content` in `_convert_message_to_mistral_chat_message`. Strings, already-translated `image_url` blocks, and Mistral-specific blocks (`document_url`, `input_audio`) pass through unchanged; the API surfaces an error for anything it doesn't recognize. --------- Co-authored-by: Akash Choudhary <achoudhary@lenovo.com> Co-authored-by: Mason Daugherty <github@mdrxy.com>	2026-05-01 17:06:39 -04:00
Mason Daugherty	4389b4c774	release(fireworks): 1.3.0 (#37144) langchain-fireworks==1.3.0	2026-05-01 16:43:33 -04:00
Mason Daugherty	390843bd84	feat(fireworks): service_tier init kwarg on ChatFireworks (#37143) ... Add a `service_tier` init kwarg to `ChatFireworks`, mirroring the field on `ChatOpenAI`. Forwards to the Fireworks chat completions API when set, and echoes the response's tier back onto `response_metadata` and `llm_output` so callbacks and consumers can read what the server actually applied.	2026-05-01 16:42:34 -04:00
Nick Hollon	91842db32b	ci(infra): extend allow-prereleases gating to remaining wheel-install steps (#37142)	2026-05-01 15:16:46 -04:00
Nick Hollon	37c8a5059f	ci(infra): opt-in allow-prereleases flag for wheel-install steps (#37141) ... ## Summary The release pipeline's two \`uv pip install dist/*.whl\` calls fail when the released package depends on a langgraph alpha that itself has transitive prerelease deps. uv's default \`if-necessary-or-explicit\` mode allows prereleases for first-party explicit markers (the wheel's own deps) but rejects transitive ones, so the install fails on the wheel — even when the wheel itself names an explicit prerelease for the immediate dependency. Add a workflow input \`allow-prereleases\` (default \`false\`, on both \`workflow_call\` and \`workflow_dispatch\` triggers). When true, both install steps pass \`--prerelease=allow\`. When false (the default), behavior is unchanged. The existing \`check_prerelease_dependencies.py\` step still gates stable releases against accidentally-pinned prerelease deps.	2026-05-01 15:06:22 -04:00
Mason Daugherty	365315e6f7	release(openrouter): 0.2.2 (#37139) langchain-openrouter==0.2.2	2026-05-01 14:16:39 -04:00
Mason Daugherty	1e38d59d41	feat(openrouter): session_id and trace fields (#37137) ... Add first-class `session_id` and `trace` constructor fields on `ChatOpenRouter`, plumbed into the request payload alongside the existing `route` / `plugins` / `openrouter_provider` knobs. Both correspond to the OpenRouter [broadcast](https://openrouter.ai/docs/guides/features/broadcast/overview) feature for grouping requests under one logical workflow and attaching per-request observability metadata. Previously these were only reachable by stuffing them through `model_kwargs` or `.bind()`, neither of which is discoverable. [Docs](https://github.com/langchain-ai/docs/pull/3840) ## Changes - New `session_id: str | None` field with a `from_env("OPENROUTER_SESSION_ID", default=None)` factory, so a process can group all requests via env var without threading the value through application code. Truthy-guarded in `_default_params` so an explicit or env-sourced empty string is treated as unset. - New `trace: dict[str, Any] | None` field for per-request trace metadata (`trace_id`, `trace_name`, `span_name`, `generation_name`, `parent_span_id`, plus arbitrary extras forwarded as custom metadata). No env fallback — set per-call or on the constructor. - Per-call override (`model.invoke(..., session_id=..., trace=...)`) works through the existing `**kwargs` flow into `_generate` / `_stream`, with the constructor value preserved across calls. - Updated the "Key init args — client params" docstring table on `ChatOpenRouter` to surface both fields.	2026-05-01 14:14:04 -04:00
dependabot[bot]	8640de8031	chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/standard-tests (#37125) ... [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [types-pyyaml](https://github.com/python/typeshed) from 6.0.12.20250915 to 6.0.12.20260408. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/python/typeshed/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mason Daugherty <mason@langchain.dev>	2026-05-01 14:18:24 +00:00
dependabot[bot]	8eb3bec99f	chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (#37109) ... Bumps [notebook](https://github.com/jupyter/notebook) from 7.5.0 to 7.5.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter/notebook/releases">notebook's releases</a>.</em></p> <blockquote> <h2>v7.5.6</h2> <h2>7.5.6</h2> <p>(<a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.5...2e642f0cb10be314ba5d97d709cffe41bf992d9e">Full Changelog</a>)</p> <h3>Security patches</h3> <ul> <li>CVE-2026-42557 <a href="https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg">https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg</a></li> <li>CVE-2026-40171 <a href="https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9">https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9</a></li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update to JupyterLab v4.5.7 <a href="https://redirect.github.com/jupyter/notebook/pull/7902">#7902</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> </ul> <h3>Documentation improvements</h3> <ul> <li>docs: Fix broken links in troubleshooting and migration docs <a href="https://redirect.github.com/jupyter/notebook/pull/7824">#7824</a> (<a