langchain

0 Fork 0

mirror of https://github.com/langchain-ai/langchain.git synced 2026-10-05 09:25:14 +03:00

Author	SHA1	Message	Date
dependabot[bot]	2e9616bf0d	chore(deps): bump oauthlib from 3.3.1 to 4.0.0 in /libs/partners/chroma (#40963 ) Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 3.3.1 to 4.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/releases">oauthlib's releases</a>.</em></p> <blockquote> <h2>4.0.0</h2> <h2>Introduction</h2> <p>The release 4.0.0 defines the foundation that enables AI contributions and will improve the maintenance of oauthlib by using AI agents, skills, code for both contributors and maintainers. It includes devcontainer, skills and cleanup of instructions.</p> <h2>What's Changed</h2> <p><strong>Important</strong>: this release contains 2 breaking changes. See CHANGELOG.rst for details:</p> <ul> <li>Removed JSONP support from token revocation endpoint (<a href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>)</li> <li>Client authentication validation reorganized across grants (<a href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>, <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>): the <code>grant_type</code> parameter is now validated before client authentication.</li> </ul> <ul> <li>Replace pyenv with uv in documentation and tooling by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/910">oauthlib/oauthlib#910</a></li> <li>Improve github action to publish package by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/915">oauthlib/oauthlib#915</a></li> <li>Add pre-commit to run linters, formatters, etc. on code changes by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/918">oauthlib/oauthlib#918</a></li> <li>Fix client authentication for DeviceCodeGrant when getting a token by <a href="https://github.com/hekhuisk"><code>@hekhuisk</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li> <li>Add project URLs to this project's PyPI page by <a href="https://github.com/Flimm"><code>@Flimm</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li> <li>Fix a typo in ServiceApplicationClient docstring. by <a href="https://github.com/rafalkrupinski"><code>@rafalkrupinski</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/923">oauthlib/oauthlib#923</a></li> <li>Correct grammar in function help by <a href="https://github.com/verhovsky"><code>@verhovsky</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li> <li>Add Python 3.14 to the testing by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/925">oauthlib/oauthlib#925</a></li> <li>Initial python/uv/tox devcontainer by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/930">oauthlib/oauthlib#930</a></li> <li>Fix ruff checks about unused variables by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/931">oauthlib/oauthlib#931</a></li> <li>Drop EOL Python 3.8 from CI by <a href="https://github.com/auvipy"><code>@auvipy</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/932">oauthlib/oauthlib#932</a></li> <li>Set Open Collective username to 'oauthlib' by <a href="https://github.com/auvipy"><code>@auvipy</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/933">oauthlib/oauthlib#933</a></li> <li>pre-commit autoupdate 2026_02_21 by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/934">oauthlib/oauthlib#934</a></li> <li>Remove a trailing whitespace fo fix failing pre-commit by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/935">oauthlib/oauthlib#935</a></li> <li>Fix typos discovered by typos by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/938">oauthlib/oauthlib#938</a></li> <li>Add <code>resource</code> to Request._params by <a href="https://github.com/juannyG"><code>@juannyG</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li> <li>Release 3.4.0: Add OAuthLib Maintainer agent by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/950">oauthlib/oauthlib#950</a></li> <li>Remove JSONP support from token revocation by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/951">oauthlib/oauthlib#951</a></li> <li>Improve PKCE code comparison by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/963">oauthlib/oauthlib#963</a></li> <li>Release 4.0.0: bump and update changelog by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/976">oauthlib/oauthlib#976</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hekhuisk"><code>@hekhuisk</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li> <li><a href="https://github.com/Flimm"><code>@Flimm</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li> <li><a href="https://github.com/verhovsky"><code>@verhovsky</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li> <li><a href="https://github.com/juannyG"><code>@juannyG</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/blob/master/CHANGELOG.rst">oauthlib's changelog</a>.</em></p> <blockquote> <h2>4.0.0 (2026-09-28):</h2> <p>OAuth2.0 Provider:</p> <ul> <li><strong>Breaking</strong>: <a href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>: Removed JSONP support from token revocation endpoint. JSONP has been superseded by CORS for cross-origin requests. The <code>enable_jsonp</code> parameter has been removed from <code>RevocationEndpoint</code> and the <code>callback</code> parameter has been removed from <code>prepare_token_revocation_request</code>.</li> <li><strong>Breaking</strong>: <a href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>, <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>: Fixed <code>DeviceCodeGrant.validate_token_request</code> trying to authenticate public clients. Client authentication validation has been reorganized and is now shared across <code>AuthorizationCodeGrant</code>, <code>DeviceCodeGrant</code>, <code>RefreshTokenGrant</code> and <code>ResourceOwnerPasswordCredentialsGrant</code>: the <code>grant_type</code> parameter is validated before client authentication, so requests missing <code>grant_type</code> now return <code>400 invalid_request</code> instead of <code>401 invalid_client</code>.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a>: Improved PKCE code comparison</li> </ul> <p>Misc:</p> <ul> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/904">#904</a>: Stop installing <code>examples</code> into <code>site-packages</code>.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/930">#930</a>: Add devcontainer, Add Python3.14, Python3.14t.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/931">#931</a>: Fix ruff checks about unused variables.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/932">#932</a>: Dropped EOL Python 3.8 from CI.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/934">#934</a>: Pre-commit hooks autoupdate.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/938">#938</a>: Fix typos discovered by typos.</li> <li>Add OAuthLib Maintainer agent for automated issue/PR triage and release management.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oauthlib/oauthlib/commit/145a9a4690cb4d9de30d15fcc2984e34c49df741"><code>145a9a4</code></a> Release 4.0.0: clarify changelog breaking changes and reformat entries</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/c8344d61492c7ae708cf378ecabab7ee6ab62812"><code>c8344d6</code></a> Update CHANGELOG.rst</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/e172830efd66a2dc1bb34b3bbbf8ee53036a9dac"><code>e172830</code></a> Release 4.0.0: bump version to 4.0.0 and update changelog</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950"><code>40b0ab5</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a> from oauthlib/ft/pkcecode</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/1b68ceaae02fe62aeaaa3468a8f8082c73830a3a"><code>1b68cea</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a> from hekhuisk/validate-client-authentication</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d"><code>c951a1d</code></a> Organized validate_client functions for all grant to avoid mistake in grnat i...</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0"><code>74664d3</code></a> Improve PKCE code comparison</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/9859b057ecc5d1ad42711af7d58ee471d708ea36"><code>9859b05</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/950">#950</a> from oauthlib/feature/3.4.0-maintainer-agent</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/9bf9b974e0797d2d03cba05854f46e314c730ba6"><code>9bf9b97</code></a> Merge branch 'master' into feature/3.4.0-maintainer-agent</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/1ba7429ad79019289540fd7be27866d7e59f2564"><code>1ba7429</code></a> Clarify agent instructions</li> <li>Additional commits viewable in <a href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oauthlib&package-manager=uv&previous-version=3.3.1&new-version=4.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-01 00:54:41 -07:00
dependabot[bot]	a31a9370b9	chore(deps): bump anyio from 4.11.0 to 4.14.2 in /libs/partners/chroma (#40642 ) Bumps [anyio](https://github.com/agronholm/anyio) from 4.11.0 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.11.0...4.14.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anyio&package-manager=uv&previous-version=4.11.0&new-version=4.14.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 13:51:26 -04:00
dependabot[bot]	3b81e028b1	chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/chroma (#40582 ) Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=uv&previous-version=2.7.0&new-version=2.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 02:35:51 +00:00
dependabot[bot]	fa369c965b	chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/chroma (#40581 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.12.1 to 0.12.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.12.6</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.10.4 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3542">langchain-ai/langsmith-sdk#3542</a></li> <li>docs: add OpenWiki, with a weekly refresh workflow by <a href="https://github.com/thibautlehmann"><code>@thibautlehmann</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3541">langchain-ai/langsmith-sdk#3541</a></li> <li>fix(livekit): preserve system instructions with history by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3544">langchain-ai/langsmith-sdk#3544</a></li> <li>release(py): 0.12.6 by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3546">langchain-ai/langsmith-sdk#3546</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.5...v0.12.6">https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.5...v0.12.6</a></p> <h2>v0.12.5</h2> <h2>What's Changed</h2> <ul> <li>fix: preserve sandbox API error IDs by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3515">langchain-ai/langsmith-sdk#3515</a></li> <li>fix(js): avoid stored reasoning in OpenAI integration tests by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3519">langchain-ai/langsmith-sdk#3519</a></li> <li>fix(js): update vulnerable test dependencies by <a href="https://github.com/linted"><code>@linted</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3525">langchain-ai/langsmith-sdk#3525</a></li> <li>chore(deps): bump js-yaml from 3.15.1 to 4.3.1 in /js/internal/environment_tests/test-exports-metro in the npm_and_yarn group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3526">langchain-ai/langsmith-sdk#3526</a></li> <li>fix(js): patch vulnerable Vitest and Hono dependencies by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3516">langchain-ai/langsmith-sdk#3516</a></li> <li>release(js): 0.10.3 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3509">langchain-ai/langsmith-sdk#3509</a></li> <li>fix(js,py): tag guardrail/subagent structurally in openai-agents integration by <a href="https://github.com/ybathula707"><code>@ybathula707</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3523">langchain-ai/langsmith-sdk#3523</a></li> <li>feat(py,js): report the configured tracing sample rate on runs by <a href="https://github.com/thibautlehmann"><code>@thibautlehmann</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3492">langchain-ai/langsmith-sdk#3492</a></li> <li>fix(js): upgrade vulnerable js-yaml and sharp by <a href="https://github.com/linted"><code>@linted</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3535">langchain-ai/langsmith-sdk#3535</a></li> <li>fix(py): stop sandbox run() from waiting ~1s on the server's TCP close after exit by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3538">langchain-ai/langsmith-sdk#3538</a></li> <li>fix(py): carry the ADK tool call ids into traced messages [LSDK-509] by <a href="https://github.com/zduric-langchain"><code>@zduric-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3506">langchain-ai/langsmith-sdk#3506</a></li> <li>release(py): 0.12.5 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3540">langchain-ai/langsmith-sdk#3540</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/linted"><code>@linted</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3525">langchain-ai/langsmith-sdk#3525</a></li> <li><a href="https://github.com/zduric-langchain"><code>@zduric-langchain</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3506">langchain-ai/langsmith-sdk#3506</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.4...v0.12.5">https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.4...v0.12.5</a></p> <h2>v0.12.4</h2> <h2>What's Changed</h2> <ul> <li>fix(livekit): support agents 1.7 and 1.8 telemetry [Closes LSDK-506] by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3510">langchain-ai/langsmith-sdk#3510</a></li> <li>release(py): 0.12.4 by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3511">langchain-ai/langsmith-sdk#3511</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.3...v0.12.4">https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.3...v0.12.4</a></p> <h2>v0.12.3</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.10.2 