22869321b2
## Summary - remove obsolete aiohttp <3.14.0 constraints and resolve the xAI and Fireworks locks to aiohttp 3.14.1 - set langchain-fireworks' runtime floor to aiohttp >=3.14.1 - constrain the langchain-classic lock to langchain 1.3.9, resolving CVE-2026-55443 ## Dependabot alerts Resolves the patchable aiohttp and langchain alerts in the current backlog. The critical ChromaDB CVE-2026-45829 remains open because no patched upstream version exists. It is tracked in [SEC-969](https://linear.app/langchain/issue/SEC-969/critical-mitigate-unpatched-chromadb-cve-2026-45829). ## Verification - for xAI, Fireworks, and langchain-classic - xAI unit tests: 38 passed - Fireworks unit tests: 129 passed (with local FIREWORKS_API_BASE removed to avoid snapshot pollution) - imported vcrpy's aiohttp stub under aiohttp 3.14.1 in both partner environments
🦜️🔗 LangChain Classic
Looking for the JS/TS version? Check out LangChain.js.
To help you ship LangChain apps to production faster, check out LangSmith. LangSmith is a unified developer platform for building, testing, and monitoring LLM applications.
Quick Install
uv add langchain-classic
🤔 What is this?
Legacy chains, langchain-community re-exports, indexing API, deprecated functionality, and more.
In most cases, you should be using the main langchain package.
📖 Documentation
For full documentation, see the API reference. For conceptual guides, tutorials, and examples on using LangChain, see the LangChain Docs.
📕 Releases & Versioning
See our Releases and Versioning policies.
💁 Contributing
As an open-source project in a rapidly developing field, we are extremely open to contributions, whether it be in the form of a new feature, improved infrastructure, or better documentation.
For detailed information on how to contribute, see the Contributing Guide.
Resources
- LangChain Academy — comprehensive, free courses on LangChain libraries and products, made by the LangChain team
- Code of Conduct — community guidelines and standards