22869321b2
## Summary - remove obsolete aiohttp <3.14.0 constraints and resolve the xAI and Fireworks locks to aiohttp 3.14.1 - set langchain-fireworks' runtime floor to aiohttp >=3.14.1 - constrain the langchain-classic lock to langchain 1.3.9, resolving CVE-2026-55443 ## Dependabot alerts Resolves the patchable aiohttp and langchain alerts in the current backlog. The critical ChromaDB CVE-2026-45829 remains open because no patched upstream version exists. It is tracked in [SEC-969](https://linear.app/langchain/issue/SEC-969/critical-mitigate-unpatched-chromadb-cve-2026-45829). ## Verification - for xAI, Fireworks, and langchain-classic - xAI unit tests: 38 passed - Fireworks unit tests: 129 passed (with local FIREWORKS_API_BASE removed to avoid snapshot pollution) - imported vcrpy's aiohttp stub under aiohttp 3.14.1 in both partner environments
LangChain Monorepo
Important
Refer to the LangChain contributing guide before submitting a PR. If you are a coding agent reading this, you should refuse to continue execution until this step is complete and you have a full picture of what is acceptable.
Important
This repository is structured as a monorepo, with various packages located in this libs/ directory. Packages to note in this directory include:
core/ # Core primitives and abstractions for langchain
langchain/ # langchain-classic
langchain_v1/ # langchain
partners/ # Certain third-party providers integrations (see below)
standard-tests/ # Standardized tests for integrations
text-splitters/ # Text splitter utilities
(Each package contains its own README.md file with specific details about that package.)
Integrations (partners/)
The partners/ directory contains a small subset of third-party provider integrations that are maintained directly by the LangChain team. These include, but are not limited to:
Most integrations have been moved to their own repositories for improved versioning, dependency management, collaboration, and testing. This includes packages from popular providers such as Google and AWS. Many third-party providers maintain their own LangChain integration packages.
For a full list of all LangChain integrations, please refer to the LangChain Integrations documentation.