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3495">langchain-ai/langsmith-sdk#3495</a></li> <li>test(py): benchmark compressed trace ingestion by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3497">langchain-ai/langsmith-sdk#3497</a></li> <li>fix(py): make the multipart body replayable across both retry layers by <a href="https://github.com/thibautlehmann"><code>@thibautlehmann</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3483">langchain-ai/langsmith-sdk#3483</a></li> <li>perf: avoid ThreadPoolExecutor churn in hybrid tracing [closes LSDK-213] by <a href="https://github.com/open-swe"><code>@open-swe</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3005">langchain-ai/langsmith-sdk#3005</a></li> <li>fix(docs): correct README code examples and update model references by <a href="https://github.com/thibautlehmann"><code>@thibautlehmann</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3503">langchain-ai/langsmith-sdk#3503</a></li> <li>feat: LangSmithSecret class for redacting sensitive function parameters by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3484">langchain-ai/langsmith-sdk#3484</a></li> <li>feat(sandbox): support proxy_config in update_sandbox (Python + JS) by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3430">langchain-ai/langsmith-sdk#3430</a></li> <li>release(py): 0.12.3 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3507">langchain-ai/langsmith-sdk#3507</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/22ac4a32401a69d21dfdf2f2d5c55c84b57363e6"><code>22ac4a3</code></a> release(py): 0.12.6 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3546">#3546</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/2d4b26ae4756af0ea09d1fc671a0eeaba4a434f2"><code>2d4b26a</code></a> fix(livekit): preserve system instructions with history (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3544">#3544</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/151ce8520755beacf220004effa743bdae3308dc"><code>151ce85</code></a> docs: add OpenWiki, with a weekly refresh workflow (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3541">#3541</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1c8f22d440f6ebd719e8480618ac50baa8a57bdd"><code>1c8f22d</code></a> release(js): 0.10.4 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3542">#3542</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/10affa44495a5cf97b7b4fe94d78f3bdb679c882"><code>10affa4</code></a> release(py): 0.12.5 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3540">#3540</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/dae91bb7709468e3a9ab17f9d1d23bbefb33b669"><code>dae91bb</code></a> fix(py): carry the ADK tool call ids into traced messages [LSDK-509] (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3506">#3506</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/9f62fa343df42df921c498eb26f3d7455a380b1e"><code>9f62fa3</code></a> fix(py): stop sandbox run() from waiting ~1s on the server's TCP close after ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/a5f13be5f6b1b0b027528b408ee0c97ec02dab40"><code>a5f13be</code></a> fix(js): upgrade vulnerable js-yaml and sharp (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3535">#3535</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/fe1aa82ba77a3e40fcf48a4268ed7544ac089aa6"><code>fe1aa82</code></a> feat(py,js): report the configured tracing sample rate on runs (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3492">#3492</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/4083bc191d12e79ae05a9da8efde91bcee60ab28"><code>4083bc1</code></a> fix(js,py): tag guardrail/subagent structurally in openai-agents integration ...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.1...v0.12.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.12.1&new-version=0.12.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 02:35:23 +00:00
dependabot[bot]	5e8888f7e6	chore(deps): bump filelock from 3.32.5 to 4.0.0 in /libs/partners/chroma (#40580 ) Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.5 to 4.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>4.0.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(soft-rw): replace the state mutex with a generation log by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/738">tox-dev/filelock#738</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.7...4.0.0">https://github.com/tox-dev/filelock/compare/3.32.7...4.0.0</a></p> <h2>3.32.7</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Fix final symlink test on musl by <a href="https://github.com/lprnmns"><code>@lprnmns</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/737">tox-dev/filelock#737</a></li> <li>📝 docs: say acquire() falls back to the lock's blocking attribute by <a href="https://github.com/hxperl"><code>@hxperl</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hxperl"><code>@hxperl</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/filelock/pull/733">tox-dev/filelock#733</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7">https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7</a></p> <h2>3.32.6</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix(lease): reject a duration no marker can carry by <a href="https://github.com/lprnmns"><code>@lprnmns</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/723">tox-dev/filelock#723</a></li> <li>🐛 fix(soft-rw): reject non-finite timing options by <a href="https://github.com/lprnmns"><code>@lprnmns</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/724">tox-dev/filelock#724</a></li> <li>fix: preserve exception notes when copying and pickling by <a href="https://github.com/jackwalkerlabs"><code>@jackwalkerlabs</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/729">tox-dev/filelock#729</a></li> <li>test(soft-rw): reuse existing test module by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/730">tox-dev/filelock#730</a></li> <li>fix: respect ACL write access when the owner write bit is absent by <a href="https://github.com/jackwalkerlabs"><code>@jackwalkerlabs</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/728">tox-dev/filelock#728</a></li> <li>Fix SoftReadWriteLock state lock timeout by <a href="https://github.com/Sohel2309"><code>@Sohel2309</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/726">tox-dev/filelock#726</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jackwalkerlabs"><code>@jackwalkerlabs</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/filelock/pull/729">tox-dev/filelock#729</a></li> <li><a href="https://github.com/Sohel2309"><code>@Sohel2309</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/filelock/pull/726">tox-dev/filelock#726</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.5...3.32.6">https://github.com/tox-dev/filelock/compare/3.32.5...3.32.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>4.0.0 (2026-09-17)</p> <hr /> <ul> <li>The :class:<code>~filelock.SoftReadWriteLock</code> on-disk protocol is a generation log under <code><path>.rw</code>, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover <code>.state</code>, <code>.write</code> and <code>.readers/</code> files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:<code>~filelock.StrictSoftFileLock</code>, so a runtime without <code>os.link</code> raises :class:<code>~filelock.SoftFileLockProtocolError</code> on acquire. Constructing a singleton again with a different <code>on_compromise</code>, or with <code>poll_interval</code> at or above <code>stale_threshold</code>, now raises :class:<code>ValueError</code>. :pr:<code>735</code></li> <li>:class:<code>~filelock.SoftReadWriteLock</code> exposes :attr:<code>~filelock.SoftReadWriteLock.generation</code> as a fencing token for the protected resource and reports a lost hold through <code>on_compromise</code> and :attr:<code>~filelock.SoftReadWriteLock.compromise</code>. :pr:<code>735</code></li> <li>:class:<code>~filelock.SoftReadWriteLock</code> no longer deadlocks when a holder dies on another host mid-transition, and <code>release()</code> no longer waits on a mutex a dead host left behind (:pr:<code>725</code>, :pr:<code>735</code>). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an <code>mtime</code> read against another host's. :pr:<code>735</code></li> </ul> <hr /> <p>3.32.7 (2026-09-16)</p> <hr /> <ul> <li>Validate final-symlink refusal by error number so the test works across libc implementations. :pr:<code>737</code></li> <li>Document that :meth:<code>~filelock.BaseFileLock.acquire</code> reads <code>blocking=None</code> as the lock's <code>blocking</code> attribute and raises :class:<code>~filelock.Timeout</code> after one attempt when <code>blocking=False</code>. :pr:<code>733</code></li> </ul> <hr /> <p>3.32.6 (2026-09-08)</p> <hr /> <ul> <li><code>SoftFileLease</code> and <code>AsyncSoftFileLease</code> now reject a boolean or non-finite <code>lease_duration</code>, which used to publish an owner record their own <code>owner</code> property reads back as malformed. :pr:<code>723</code></li> <li>Reject non-finite heartbeat, stale, and polling intervals in <code>SoftReadWriteLock</code> and <code>AsyncSoftReadWriteLock</code>, including cached singleton construction and overflow in the default stale threshold. :pr:<code>724</code></li> <li>Honor acquisition timeouts and <code>blocking=False</code> during <code>SoftReadWriteLock</code> state-mutex contention, including failed writer cleanup. Cross-host recovery of an abandoned <code>.state</code> marker remains unsupported. :pr:<code>726</code></li> <li>Allow acquiring existing lock files that grant write access through group permissions or an ACL even when their owner-write mode bit is unset. :pr:<code>728</code></li> <li>Preserve exception notes and custom attributes when copying or pickling <code>Timeout</code> and <code>SoftFileLockProtocolError</code>. :pr:<code>729</code></li> </ul> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/7e574366455fdf792dbfc8cc71e5e3c11f31d130"><code>7e57436</code></a> Release 4.0.0</li> <li><a href="https://github.com/tox-dev/filelock/commit/f9743288a2885220560d608e197e4020fd2ac61c"><code>f974328</code></a> 🐛 fix(soft-rw): replace the state mutex with a generation log (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/738">#738</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/20929f7d1439d5fa1df158fcac87b60815f5d422"><code>20929f7</code></a> Release 3.32.7</li> <li><a href="https://github.com/tox-dev/filelock/commit/35f07c48009c41faecfa7182939e5b7e1c78ae71"><code>35f07c4</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/736">#736</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/e860d3905d369b4753de5759d1cd70d0ca639d1f"><code>e860d39</code></a> 📝 docs: say acquire() falls back to the lock's blocking attribute (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/733">#733</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/c530efec2ee5012eeaa742c196c3623d478888ba"><code>c530efe</code></a> Fix final symlink test on musl (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/737">#737</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/4efd93e0482e8095a0b6949fb337206e7f67495d"><code>4efd93e</code></a> Release 3.32.6</li> <li><a href="https://github.com/tox-dev/filelock/commit/7b7b7a8b9b10acf826cca246441297468039b0c1"><code>7b7b7a8</code></a> Fix SoftReadWriteLock state lock timeout (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/726">#726</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/f2f7b8696426c518b6828ea10e755c0ba2a4ffe2"><code>f2f7b86</code></a> fix: respect ACL write access when the owner write bit is absent (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/728">#728</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/e947a694fb0da6676c4861c8bfef3650e5656153"><code>e947a69</code></a> test(soft-rw): reuse existing test module (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/730">#730</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tox-dev/py-filelock/compare/3.32.5...4.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=uv&previous-version=3.32.5&new-version=4.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 02:34:49 +00:00
John Kennedyandopen-swe[bot]	f5ee2b65f4	chore(chroma): bump Pygments security constraint (#40162 ) Chroma's development lock still selected Pygments 2.20.0, which is affected by a published security advisory. Raise the existing transitive dependency constraint to 2.21.0 and refresh the lockfile so development and CI environments select the patched release. The other recently reported Chroma lockfile dependencies were already updated on `master`, are no longer present in the current uv dependency graph, or do not yet have a compatible patched release. This contribution was prepared with an AI coding agent. Made by [Open SWE](https://openswe.vercel.app/agents/867a14a4-e0cb-53ec-bf1a-70edcb54e89e) Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>	2026-09-02 19:03:27 -07:00