href="https://github.com/RamiNoodle733"><code>@​RamiNoodle733</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-03-11&amp;to=2026-04-30&amp;type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/jtpio"><code>@​jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-03-11..2026-04-30&amp;type=Issues">activity</a>) | <a href="https://github.com/RamiNoodle733"><code>@​RamiNoodle733</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3ARamiNoodle733+updated%3A2026-03-11..2026-04-30&amp;type=Issues">activity</a>)</p> <h2>v7.5.5</h2> <h2>7.5.5</h2> <p>(<a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.4...4f8438b0c67dc4f010bf8cd052da4f16e2ed3828">Full Changelog</a>)</p> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update to JupyterLab v4.5.6 <a href="https://redirect.github.com/jupyter/notebook/pull/7861">#7861</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> <li>[7.5.x] Drop Python 3.9 on CI <a href="https://redirect.github.com/jupyter/notebook/pull/7860">#7860</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> <li>Fix check links <a href="https://redirect.github.com/jupyter/notebook/pull/7857">#7857</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-02-24&amp;to=2026-03-11&amp;type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/jtpio"><code>@​jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-02-24..2026-03-11&amp;type=Issues">activity</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter/notebook/blob/@jupyter-notebook/tree@7.5.6/CHANGELOG.md">notebook's changelog</a>.</em></p> <blockquote> <h2>7.5.6</h2> <p>(<a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.5...2e642f0cb10be314ba5d97d709cffe41bf992d9e">Full Changelog</a>)</p> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update to JupyterLab v4.5.7 <a href="https://redirect.github.com/jupyter/notebook/pull/7902">#7902</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> </ul> <h3>Documentation improvements</h3> <ul> <li>docs: Fix broken links in troubleshooting and migration docs <a href="https://redirect.github.com/jupyter/notebook/pull/7824">#7824</a> (<a href="https://github.com/RamiNoodle733"><code>@​RamiNoodle733</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-03-11&amp;to=2026-04-30&amp;type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/jtpio"><code>@​jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-03-11..2026-04-30&amp;type=Issues">activity</a>) | <a href="https://github.com/RamiNoodle733"><code>@​RamiNoodle733</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3ARamiNoodle733+updated%3A2026-03-11..2026-04-30&amp;type=Issues">activity</a>)</p> <!-- raw HTML omitted --> <h2>7.5.5</h2> <p>(<a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.4...4f8438b0c67dc4f010bf8cd052da4f16e2ed3828">Full Changelog</a>)</p> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update to JupyterLab v4.5.6 <a href="https://redirect.github.com/jupyter/notebook/pull/7861">#7861</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> <li>[7.5.x] Drop Python 3.9 on CI <a href="https://redirect.github.com/jupyter/notebook/pull/7860">#7860</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> <li>Fix check links <a href="https://redirect.github.com/jupyter/notebook/pull/7857">#7857</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-02-24&amp;to=2026-03-11&amp;type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/jtpio"><code>@​jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-02-24..2026-03-11&amp;type=Issues">activity</a>)</p> <h2>7.5.4</h2> <p>(<a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.3...e5d8418b706fcefd4208bb61c22399dd3123555b">Full Changelog</a>)</p> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update to JupyterLab v4.5.5 <a href="https://redirect.github.com/jupyter/notebook/pull/7842">#7842</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> <li>Fix PyO3 CI failure with Python 3.15 <a href="https://redirect.github.com/jupyter/notebook/pull/7836">#7836</a> (<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="1ab2d2b992"><code>1ab2d2b</code></a> Publish 7.5.6</li> <li><a href="50e5222c96"><code>50e5222</code></a> Merge commit from fork</li> <li><a href="2e642f0cb1"><code>2e642f0</code></a> Update to JupyterLab v4.5.7 (<a href="https://redirect.github.com/jupyter/notebook/issues/7902">#7902</a>)</li> <li><a href="4b93f98b5a"><code>4b93f98</code></a> Backport PR <a href="https://redirect.github.com/jupyter/notebook/issues/7824">#7824</a>: docs: Fix broken links in troubleshooting and migration do...</li> <li><a href="9a2c88fe64"><code>9a2c88f</code></a> Publish 7.5.5</li> <li><a href="4f8438b0c6"><code>4f8438b</code></a> Update to JupyterLab v4.5.6 (<a href="https://redirect.github.com/jupyter/notebook/issues/7861">#7861</a>)</li> <li><a href="f78fcfada8"><code>f78fcfa</code></a> Backport PR <a href="https://redirect.github.com/jupyter/notebook/issues/7857">#7857</a>: Fix check links (<a href="https://redirect.github.com/jupyter/notebook/issues/7858">#7858</a>)</li> <li><a href="9e4cf2a445"><code>9e4cf2a</code></a> [7.5.x] Drop Python 3.9 on CI (<a href="https://redirect.github.com/jupyter/notebook/issues/7860">#7860</a>)</li> <li><a href="ecc3aaf1bb"><code>ecc3aaf</code></a> Publish 7.5.4</li> <li><a href="e5d8418b70"><code>e5d8418</code></a> Update to JupyterLab v4.5.5 (<a href="https://redirect.github.com/jupyter/notebook/issues/7842">#7842</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/tree@7.5.0...@jupyter-notebook/tree@7.5.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-01 10:13:25 -04:00