dependabot[bot]	c50b358308	chore(deps): bump requests from 2.33.0 to 2.34.2 in /libs/partners/chroma (#40127 ) Bumps [requests](https://github.com/psf/requests) from 2.33.0 to 2.34.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>.</em></p> <blockquote> <h2>v2.34.2</h2> <h2>2.34.2 (2026-05-14)</h2> <ul> <li>Moved <code>headers</code> input type back to <code>Mapping</code> to avoid invariance issues with <code>MutableMapping</code> and inferred dict types. Users calling <code>Request.headers.update()</code> may need to narrow typing in their code. (<a href="https://redirect.github.com/psf/requests/issues/7441">#7441</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14">https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14</a></p> <h2>v2.34.1</h2> <h2>2.34.1 (2026-05-13)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Widened <code>json</code> input type from <code>dict</code> and <code>list</code> to <code>Mapping</code> and <code>Sequence</code>. (<a href="https://redirect.github.com/psf/requests/issues/7436">#7436</a>)</li> <li>Changed <code>headers</code> input type to MutableMapping and removed <code>None</code> from <code>Request.headers</code> typing to improve handling for users. (<a href="https://redirect.github.com/psf/requests/issues/7431">#7431</a>)</li> <li><code>Response.reason</code> moved from <code>str \| None</code> to <code>str</code> to improve handling for users. (<a href="https://redirect.github.com/psf/requests/issues/7437">#7437</a>)</li> <li>Fixed a bug where some bodies with custom <code>__getattr__</code> implementations weren't being properly detected as Iterables. (<a href="https://redirect.github.com/psf/requests/issues/7433">#7433</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/k223kim"><code>@k223kim</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7433">psf/requests#7433</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13">https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13</a></p> <h2>v2.34.0</h2> <h2>2.34.0 (2026-05-11)</h2> <p><strong>Announcements</strong></p> <ul> <li> <p>Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. <strong>We believe types are comprehensive but if you find issues, please report them to the <a href="https://redirect.github.com/psf/requests/issues/7271">pinned tracking issue</a>.</strong></p> <p>Special thanks to <a href="https://github.com/bastimeyer"><code>@bastimeyer</code></a>, <a href="https://github.com/cthoyt"><code>@cthoyt</code></a>, <a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a>, and <a href="https://github.com/srittau"><code>@srittau</code></a> for helping review and test the types ahead of the release. (<a href="https://redirect.github.com/psf/requests/issues/7272">#7272</a>)</p> </li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Digest Auth hashing algorithms have added <code>usedforsecurity=False</code> to clarify security considerations. (<a href="https://redirect.github.com/psf/requests/issues/7310">#7310</a>)</li> <li>Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (<a href="https://redirect.github.com/psf/requests/issues/7422">#7422</a>)</li> <li>Requests added support for Python 3.14t. (<a href="https://redirect.github.com/psf/requests/issues/7419">#7419</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li><code>Response.history</code> no longer contains a reference to itself, preventing accidental looping when traversing the history list. (<a href="https://redirect.github.com/psf/requests/issues/7328">#7328</a>)</li> <li>Requests no longer performs greedy matching on no_proxy domains. The</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>.</em></p> <blockquote> <h2>2.34.2 (2026-05-14)</h2> <ul> <li>Moved <code>headers</code> input type back to <code>Mapping</code> to avoid invariance issues with <code>MutableMapping</code> and inferred dict types. Users calling <code>Request.headers.update()</code> may need to narrow typing in their code. (<a href="https://redirect.github.com/psf/requests/issues/7441">#7441</a>)</li> </ul> <h2>2.34.1 (2026-05-13)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Widened <code>json</code> input type from <code>dict</code> and <code>list</code> to <code>Mapping</code> and <code>Sequence</code>. (<a href="https://redirect.github.com/psf/requests/issues/7436">#7436</a>)</li> <li>Changed <code>headers</code> input type to MutableMapping and removed <code>None</code> from <code>Request.headers</code> typing to improve handling for users. (<a href="https://redirect.github.com/psf/requests/issues/7431">#7431</a>)</li> <li><code>Response.reason</code> moved from <code>str \| None</code> to <code>str</code> to improve handling for users. (<a href="https://redirect.github.com/psf/requests/issues/7437">#7437</a>)</li> <li>Fixed a bug where some bodies with custom <code>__getattr__</code> implementations weren't being properly detected as Iterables. (<a href="https://redirect.github.com/psf/requests/issues/7433">#7433</a>)</li> </ul> <h2>2.34.0 (2026-05-11)</h2> <p><strong>Announcements</strong></p> <ul> <li> <p>Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.</p> <p>Special thanks to <a href="https://github.com/bastimeyer"><code>@bastimeyer</code></a>, <a href="https://github.com/cthoyt"><code>@cthoyt</code></a>, <a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a>, and <a href="https://github.com/srittau"><code>@srittau</code></a> for helping review and test the types ahead of the release. (<a href="https://redirect.github.com/psf/requests/issues/7272">#7272</a>)</p> </li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Digest Auth hashing algorithms have added <code>usedforsecurity=False</code> to clarify security considerations. (<a href="https://redirect.github.com/psf/requests/issues/7310">#7310</a>)</li> <li>Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (<a href="https://redirect.github.com/psf/requests/issues/7422">#7422</a>)</li> <li>Requests added support for Python 3.14t. (<a href="https://redirect.github.com/psf/requests/issues/7419">#7419</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li><code>Response.history</code> no longer contains a reference to itself, preventing accidental looping when traversing the history list. (<a href="https://redirect.github.com/psf/requests/issues/7328">#7328</a>)</li> <li>Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (<a href="https://redirect.github.com/psf/requests/issues/7427">#7427</a>)</li> <li>Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (<a href="https://redirect.github.com/psf/requests/issues/7315">#7315</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/6e83187b8feb273ed4c6cdab5efd8d54901dfab3"><code>6e83187</code></a> v2.34.2</li> <li><a href="https://github.com/psf/requests/commit/84d10f0be83e8f6aeca8a05230c52216431c4d0b"><code>84d10f0</code></a> Move Request.headers back to Mapping (<a href="https://redirect.github.com/psf/requests/issues/7441">#7441</a>)</li> <li><a href="https://github.com/psf/requests/commit/b7b549b54571d03950b16afd2d01bc6ff0348224"><code>b7b549b</code></a> v2.34.1</li> <li><a href="https://github.com/psf/requests/commit/e511bc72777a94c45d004e010c597925092e1efe"><code>e511bc7</code></a> Fix mutability issues with headers input types (<a href="https://redirect.github.com/psf/requests/issues/7431">#7431</a>)</li> <li><a href="https://github.com/psf/requests/commit/5691f596134c2feb121e595c77a0178921fcce61"><code>5691f59</code></a> Update JsonType containers to read-based collections (<a href="https://redirect.github.com/psf/requests/issues/7436">#7436</a>)</li> <li><a href="https://github.com/psf/requests/commit/2144213c307691710c9d665700860fc4993c3035"><code>2144213</code></a> Constrain Response.reason to str (<a href="https://redirect.github.com/psf/requests/issues/7437">#7437</a>)</li> <li><a href="https://github.com/psf/requests/commit/6404f345e562d962abe6700a1c357ec1e7e18232"><code>6404f34</code></a> Fix <code>prepare_body</code> stream detection for <code>__getattr__</code>-based file wrappers (<a href="https://redirect.github.com/psf/requests/issues/7">#7</a>...</li> <li><a href="https://github.com/psf/requests/commit/0b401c76b6e80a4eecf3c690085b2553f6e261ca"><code>0b401c7</code></a> v2.34.0</li> <li><a href="https://github.com/psf/requests/commit/86b378d3f60f828daa13ca50aa82e287ff7b66b4"><code>86b378d</code></a> Align Session.get parameters with requests.get (<a href="https://redirect.github.com/psf/requests/issues/7429">#7429</a>)</li> <li><a href="https://github.com/psf/requests/commit/a4f9a5999bdb9bf2d6e7c8aa973b28cacb17134f"><code>a4f9a59</code></a> Port bpo-39057 to Requests (<a href="https://redirect.github.com/psf/requests/issues/7427">#7427</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.33.0...v2.34.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.33.0&new-version=2.34.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:03:48 -07:00
dependabot[bot]	6935f7a4b7	chore(deps): bump filelock from 3.20.3 to 3.32.5 in /libs/partners/chroma (#40122 ) Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.20.3 to 3.32.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/py-filelock/releases">filelock's releases</a>.</em></p> <blockquote> <h2>3.32.5</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🧪 test(fork): report where a stalled fork stops by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/715">tox-dev/filelock#715</a></li> <li>📝 docs: say that mode is read-only in the thread-local section by <a href="https://github.com/Gares95"><code>@Gares95</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/716">tox-dev/filelock#716</a></li> <li>🐛 fix(lease): clear token after failed acquire by <a href="https://github.com/lprnmns"><code>@lprnmns</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/721">tox-dev/filelock#721</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lprnmns"><code>@lprnmns</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/filelock/pull/721">tox-dev/filelock#721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.4...3.32.5">https://github.com/tox-dev/filelock/compare/3.32.4...3.32.5</a></p> <h2>3.32.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🐛 fix: retry transient denials on open and claim read by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/705">tox-dev/filelock#705</a></li> <li>🧪 test: deflake six scheduled-run failures by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/704">tox-dev/filelock#704</a></li> <li>🧪 test: cover a reclaimed private record for real by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/706">tox-dev/filelock#706</a></li> <li>🧪 test(fork): fork once the event loop has closed by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/714">tox-dev/filelock#714</a></li> <li>🔧 chore: batch dependency updates weekly on Tuesday by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/713">tox-dev/filelock#713</a></li> <li>escape the hostname every marker publishes by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/709">tox-dev/filelock#709</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.3...3.32.4">https://github.com/tox-dev/filelock/compare/3.32.3...3.32.4</a></p> <h2>3.32.3</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>🧪 test(strict): deflake close-fault injections on graalpy by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/697">tox-dev/filelock#697</a></li> <li>📄 docs: publish llms.txt from the docs build by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/700">tox-dev/filelock#700</a></li> <li>🐛 fix(fork): survive audit events during interpreter shutdown by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/703">tox-dev/filelock#703</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.2...3.32.3">https://github.com/tox-dev/filelock/compare/3.32.2...3.32.3</a></p> <h2>3.32.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Fix test failures on NetBSD (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/689">#689</a>) by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/693">tox-dev/filelock#693</a></li> <li>🧪 test(soft-rw): deflake writer phase-2 peer-marker test by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/694">tox-dev/filelock#694</a></li> <li>hand back the claim when a heartbeat thread fails to start by <a href="https://github.com/dxbjavid"><code>@dxbjavid</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/691">tox-dev/filelock#691</a></li> <li>🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/filelock/pull/695">tox-dev/filelock#695</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/filelock/compare/3.32.1...3.32.2">https://github.com/tox-dev/filelock/compare/3.32.1...3.32.2</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst">filelock's changelog</a>.</em></p> <blockquote> <p>########### Changelog ###########</p> <p>.. towncrier-draft-entries:: Unreleased</p> <p>.. towncrier release notes start</p> <hr /> <p>3.32.5 (2026-08-31)</p> <hr /> <ul> <li><code>SoftFileLease.token</code> and <code>AsyncSoftFileLease.token</code> now read <code>None</code> after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:<code>721</code></li> <li>Document that <code>mode</code> has no setter: unlike <code>poll_interval</code>, <code>timeout</code>, <code>blocking</code> and <code>lifetime</code>, it is fixed at construction and <code>lock.mode = ...</code> raises <code>AttributeError</code>. :pr:<code>716</code></li> </ul> <hr /> <p>3.32.4 (2026-08-23)</p> <hr /> <ul> <li><code>StrictSoftFileLock</code> always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:<code>705</code></li> <li><code>WindowsFileLock</code> waits out a transient <code>STATUS_ACCESS_DENIED</code> from <code>NtCreateFile</code> for up to half a second before raising <code>PermissionError</code>, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:<code>705</code></li> <li>Every lock class now escapes the hostname it publishes, so a host whose <code>socket.gethostname()</code> carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held <code>SoftReadWriteLock</code> read slot to a peer and could not take a write slot or a <code>StrictSoftFileLock</code> at all. :pr:<code>709</code></li> </ul> <hr /> <p>3.32.3 (2026-08-13)</p> <hr /> <ul> <li>The fork-safety audit hook no longer prints <code>Exception ignored in audit hook</code> with a <code>TypeError</code> when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:<code>701</code></li> </ul> <hr /> <p>3.32.2 (2026-07-29)</p> <hr /> <ul> <li>A <code>SoftReadWriteLock</code> or <code>SoftFileLease</code> acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:<code>691</code></li> </ul> <hr /> <p>3.32.1 (2026-07-26)</p> <hr /> <ul> <li>Canceling an <code>AsyncSoftReadWriteLock</code> acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:<code>686</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/filelock/commit/1585dfef9355a5c77d4a9498cc34d3a98056fdb9"><code>1585dfe</code></a> Release 3.32.5</li> <li><a href="https://github.com/tox-dev/filelock/commit/00177c32686e60bc5ef9875b5841867ea08d4558"><code>00177c3</code></a> 🐛 fix(lease): clear token after failed acquire (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/721">#721</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/5aeb9b6a5fe1e86dcb1c44a927aefffd607b17b0"><code>5aeb9b6</code></a> 📝 docs: say that mode is read-only in the thread-local section (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/716">#716</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/2634dd1dcc597b319770df027491f16d07662952"><code>2634dd1</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/720">#720</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/37dccf0276f6db1520db9e3482fdf0446c14276e"><code>37dccf0</code></a> 🧪 test(fork): report where a stalled fork stops (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/715">#715</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/cb493d6684ed5d2f923384633c86fef12e29bce2"><code>cb493d6</code></a> Release 3.32.4</li> <li><a href="https://github.com/tox-dev/filelock/commit/fe07a11a7133ddd104322eb79d3c59f966b4ba15"><code>fe07a11</code></a> escape the hostname every marker publishes (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/709">#709</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/232732f49ed9d230802f527ad60b5d5ad1202a56"><code>232732f</code></a> 🔧 chore: batch dependency updates weekly on Tuesday (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/713">#713</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/2966eb51431ff8ac19eb2bec4e0b67c328437c48"><code>2966eb5</code></a> 🧪 test(fork): fork once the event loop has closed (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/714">#714</a>)</li> <li><a href="https://github.com/tox-dev/filelock/commit/61511ebc1cc5d40b28f8584f1078e63f2d63fb02"><code>61511eb</code></a> build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (<a href="https://redirect.github.com/tox-dev/py-filelock/issues/712">#712</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tox-dev/py-filelock/compare/3.20.3...3.32.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=uv&previous-version=3.20.3&new-version=3.32.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:03:22 -07:00
dependabot[bot]	3f6bfe80a6	chore(deps): bump langsmith from 0.10.16 to 0.12.1 in /libs/partners/chroma (#40123 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.10.16 to 0.12.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.12.1</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.10.0 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3474">langchain-ai/langsmith-sdk#3474</a></li> <li>fix(py,js): drain the anonymizer walk queue in O(1) [LSDK-412] by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3475">langchain-ai/langsmith-sdk#3475</a></li> <li>release(py): 0.12.1 by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3478">langchain-ai/langsmith-sdk#3478</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.0...v0.12.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.12.0...v0.12.1</a></p> <h2>v0.12.0</h2> <h2>What's Changed</h2> <ul> <li>ci: enable CodSpeed flame graphs and pin the benchmarks to one CPU by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3449">langchain-ai/langsmith-sdk#3449</a></li> <li>fix(py,js)!: make trace sampling deterministic by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3183">langchain-ai/langsmith-sdk#3183</a></li> <li>fix(py): suppress import-untyped on the optional langsmith_pyo3 import by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3462">langchain-ai/langsmith-sdk#3462</a></li> <li>chore(py)!: swtich to httpx2 dependency while keeping httpx as a fallback by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3406">langchain-ai/langsmith-sdk#3406</a></li> <li>fix!: fail-closed when per-function anonymization callables fail by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3328">langchain-ai/langsmith-sdk#3328</a></li> <li>fix(py): compress replica writes that carry their own credentials by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3448">langchain-ai/langsmith-sdk#3448</a></li> <li>perf(py): serialize identical replicas once, into one frame by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3450">langchain-ai/langsmith-sdk#3450</a></li> <li>release(py): 0.12.0 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3472">langchain-ai/langsmith-sdk#3472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.2...v0.12.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.2...v0.12.0</a></p> <h2>v0.11.2</h2> <h2>What's Changed</h2> <ul> <li>fix: exclude password and email env vars from run metadata by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3417">langchain-ai/langsmith-sdk#3417</a></li> <li>feat(js): Avoid redundantly sending inputs up in patch by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3425">langchain-ai/langsmith-sdk#3425</a></li> <li>release(js): 0.9.0 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3426">langchain-ai/langsmith-sdk#3426</a></li> <li>test(py): continuous benchmarking with CodSpeed by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3420">langchain-ai/langsmith-sdk#3420</a></li> <li>fix: point migration guide links at their new per-area pages by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3421">langchain-ai/langsmith-sdk#3421</a></li> <li>fix(js): send langsmith-js User-Agent on generated client calls by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3411">langchain-ai/langsmith-sdk#3411</a></li> <li>test(py): pin multipart ingest retry matrix and drop warning by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3377">langchain-ai/langsmith-sdk#3377</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3407">langchain-ai/langsmith-sdk#3407</a></li> <li>fix(py): handle 64bit+ integers without loss of precision by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3409">langchain-ai/langsmith-sdk#3409</a></li> <li>fix(py): exclude replica config from the serialized run body by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3442">langchain-ai/langsmith-sdk#3442</a></li> <li>fix(py,js): consistent (non-v7) UUID rewriting for replicas by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3445">langchain-ai/langsmith-sdk#3445</a></li> <li>ci: report Python benchmarks to Datadog Test Optimization by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3408">langchain-ai/langsmith-sdk#3408</a></li> <li>fix(js): close the argument-shape bypass in Anthropic MCP redaction by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3378">langchain-ai/langsmith-sdk#3378</a></li> <li>feat(livekit): align trace audio with the span timeline by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3452">langchain-ai/langsmith-sdk#3452</a></li> <li>release(py): 0.11.2 by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3457">langchain-ai/langsmith-sdk#3457</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.1...v0.11.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.1...v0.11.2</a></p> <h2>v0.11.1</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.8.11 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3401">langchain-ai/langsmith-sdk#3401</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3340">langchain-ai/langsmith-sdk#3340</a></li> <li>fix(sandbox): retry transient WebSocket upgrades in Python and JS by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3388">langchain-ai/langsmith-sdk#3388</a></li> <li>fix: report incomplete pytest suites accurately by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3398">langchain-ai/langsmith-sdk#3398</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/11093852f2fe7b4fc63b88565da37d6cb796bcda"><code>1109385</code></a> release(py): 0.12.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3478">#3478</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/73ac3029c90a8d64aadb71848db87f83acaf97a5"><code>73ac302</code></a> fix(py,js): drain the anonymizer walk queue in O(1) [LSDK-412] (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3475">#3475</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/11f7208efcf2484d020ecd6d6ba4f4d6f675a606"><code>11f7208</code></a> release(js): 0.10.0 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3474">#3474</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/a95cddfe4f406bdef6d92213e7ff30bb7c980d85"><code>a95cddf</code></a> release(py): 0.12.0 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3472">#3472</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/4ddfa249823d102183054c750fc4ba4a9a356899"><code>4ddfa24</code></a> perf(py): serialize identical replicas once, into one frame (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3450">#3450</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/983e00acc1c7a5f944fe530db8d0aa13063a2392"><code>983e00a</code></a> fix(py): compress replica writes that carry their own credentials (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3448">#3448</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/3239181c87dbdb5815746534cd9082227a443595"><code>3239181</code></a> fix!: fail-closed when per-function anonymization callables fail (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3328">#3328</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/0d3256709ee31a73647cee4846256ecf0be38932"><code>0d32567</code></a> chore(py)!: swtich to httpx2 dependency while keeping httpx as a fallback (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3">#3</a>...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1b64f94fe226f07fcacc81ea8a3e7486c1fc5c14"><code>1b64f94</code></a> fix(py): suppress import-untyped on the optional langsmith_pyo3 import (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3462">#3462</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/e5360c9833cfad5dc20beeef5f42dcd7bd1b4116"><code>e5360c9</code></a> fix(py,js)!: make trace sampling deterministic (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3183">#3183</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.16...v0.12.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.10.16&new-version=0.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:03:13 -07:00
dependabot[bot]	dca0ae4913	chore(deps): bump protobuf from 6.33.5 to 6.33.6 in /libs/partners/chroma (#40124 ) Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.33.5 to 6.33.6. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/protocolbuffers/protobuf/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=protobuf&package-manager=uv&previous-version=6.33.5&new-version=6.33.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:03:05 -07:00
dependabot[bot]	1eebed2c37	chore(deps): bump orjson from 3.11.6 to 3.12.0 in /libs/partners/chroma (#40125 ) Bumps [orjson](https://github.com/ijl/orjson) from 3.11.6 to 3.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/releases">orjson's releases</a>.</em></p> <blockquote> <h2>3.12.0</h2> <h3>Changed</h3> <ul> <li>Serialization implementation substantially rewritten.</li> <li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later, <code>manylinux_2_39</code> (2024) is targeted instead of <code>manylinux_2_17</code> (2012).</li> <li>No longer publish PyPI wheels for ppc64le and s390x.</li> </ul> <h2>3.11.9</h2> <h3>Changed</h3> <ul> <li>Build now depends on Rust 1.95 or later instead of 1.89.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix building on Rust 1.95.</li> </ul> <h2>3.11.8</h2> <h3>Changed</h3> <ul> <li>Build and compatibility improvements.</li> </ul> <h2>3.11.7</h2> <h3>Changed</h3> <ul> <li>Use a faster library to serialize <code>float</code>. Users with byte-exact regression tests should note positive exponents are now written using a <code>+</code>, e.g., <code>1.2e+30</code> instead of <code>1.2e30</code>. Both formats are spec-compliant.</li> <li>ABI compatibility with CPython 3.15 alpha 5 free-threading.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md">orjson's changelog</a>.</em></p> <blockquote> <h2>3.12.0 - 2026-08-14</h2> <h3>Changed</h3> <ul> <li>Serialization implementation substantially rewritten.</li> <li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later, <code>manylinux_2_39</code> (2024) is targeted instead of <code>manylinux_2_17</code> (2012).</li> <li>No longer publish PyPI wheels for ppc64le and s390x.</li> </ul> <h2>3.11.9 - 2026-05-06</h2> <h3>Changed</h3> <ul> <li>Build now depends on Rust 1.95 or later instead of 1.89.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix building on Rust 1.95.</li> </ul> <h2>3.11.8 - 2026-03-31</h2> <h3>Changed</h3> <ul> <li>Build and compatibility improvements.</li> </ul> <h2>3.11.7 - 2026-02-02</h2> <h3>Changed</h3> <ul> <li>Use a faster library to serialize <code>float</code>. Users with byte-exact regression tests should note positive exponents are now written using a <code>+</code>, e.g., <code>1.2e+30</code> instead of <code>1.2e30</code>. Both formats are spec-compliant.</li> <li>ABI compatibility with CPython 3.15 alpha 5 free-threading.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ijl/orjson/commit/6737895a1a4e3e26df0569a40147893a786f9a58"><code>6737895</code></a> 3.12.0</li> <li><a href="https://github.com/ijl/orjson/commit/c2a6e8ff7b898635fb68a85bd5a62df1edf61cfc"><code>c2a6e8f</code></a> JsonWriter, iterators</li> <li><a href="https://github.com/ijl/orjson/commit/6a2d7a7d66dc3c5698625a7b334c40db459e46ae"><code>6a2d7a7</code></a> yyjson 1ea2fb0</li> <li><a href="https://github.com/ijl/orjson/commit/97bf170d9726e91c891f35eae4892801520b9dce"><code>97bf170</code></a> build update</li> <li><a href="https://github.com/ijl/orjson/commit/705515d77b28429d0b7c30c3d781abe52e8a1e5a"><code>705515d</code></a> 3.11.9</li> <li><a href="https://github.com/ijl/orjson/commit/d19055d5bab432f98d53b71606a9c6c23fb21bf6"><code>d19055d</code></a> build update</li> <li><a href="https://github.com/ijl/orjson/commit/77e2d96c3febe099cde2447856fe2523d68c71b0"><code>77e2d96</code></a> MSRV 1.95, remove compiler feature detection</li> <li><a href="https://github.com/ijl/orjson/commit/5cbb3d0398a2f42de51210270286fecd798c5d78"><code>5cbb3d0</code></a> 3.11.8</li> <li><a href="https://github.com/ijl/orjson/commit/4195d7f263e33076295b75efdcbaf6a55af8674e"><code>4195d7f</code></a> writer::half</li> <li><a href="https://github.com/ijl/orjson/commit/d00641b69410728a735f0855eb1c2843b0a5819b"><code>d00641b</code></a> writer::uuid</li> <li>Additional commits viewable in <a href="https://github.com/ijl/orjson/compare/3.11.6...3.12.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=orjson&package-manager=uv&previous-version=3.11.6&new-version=3.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:02:59 -07:00
dependabot[bot]	c583b5b043	chore(deps): bump python-dotenv from 1.2.2 to 1.2.3 in /libs/partners/chroma (#40126 ) Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.2.2 to 1.2.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theskumar/python-dotenv/releases">python-dotenv's releases</a>.</em></p> <blockquote> <h2>v1.2.3</h2> <h3>Fixed</h3> <ul> <li>Strip a leading UTF-8 BOM from <code>.env</code> file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [<a href="https://github.com/h1whelan"><code>@h1whelan</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/640">#640</a></li> <li><code>set_key</code> now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [<a href="https://github.com/dchaudhari7177"><code>@dchaudhari7177</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/680">#680</a></li> <li><code>dotenv run</code> now prints a friendly error instead of a traceback when no command is given by [<a href="https://github.com/bbc2"><code>@bbc2</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/606">#606</a></li> <li>Cache the parsed result for empty <code>.env</code> files so repeated <code>dotenv_values</code>/<code>load_dotenv</code> calls no longer re-read the file by [<a href="https://github.com/ReinerBRO"><code>@ReinerBRO</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/638">#638</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md">python-dotenv's changelog</a>.</em></p> <blockquote> <h2>[1.2.3] - 2026-08-16</h2> <h3>Fixed</h3> <ul> <li>Strip a leading UTF-8 BOM from <code>.env</code> file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [<a href="https://github.com/h1whelan"><code>@h1whelan</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/640">#640</a></li> <li><code>set_key</code> now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [<a href="https://github.com/dchaudhari7177"><code>@dchaudhari7177</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/680">#680</a></li> <li><code>dotenv run</code> now prints a friendly error instead of a traceback when no command is given by [<a href="https://github.com/bbc2"><code>@bbc2</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/606">#606</a></li> <li>Cache the parsed result for empty <code>.env</code> files so repeated <code>dotenv_values</code>/<code>load_dotenv</code> calls no longer re-read the file by [<a href="https://github.com/ReinerBRO"><code>@ReinerBRO</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/638">#638</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/theskumar/python-dotenv/commit/49515afee2d50c33cad9419b3800b3a0dc93fc59"><code>49515af</code></a> Bump version: 1.2.2 → 1.2.3</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/8ac846ff2760b65470e769d7eed33e540f0934e1"><code>8ac846f</code></a> chore: add release runbook (RELEASING.md) and make release target</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/bb31c944fb4b40e8dea59587f525840c38326166"><code>bb31c94</code></a> docs: add 1.2.3 release notes (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/606">#606</a>, <a href="https://redirect.github.com/theskumar/python-dotenv/issues/638">#638</a>, <a href="https://redirect.github.com/theskumar/python-dotenv/issues/680">#680</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/f7b18d9c72d1abcc2ad4023424b84f5bee30d266"><code>f7b18d9</code></a> fix: round-trip backslashes through set_key (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/680">#680</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/751f8c148222e58aa173c83c4e5e6cfccb2cc124"><code>751f8c1</code></a> ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/f1937b68f338d7ebd7754da377ca08b2f0df8dbb"><code>f1937b6</code></a> chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/45b93720dd5e9e127d0be3971a04855d34e464d8"><code>45b9372</code></a> chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/653">#653</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/72896e9244d2a1ff8d5e1934d3df8a35c813799a"><code>72896e9</code></a> docs: fix broken mkdocs link in CONTRIBUTING.md (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/636">#636</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/72754a16a4743e4c92edf87ce59ba0e4ff78758d"><code>72754a1</code></a> ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/078325e92558330e9addc661b789c7b6123fa73c"><code>078325e</code></a> ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...</li> <li>Additional commits viewable in <a href="https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-dotenv&package-manager=uv&previous-version=1.2.2&new-version=1.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:02:55 -07:00
dependabot[bot]	b0d66d19d9	chore(deps): bump idna from 3.15 to 3.19 in /libs/partners/chroma (#40128 ) Bumps [idna](https://github.com/kjd/idna) from 3.15 to 3.19. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/releases">idna's releases</a>.</em></p> <blockquote> <h2>v3.19</h2> <ul> <li>Restore the <code>std3_rules</code> option, which had no effect since changes to UTS <a href="https://redirect.github.com/kjd/idna/issues/46">#46</a> processing in Unicode 16. Note that <code>uts46_remap()</code> defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.</li> <li>Performance improvements to UTS <a href="https://redirect.github.com/kjd/idna/issues/46">#46</a> mapping, particularly for ASCII-only domains.</li> <li>Test on free-threaded CPython with the GIL disabled and document thread safety.</li> <li>Expose the Unicode version of the generated tables as <code>idna.unicode_version</code>, and show it in <code>idna --version</code>.</li> <li>Add <code>code</code>, <code>text</code>, <code>codepoint</code> and <code>position</code> attributes to <code>IDNAError</code> so that the failed rule and the offending character can be identified without parsing the exception message.</li> <li>The deprecated <code>transitional</code> argument to <code>encode()</code> and <code>uts46_remap()</code> is now completely ignored, and gives a deprecation warning for the latter.</li> <li>Reject A-labels that are not the canonical Punycode encoding of their U-label.</li> <li>Fix CONTEXTJ violations raising <code>IDNAError</code> instead of <code>InvalidCodepointContext</code>.</li> <li>Consistently raise <code>IDNAError</code> for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.</li> <li>Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.</li> <li>Various code quality and tooling improvements.</li> </ul> <p>Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.</p> <h2>v3.18</h2> <p>No release notes provided.</p> <h2>v3.17</h2> <p>No release notes provided.</p> <h2>v3.16</h2> <p>No release notes provided.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.19 (2026-08-18)</h2> <ul> <li>Restore the <code>std3_rules</code> option, which had no effect since changes to UTS <a href="https://redirect.github.com/kjd/idna/issues/46">#46</a> processing in Unicode 16. Note that <code>uts46_remap()</code> defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.</li> <li>Performance improvements to UTS <a href="https://redirect.github.com/kjd/idna/issues/46">#46</a> mapping, particularly for ASCII-only domains.</li> <li>Test on free-threaded CPython with the GIL disabled and document thread safety.</li> <li>Expose the Unicode version of the generated tables as <code>idna.unicode_version</code>, and show it in <code>idna --version</code>.</li> <li>Add <code>code</code>, <code>text</code>, <code>codepoint</code> and <code>position</code> attributes to <code>IDNAError</code> so that the failed rule and the offending character can be identified without parsing the exception message.</li> <li>The deprecated <code>transitional</code> argument to <code>encode()</code> and <code>uts46_remap()</code> is now completely ignored, and gives a deprecation warning for the latter.</li> <li>Reject A-labels that are not the canonical Punycode encoding of their U-label.</li> <li>Fix CONTEXTJ violations raising <code>IDNAError</code> instead of <code>InvalidCodepointContext</code>.</li> <li>Consistently raise <code>IDNAError</code> for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.</li> <li>Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.</li> <li>Various code quality and tooling improvements.</li> </ul> <p>Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.</p> <h2>3.18 (2026-06-02)</h2> <ul> <li>When decoding a domain, add a <code>display</code> argument that will pass through invalid labels rather than raising an exception.</li> </ul> <h2>3.17 (2026-05-28)</h2> <ul> <li>Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.</li> <li>Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.</li> </ul> <h2>3.16 (2026-05-22)</h2> <ul> <li>Add a command-line interface (<code>python -m idna</code>, also available as the <code>idna</code> script). Encodes or decodes one or more domains supplied</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/03a9a11dd8aecd4fea742cabe20f4d3d9ed82abb"><code>03a9a11</code></a> Release 3.19</li> <li><a href="https://github.com/kjd/idna/commit/2d2a7ef0c59210a48407b3dde6d884933cecf093"><code>2d2a7ef</code></a> Pre-release 3.19rc0</li> <li><a href="https://github.com/kjd/idna/commit/5cce1308d148019c5fa0febceafa13e99cdacfe7"><code>5cce130</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/268">#268</a> from kjd/fix-std3-regex-alert</li> <li><a href="https://github.com/kjd/idna/commit/3914b75f3e4cbc11e59f92eeecdb16d10871e57f"><code>3914b75</code></a> Split the STD3 disallowed-character range so uppercase is explicit</li> <li><a href="https://github.com/kjd/idna/commit/ce9fd98ac4073866db276e93834b259f2a5a4ac4"><code>ce9fd98</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/267">#267</a> from kjd/housekeeping</li> <li><a href="https://github.com/kjd/idna/commit/809240c3cc9358c9c9c79b2d12ffe39e75ccfb0f"><code>809240c</code></a> Fail CI when the license copyright year is behind the current year</li> <li><a href="https://github.com/kjd/idna/commit/d9e16c523d7d25dcc14100fa80f3e303404e09be"><code>d9e16c5</code></a> Consolidate test fixtures, prune stale gitignore entries, and fix doc typos</li> <li><a href="https://github.com/kjd/idna/commit/ef30feeed3a758e96286fdab0315a551f7f5e7d6"><code>ef30fee</code></a> Remove dead code and pare back superfluous comments</li> <li><a href="https://github.com/kjd/idna/commit/b907913f854d26cc714f721c6c2cb626d41ac468"><code>b907913</code></a> Tighten the version support and Unicode notes in the README</li> <li><a href="https://github.com/kjd/idna/commit/6204cbe343ef438df7c58bc80b94d0f960991d90"><code>6204cbe</code></a> Ignore local build artifacts and stop packaging stray tooling config</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.15...v3.19">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=idna&package-manager=uv&previous-version=3.15&new-version=3.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-02 01:02:47 -07:00
dependabot[bot]	759c5e348a	chore: bump langsmith from 0.10.6 to 0.10.16 in /libs/partners/chroma (#39280 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.10.6 to 0.10.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.10.16</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.8.9 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3316">langchain-ai/langsmith-sdk#3316</a></li> <li>fix(python): mask metadata after the runtime env merge and via the anonymizer by <a href="https://github.com/vladislav-nechakhin"><code>@vladislav-nechakhin</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3313">langchain-ai/langsmith-sdk#3313</a></li> <li>fix(js): mask metadata after the runtime env merge and via the anonymizer by <a href="https://github.com/vladislav-nechakhin"><code>@vladislav-nechakhin</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3314">langchain-ai/langsmith-sdk#3314</a></li> <li>chore(deps-dev): bump types-requests from 2.33.0.20260518 to 2.33.0.20260712 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3325">langchain-ai/langsmith-sdk#3325</a></li> <li>chore(deps-dev): bump types-pyyaml from 6.0.12.20260518 to 6.0.12.20260724 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3324">langchain-ai/langsmith-sdk#3324</a></li> <li>chore(deps): bump the actions-major group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3321">langchain-ai/langsmith-sdk#3321</a></li> <li>chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3320">langchain-ai/langsmith-sdk#3320</a></li> <li>chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3330">langchain-ai/langsmith-sdk#3330</a></li> <li>fix(js,py): stamp ls_agent_type on wrap_openai LLM runs by <a href="https://github.com/ybathula707"><code>@ybathula707</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3317">langchain-ai/langsmith-sdk#3317</a></li> <li>chore(deps): bump aiohttp from 3.14.1 to 3.14.3 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3329">langchain-ai/langsmith-sdk#3329</a></li> <li>chore(deps-dev): bump the py-major group in /python with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3323">langchain-ai/langsmith-sdk#3323</a></li> <li>chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3331">langchain-ai/langsmith-sdk#3331</a></li> <li>fix(js,py): preserve user-supplied ls_agent_type in openai-agents-sdk integration by <a href="https://github.com/ybathula707"><code>@ybathula707</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3318">langchain-ai/langsmith-sdk#3318</a></li> <li>fix(js): inherit parent's ls_agent_type in Vercel _getLsAgentType helper by <a href="https://github.com/ybathula707"><code>@ybathula707</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3319">langchain-ai/langsmith-sdk#3319</a></li> <li>chore(deps): bump the py-minor-and-patch group across 1 directory with 25 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3322">langchain-ai/langsmith-sdk#3322</a></li> <li>fix(profiles): resolve the OAuth token endpoint from deployment metadata by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3333">langchain-ai/langsmith-sdk#3333</a></li> <li>fix: avoid resetting compression threads by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3332">langchain-ai/langsmith-sdk#3332</a></li> <li>docs(sandbox): fix invalid sizing example in JS sandbox README by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3335">langchain-ai/langsmith-sdk#3335</a></li> <li>test(claude-agent-sdk): run subagent in foreground so trace nests correctly by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3339">langchain-ai/langsmith-sdk#3339</a></li> <li>release(py): 0.10.16 by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3337">langchain-ai/langsmith-sdk#3337</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/vladislav-nechakhin"><code>@vladislav-nechakhin</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3313">langchain-ai/langsmith-sdk#3313</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.15...v0.10.16">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.15...v0.10.16</a></p> <h2>v0.10.15</h2> <h2>What's Changed</h2> <ul> <li>fix(python): apply the caller-supplied session's config to v2 endpoints by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3304">langchain-ai/langsmith-sdk#3304</a></li> <li>chore: Use a common function for backend detection by <a href="https://github.com/emil-lc"><code>@emil-lc</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3307">langchain-ai/langsmith-sdk#3307</a></li> <li>fix: prioritize API key over OAuth profile auth [closes LSDK-414] by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3295">langchain-ai/langsmith-sdk#3295</a></li> <li>fix(js): apply caller-supplied headers to the v2 endpoints by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3305">langchain-ai/langsmith-sdk#3305</a></li> <li>chore: deprecate legacy SmithDB-migration SDK methods by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3299">langchain-ai/langsmith-sdk#3299</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3310">langchain-ai/langsmith-sdk#3310</a></li> <li>fix: stop supported APIs from emitting nested deprecation warnings by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3308">langchain-ai/langsmith-sdk#3308</a></li> <li>chore: deprecate the run-sharing SDK methods by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3312">langchain-ai/langsmith-sdk#3312</a></li> <li>release(py): 0.10.15 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3315">langchain-ai/langsmith-sdk#3315</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.14...v0.10.15">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.14...v0.10.15</a></p> <h2>v0.10.14</h2> <h2>What's Changed</h2> <ul> <li>fix(sandbox): count an acknowledged reattachment as progress by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3301">langchain-ai/langsmith-sdk#3301</a></li> <li>feat(python): trace raw Gemini Live sessions by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3291">langchain-ai/langsmith-sdk#3291</a></li> <li>release(py): 0.10.14 by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3302">langchain-ai/langsmith-sdk#3302</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/3f9fe09d8e0698d65aa8bb63ac3316dfcb2ca947"><code>3f9fe09</code></a> release(py): 0.10.16 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3337">#3337</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8c5d807dca1f25673bc95492ed9a04f3a6850a2c"><code>8c5d807</code></a> test(claude-agent-sdk): run subagent in foreground so trace nests correctly (...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/b34c68e3a87897f082da436d7f0ccd7d82fd5c9f"><code>b34c68e</code></a> docs(sandbox): fix invalid sizing example in JS sandbox README (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3335">#3335</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/446c78c7481b2d890db78636101aabe1a51acf90"><code>446c78c</code></a> fix: avoid resetting compression threads (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3332">#3332</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/cc9291a6852f13bdd732f466d61056e5b8a4d0c5"><code>cc9291a</code></a> fix(profiles): resolve the OAuth token endpoint from deployment metadata (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3333">#3333</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1e70bf5c526a518916bd477f1c4e785a73a9f7d8"><code>1e70bf5</code></a> chore(deps): bump the py-minor-and-patch group across 1 directory with 25 upd...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/9b047e3ca79bd9b7dd633c2f0d750154713fbe8b"><code>9b047e3</code></a> fix(js): inherit parent's ls_agent_type in Vercel _getLsAgentType helper (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3319">#3319</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/0a6256d636c1b824650e543c529ed46140322b32"><code>0a6256d</code></a> fix(js,py): preserve user-supplied ls_agent_type in openai-agents-sdk integra...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/312a9f545764f0456f5d9e803aaa1e7c4bb8d164"><code>312a9f5</code></a> chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3331">#3331</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/2a81489e723df8f65593811171cca2d12d4f49df"><code>2a81489</code></a> chore(deps-dev): bump the py-major group in /python with 2 updates (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3323">#3323</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.6...v0.10.16">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.10.6&new-version=0.10.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-05 13:18:07 -07:00
dependabot[bot]	bb3facc76c	chore: bump langsmith from 0.10.2 to 0.10.6 in /libs/partners/chroma (#38916 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.10.2 to 0.10.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.10.6</h2> <h2>What's Changed</h2> <ul> <li>Patch Dependabot alert dependencies by <a href="https://github.com/langsmith-fleet"><code>@langsmith-fleet</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3216">langchain-ai/langsmith-sdk#3216</a></li> <li>feat(pipecat): capture realtime tool calls and OpenAI realtime history by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3218">langchain-ai/langsmith-sdk#3218</a></li> <li>feat(py,js): Spread OpenAI request metadata into traced metadata by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3220">langchain-ai/langsmith-sdk#3220</a></li> <li>feat: capture Pipecat realtime transcripts by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3219">langchain-ai/langsmith-sdk#3219</a></li> <li>fix(deps): correct uv override-dependencies syntax for json-repair by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3221">langchain-ai/langsmith-sdk#3221</a></li> <li>chore(deps): bump mcp from 1.26.0 to 1.28.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3222">langchain-ai/langsmith-sdk#3222</a></li> <li>fix: preserve env replica project names by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3224">langchain-ai/langsmith-sdk#3224</a></li> <li>release(py): Bump version: 0.10.5 → 0.10.6 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3225">langchain-ai/langsmith-sdk#3225</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.5...v0.10.6">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.5...v0.10.6</a></p> <h2>v0.10.5</h2> <h2>What's Changed</h2> <ul> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3205">langchain-ai/langsmith-sdk#3205</a></li> <li>fix: patch high-severity JS dependencies by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3210">langchain-ai/langsmith-sdk#3210</a></li> <li>release(js): 0.8.3 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3213">langchain-ai/langsmith-sdk#3213</a></li> <li>release(python): bump py version to 0.10.5 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3212">langchain-ai/langsmith-sdk#3212</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.4...v0.10.5">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.4...v0.10.5</a></p> <h2>v0.10.4</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.8.2 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3204">langchain-ai/langsmith-sdk#3204</a></li> <li>feat(livekit): capture realtime user transcript via instrument_session by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3201">langchain-ai/langsmith-sdk#3201</a></li> <li>feat(voice): capture OpenAI Agents realtime model costs by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3193">langchain-ai/langsmith-sdk#3193</a></li> <li>feat(voice): capture Google ADK Live (Gemini) model costs by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3194">langchain-ai/langsmith-sdk#3194</a></li> <li>release(python): bump py version to 0.10.4 by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3207">langchain-ai/langsmith-sdk#3207</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.3...v0.10.4">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.3...v0.10.4</a></p> <h2>v0.10.3</h2> <h2>What's Changed</h2> <ul> <li>fix: Auto-Batch Processing Drops Workspace Override Leading to Cross-Tenant Data Leakage by <a href="https://github.com/corridor-security"><code>@corridor-security</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3174">langchain-ai/langsmith-sdk#3174</a></li> <li>chore: bump _MIN_BACKEND_VERSION to 0.16.13rc1 by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3182">langchain-ai/langsmith-sdk#3182</a></li> <li>feat(voice): capture LiveKit realtime model costs by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3191">langchain-ai/langsmith-sdk#3191</a></li> <li>feat(voice): capture Pipecat TTS/realtime model costs by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3192">langchain-ai/langsmith-sdk#3192</a></li> <li>chore(deps): bump esbuild from 0.17.19 to 0.28.1 in /js/internal/environment_tests/test-exports-cf in the npm_and_yarn group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3172">langchain-ai/langsmith-sdk#3172</a></li> <li>chore(deps): bump nltk from 3.9.4 to 3.10.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3186">langchain-ai/langsmith-sdk#3186</a></li> <li>chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3200">langchain-ai/langsmith-sdk#3200</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3165">langchain-ai/langsmith-sdk#3165</a></li> <li>release(python): bump py version to 0.10.3 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3203">langchain-ai/langsmith-sdk#3203</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.2...v0.10.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.2...v0.10.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d6cd6082f09e7826a2d6afe444ae6119e61b82a6"><code>d6cd608</code></a> release(py): Bump version: 0.10.5 → 0.10.6 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3225">#3225</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1ff410c81651d98068911005c6de2f737fc94fb8"><code>1ff410c</code></a> fix: preserve env replica project names (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3224">#3224</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/0140e9fc17ec845b58f1fa1ae2ee0bff2cacb8ef"><code>0140e9f</code></a> chore(deps): bump mcp from 1.26.0 to 1.28.1 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3222">#3222</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8ffae665dc04a09788dcba069079e061a2c17292"><code>8ffae66</code></a> fix(deps): correct uv override-dependencies syntax for json-repair (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3221">#3221</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/591b06d0ec931bf6a8e8371b45eef0e19905a6bc"><code>591b06d</code></a> feat: capture Pipecat realtime transcripts (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3219">#3219</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/58f96bf967d9f797ce7ee1a18216f385c7638a32"><code>58f96bf</code></a> feat(py,js): Spread OpenAI request metadata into traced metadata (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3220">#3220</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/71d5c6274aefff31855e4640fec619493ba7bedf"><code>71d5c62</code></a> feat(pipecat): capture realtime tool calls and OpenAI realtime history (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3218">#3218</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/ce093c9b6331ccb1682c35670d1830c9a28f2bdb"><code>ce093c9</code></a> Patch Dependabot alert dependencies (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3216">#3216</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/c2450d95237768ddd7e77a60f4939f164fca3e8d"><code>c2450d9</code></a> release(python): bump py version to 0.10.5 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3212">#3212</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8ba1a60ed54ae9637842d351f7858ce60fdca18d"><code>8ba1a60</code></a> release(js): 0.8.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3213">#3213</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.2...v0.10.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.10.2&new-version=0.10.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-17 13:23:22 -07:00
dependabot[bot]	3d4426d427	chore: bump langsmith from 0.9.5 to 0.10.2 in /libs/partners/chroma (#38831 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.9.5 to 0.10.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.10.2</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.8.1 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3185">langchain-ai/langsmith-sdk#3185</a></li> <li>refactor(voice): move span attribute setters onto TranslatedSpan by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3179">langchain-ai/langsmith-sdk#3179</a></li> <li>feat: add SmithDB by-key path to add_runs_to_annotation_queue (runs= param) [LSDK-287] by <a href="https://github.com/ayoung19"><code>@ayoung19</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3077">langchain-ai/langsmith-sdk#3077</a></li> <li>refactor(livekit + pipecat): Refactor for clarity by <a href="https://github.com/carolinedivittorio"><code>@carolinedivittorio</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3187">langchain-ai/langsmith-sdk#3187</a></li> <li>feat(py): re-export OpenAPI client exceptions from langsmith package by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3188">langchain-ai/langsmith-sdk#3188</a></li> <li>release(python): bump py version to 0.10.2 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3189">langchain-ai/langsmith-sdk#3189</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ayoung19"><code>@ayoung19</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3077">langchain-ai/langsmith-sdk#3077</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.1...v0.10.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.1...v0.10.2</a></p> <h2>v0.10.1</h2> <h2>What's Changed</h2> <ul> <li>fix: bound voice streaming audio buffers by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3169">langchain-ai/langsmith-sdk#3169</a></li> <li>fix: escape insights report html repr by <a href="https://github.com/corridor-security"><code>@corridor-security</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3176">langchain-ai/langsmith-sdk#3176</a></li> <li>chore: bump _MIN_BACKEND_VERSION to 0.16.12rc1 by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3178">langchain-ai/langsmith-sdk#3178</a></li> <li>Fix URL Path Injection via Unencoded Resource Names in Python Sandbox Client (Sync) by <a href="https://github.com/corridor-security"><code>@corridor-security</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3177">langchain-ai/langsmith-sdk#3177</a></li> <li>feat(js): expose openapi client error classes by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3181">langchain-ai/langsmith-sdk#3181</a></li> <li>release(py): 0.10.1 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3184">langchain-ai/langsmith-sdk#3184</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/corridor-security"><code>@corridor-security</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3176">langchain-ai/langsmith-sdk#3176</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.0...v0.10.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.0...v0.10.1</a></p> <h2>v0.10.0</h2> <h2>What's Changed</h2> <ul> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3152">langchain-ai/langsmith-sdk#3152</a></li> <li>release(js): bump JS SDK to 0.7.16 by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3160">langchain-ai/langsmith-sdk#3160</a></li> <li>feat: expose OTel-safe metadata helpers [closes LSDK-262] by <a href="https://github.com/open-swe"><code>@open-swe</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3091">langchain-ai/langsmith-sdk#3091</a></li> <li>feat(integrations): helpers to build LangSmith run URLs from OTel spans [LSDK-273] by <a href="https://github.com/harisaiharish"><code>@harisaiharish</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3142">langchain-ai/langsmith-sdk#3142</a></li> <li>fix(python): remove projects accessor from AsyncClient by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3163">langchain-ai/langsmith-sdk#3163</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3162">langchain-ai/langsmith-sdk#3162</a></li> <li>feat(js): Extends wrapAnthropic JS wrapper to support Claude Managed Agents methods by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3155">langchain-ai/langsmith-sdk#3155</a></li> <li>release(js): 0.7.17 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3166">langchain-ai/langsmith-sdk#3166</a></li> <li>feat(client): expose threads and traces resource accessors on Python and JS clients by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3164">langchain-ai/langsmith-sdk#3164</a></li> <li>ci: freeze pnpm environment test installs by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3168">langchain-ai/langsmith-sdk#3168</a></li> <li>Quote sandbox client URL path segments by <a href="https://github.com/langsmith-fleet"><code>@langsmith-fleet</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3167">langchain-ai/langsmith-sdk#3167</a></li> <li>release(js): 0.8.0 by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3171">langchain-ai/langsmith-sdk#3171</a></li> <li>release(py): 0.10.0 by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3170">langchain-ai/langsmith-sdk#3170</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/langsmith-fleet"><code>@langsmith-fleet</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3167">langchain-ai/langsmith-sdk#3167</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.8...v0.10.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.8...v0.10.0</a></p> <h2>v0.9.8</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/687fc8d527a28504432f52bd08c75f2894c209fe"><code>687fc8d</code></a> release(python): bump py version to 0.10.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3189">#3189</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/08cbc910be1b91f4a2714a158b32fa3a56bf7040"><code>08cbc91</code></a> feat(py): re-export OpenAPI client exceptions from langsmith package (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3188">#3188</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d309be59b951dc3b3796753b25908c029bead7d8"><code>d309be5</code></a> refactor(livekit + pipecat): Refactor for clarity (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3187">#3187</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/2e61f5418458fa559943da2ce274dfcd231cf074"><code>2e61f54</code></a> feat: add SmithDB by-key path to add_runs_to_annotation_queue (runs= param) [...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/fab828a2b074aab98bc22d73c569ece2435e17ae"><code>fab828a</code></a> refactor(voice): move span attribute setters onto TranslatedSpan (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3179">#3179</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/2f7709cdaaf6626a22daefa9fecef712abf3e39c"><code>2f7709c</code></a> release(js): 0.8.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3185">#3185</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/6388e488ba28f8b18e18e34a3452f4a7e0c755aa"><code>6388e48</code></a> release(py): 0.10.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3184">#3184</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/de74fb8f42bb632257de19f22d18a41c7d5a59b0"><code>de74fb8</code></a> feat(js): expose openapi client error classes (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3181">#3181</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/6c0729a9bc00ab49a804b57731a423714b879a0e"><code>6c0729a</code></a> Fix URL Path Injection via Unencoded Resource Names in Python Sandbox Client ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/996073e478d6960b189d5a12d1f4f5adda9d7272"><code>996073e</code></a> chore: bump _MIN_BACKEND_VERSION to 0.16.12rc1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3178">#3178</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.5...v0.10.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.9.5&new-version=0.10.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-13 17:58:05 -04:00
Mason Daugherty	a4294f9a39	chore(deps): refresh lockfiles (#38746 )	2026-07-09 12:43:43 -04:00
dependabot[bot]	9ece1e3455	chore: bump langsmith from 0.8.18 to 0.9.5 in /libs/partners/chroma (#38596 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.18 to 0.9.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.9.5</h2> <h2>What's Changed</h2> <ul> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3126">langchain-ai/langsmith-sdk#3126</a></li> <li>chore: bump _MIN_BACKEND_VERSION to 0.16.9rc1 by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3127">langchain-ai/langsmith-sdk#3127</a></li> <li>fix(sandbox): wrap all WS handshake failures as SandboxConnectionError by <a href="https://github.com/asrira428"><code>@asrira428</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3130">langchain-ai/langsmith-sdk#3130</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.4...v0.9.5">https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.4...v0.9.5</a></p> <h2>v0.9.4</h2> <h2>What's Changed</h2> <ul> <li>fix(google_adk): capture LLM inputs after before_model_callback runs [LSDK-279] by <a href="https://github.com/harisaiharish"><code>@harisaiharish</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3094">langchain-ai/langsmith-sdk#3094</a></li> <li>release(js): bump js sdk version to 0.7.13 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3104">langchain-ai/langsmith-sdk#3104</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3105">langchain-ai/langsmith-sdk#3105</a></li> <li>doc: improve resource comments by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3108">langchain-ai/langsmith-sdk#3108</a></li> <li>fix(client): apply anonymizer to run error field by <a href="https://github.com/paarth-a"><code>@paarth-a</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3100">langchain-ai/langsmith-sdk#3100</a></li> <li>feat(client): expose datasets v2 resource + experiment-runs integration tests [langchainplus#28358] by <a href="https://github.com/GowriH-1"><code>@GowriH-1</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3106">langchain-ai/langsmith-sdk#3106</a></li> <li>fix(google-adk): set tool span as active tracing context in wrap_tool_run_async by <a href="https://github.com/navarra-lisandro"><code>@navarra-lisandro</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3111">langchain-ai/langsmith-sdk#3111</a></li> <li>fix(client): apply anonymizer to run error field (JS) by <a href="https://github.com/paarth-a"><code>@paarth-a</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3110">langchain-ai/langsmith-sdk#3110</a></li> <li>fix(python): use current project issues endpoint by <a href="https://github.com/khankaholic"><code>@khankaholic</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3064">langchain-ai/langsmith-sdk#3064</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3120">langchain-ai/langsmith-sdk#3120</a></li> <li>fix(js): Avoid setting usage_metadata on parent chain runs for Claude Agent SDK runs by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3119">langchain-ai/langsmith-sdk#3119</a></li> <li>feat(client): expose projects resource accessor on Python and JS clients by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3109">langchain-ai/langsmith-sdk#3109</a></li> <li>release(js): bump to 0.7.14 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3121">langchain-ai/langsmith-sdk#3121</a></li> <li>release(python): bump py version to 0.9.4 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3124">langchain-ai/langsmith-sdk#3124</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/navarra-lisandro"><code>@navarra-lisandro</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3111">langchain-ai/langsmith-sdk#3111</a></li> <li><a href="https://github.com/khankaholic"><code>@khankaholic</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3064">langchain-ai/langsmith-sdk#3064</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.3...v0.9.4">https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.3...v0.9.4</a></p> <h2>v0.9.3</h2> <h2>What's Changed</h2> <ul> <li>release(js): bump js sdk version to 0.7.12 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3089">langchain-ai/langsmith-sdk#3089</a></li> <li>feat(sandbox): do not gate dataplane ops on sandbox status by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3090">langchain-ai/langsmith-sdk#3090</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3095">langchain-ai/langsmith-sdk#3095</a></li> <li>ci: pin all GitHub Actions to immutable SHA pins by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3093">langchain-ai/langsmith-sdk#3093</a></li> <li>chore(deps-dev): bump vcrpy from 8.1.1 to 8.2.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3074">langchain-ai/langsmith-sdk#3074</a></li> <li>chore(deps): bump pydantic-settings from 2.13.1 to 2.14.2 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3075">langchain-ai/langsmith-sdk#3075</a></li> <li>feat(sandbox): expose registries via generated v2 client by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3087">langchain-ai/langsmith-sdk#3087</a></li> <li>fix(client): lazily initialize sync OpenAPI client by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3099">langchain-ai/langsmith-sdk#3099</a></li> <li>release(python): bump py version to 0.9.3 by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3101">langchain-ai/langsmith-sdk#3101</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.2...v0.9.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.9.2...v0.9.3</a></p> <h2>v0.9.2</h2> <h2>What's Changed</h2> <ul> <li>release(js): bump js sdk version to 0.7.11 by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3079">langchain-ai/langsmith-sdk#3079</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/55b7eec3f40b8f77802ab57692833b6c6773d8d0"><code>55b7eec</code></a> fix(sandbox): wrap all WS handshake failures as SandboxConnectionError (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3130">#3130</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/c732fbbe365d0b8eb0598abdd9aceeb2116f0668"><code>c732fbb</code></a> chore: bump _MIN_BACKEND_VERSION to 0.16.9rc1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3127">#3127</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/796fb2bfd8089e9eae60d9be782feef4be19c0f4"><code>796fb2b</code></a> chore: sync langsmith_api (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3126">#3126</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/80d93c48c49a521b076e6f61fa4f4554cfb83150"><code>80d93c4</code></a> release(python): bump py version to 0.9.4 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3124">#3124</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/b453dd58d6eca2c79071d36768109a4f542bf08f"><code>b453dd5</code></a> release(js): bump to 0.7.14 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3121">#3121</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/76f5c7136c0ffdc7e39fc341bb91355f3030f537"><code>76f5c71</code></a> feat(client): expose projects resource accessor on Python and JS clients (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3109">#3109</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/5f324261094d223d9a9221b0a52fcc250ef1af7e"><code>5f32426</code></a> fix(js): Avoid setting usage_metadata on parent chain runs for Claude Agent S...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/03b53410f12d62b1adb78a34f7a27494ca26d8c8"><code>03b5341</code></a> chore: sync langsmith_api (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3120">#3120</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/7595f5c187cc3c2de8c470c2aa04a94e97f7ae45"><code>7595f5c</code></a> fix(python): use current project issues endpoint (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3064">#3064</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/b5291fac0614332d44393641884904e3b56faadd"><code>b5291fa</code></a> fix(client): apply anonymizer to run error field (JS) (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3110">#3110</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.18...v0.9.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.18&new-version=0.9.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-01 15:01:08 -04:00
dependabot[bot]	8235577a38	chore: bump pytest from 9.1.0 to 9.1.1 in /libs/partners/chroma (#38597 ) Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.1.0 to 9.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.1.1</h2> <h1>pytest 9.1.1 (2026-06-19)</h1> <h2>Bug fixes</h2> <ul> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14220">#14220</a>: Fixed a logic bug in <code>pytest.RaisesGroup</code> which would might cause it to display incorrect "It matches <!-- raw HTML omitted -->FooError()<!-- raw HTML omitted --> which was paired with <!-- raw HTML omitted -->BarError<!-- raw HTML omitted -->" messages.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14591">#14591</a>: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect <!-- raw HTML omitted --><a href="https://github.com/pytest"><code>@pytest</code></a>.mark.parametrize<!-- raw HTML omitted --> to fail with "duplicate parametrization of '<fixture name>'".</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14606">#14606</a>: Fixed <code>list-item</code> typing errors from mypy in <code>@pytest.mark.parametrize <pytest.mark.parametrize ref></code> <code>argvalues</code> parameter.</li> <li><a href="https://redirect.github.com/pytest-dev/pytest/issues/14608">#14608</a>: Fixed a regression in pytest 9.1.0 where <code>conftest.py</code> files located in <code><invocation dir>/test*</code> were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like <code>pytest_addoption</code>) in these files to not fire.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytest-dev/pytest/commit/cf470ec0bf7eb89cd97dd56df4859eae5db46447"><code>cf470ec</code></a> Prepare release version 9.1.1</li> <li><a href="https://github.com/pytest-dev/pytest/commit/e0c8ce6cc5db1f08363be6f152c32e6838df2690"><code>e0c8ce6</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14625">#14625</a> from pytest-dev/patchback/backports/9.1.x/a07c31a97...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/1b82d1694fce22385ee7a4287917fbafbaf2e757"><code>1b82d16</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14624">#14624</a> from pytest-dev/patchback/backports/9.1.x/b375b79ec...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/501c4bc784da3b08bfcaa64858eba5d15dc59e53"><code>501c4bc</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14596">#14596</a> from bluetech/doc-classmethod</li> <li><a href="https://github.com/pytest-dev/pytest/commit/b61f588e36e9377c3d1d3f06bece1da0fc31d9ca"><code>b61f588</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14622">#14622</a> from chrisburr/fix-14608-initial-conftest-test-subdir</li> <li><a href="https://github.com/pytest-dev/pytest/commit/9a567e009f4d2da3ce1721c6db3109cb5744d40a"><code>9a567e0</code></a> [automated] Update plugin list (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14617">#14617</a>) (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14618">#14618</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/ef8b2993e5b48639e4a3d97d0525df9760781384"><code>ef8b299</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14620">#14620</a> from pytest-dev/patchback/backports/9.1.x/680f9f3ed...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/66abd0784d4cb7c1ba44ab9a8896506cd4985acc"><code>66abd07</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14220">#14220</a> from bysiber/fix-stale-iexp-raisesgroup</li> <li><a href="https://github.com/pytest-dev/pytest/commit/79fbf93b666cac5f27c9dad047943d47b766c8d5"><code>79fbf93</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14612">#14612</a> from pytest-dev/patchback/backports/9.1.x/974ed48b6...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/0d312eb876177e9f1c04262b54060a41034ebf5c"><code>0d312eb</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14611">#14611</a> from bluetech/parametrize-argvalues-typing</li> <li>Additional commits viewable in <a href="https://github.com/pytest-dev/pytest/compare/9.1.0...9.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest&package-manager=uv&previous-version=9.1.0&new-version=9.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-01 15:01:00 -04:00
dependabot[bot]	0429dbe088	chore: bump pydantic-settings from 2.13.1 to 2.14.2 in /libs/partners/chroma (#38322 ) Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.13.1 to 2.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.2</h2> <h2>What's Changed</h2> <p>This is a security patch release.</p> <ul> <li>Prevent <code>NestedSecretsSettingsSource</code> from following symlinks outside <code>secrets_dir</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/889">pydantic/pydantic-settings#889</a></li> <li>Prepare release 2.14.2 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/890">pydantic/pydantic-settings#890</a></li> </ul> <h3>Security</h3> <p>Fixes <a href="https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j">GHSA-4xgf-cpjx-pc3j</a>: <code>NestedSecretsSettingsSource</code> with <code>secrets_nested_subdir=True</code> could follow a symbolic link inside <code>secrets_dir</code> pointing outside it, reading out-of-tree files into settings values and bypassing the <code>secrets_dir_max_size</code> cap. Affected versions: <code>>= 2.12.0, < 2.14.2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2">https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2</a></p> <h2>v2.14.1</h2> <h2>What's Changed</h2> <ul> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/850">pydantic/pydantic-settings#850</a></li> <li>Bump the python-packages group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/854">pydantic/pydantic-settings#854</a></li> <li>Bump the github-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/853">pydantic/pydantic-settings#853</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/856">pydantic/pydantic-settings#856</a></li> <li>Fix field named <code>cls</code> conflicting with classmethod parameter by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/858">pydantic/pydantic-settings#858</a></li> <li>Prepare release 2.14.1 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/859">pydantic/pydantic-settings#859</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1">https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1</a></p> <h2>v2.14.0</h2> <h2>What's Changed</h2> <ul> <li>Fix parsing env vars into Optional Strict types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/792">pydantic/pydantic-settings#792</a></li> <li>Fix RecursionError with mutually recursive models in CLI by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/794">pydantic/pydantic-settings#794</a></li> <li>Fix env_file from model_config ignored in CliApp.run() (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/795">#795</a>) by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/796">pydantic/pydantic-settings#796</a></li> <li>Update dependencies by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/798">pydantic/pydantic-settings#798</a></li> <li>Add Dependabot configuration by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/801">pydantic/pydantic-settings#801</a></li> <li>Bump samuelcolvin/check-python-version from 4.1 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li>Bump actions/upload-artifact from 4 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/803">pydantic/pydantic-settings#803</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/804">pydantic/pydantic-settings#804</a></li> <li>Bump astral-sh/setup-uv from 5 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/805">pydantic/pydantic-settings#805</a></li> <li>Bump actions/setup-python from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/806">pydantic/pydantic-settings#806</a></li> <li>Ignore chardet and group GitHub Actions in Dependabot by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/808">pydantic/pydantic-settings#808</a></li> <li>Bump actions/download-artifact from 4 to 8 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/809">pydantic/pydantic-settings#809</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/810">pydantic/pydantic-settings#810</a></li> <li>Support reading .env files from FIFOs (e.g. 1Password Environments) by <a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li>Fix AliasChoices ignored when changing provider priority by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/813">pydantic/pydantic-settings#813</a></li> <li>fix: resolve KeyError in run_subcommand for underscore field names by <a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/814">pydantic/pydantic-settings#814</a></li> <li>Fix <code>Literal[numeric Enum]</code> coercion for CLI and env vars by <a href="https://github.com/m9810223"><code>@m9810223</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/811">pydantic/pydantic-settings#811</a></li> <li>Fix nested discriminated unions not discovered by env/CLI providers by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/816">pydantic/pydantic-settings#816</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/820">pydantic/pydantic-settings#820</a></li> <li>CLI ensure env nested max split internally. by <a href="https://github.com/kschwab"><code>@kschwab</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/821">pydantic/pydantic-settings#821</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/824">pydantic/pydantic-settings#824</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic-settings/commit/d703bd717e5e07439fa89da2245eee6139413e9e"><code>d703bd7</code></a> Prepare release 2.14.2 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/890">#890</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/e95c30bec8cfaee88ee275138c064aea97a25bdf"><code>e95c30b</code></a> Prepare release 2.14.1 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/859">#859</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/0c8734581b6cf70a995afad603ac456631d00621"><code>0c87345</code></a> Fix field named <code>cls</code> conflicting with classmethod parameter (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/858">#858</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/7bd0072795a800065b42210b6dca90fc9b83daf7"><code>7bd0072</code></a> Bump the python-packages group with 2 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/856">#856</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/b03e573d017ed48e1c2774a5e0b715db9766c76b"><code>b03e573</code></a> Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/853">#853</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/eaa3b434938411ec8a3717ea646614561e713f51"><code>eaa3b43</code></a> Bump the python-packages group with 5 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/854">#854</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/9f95615c24c6813c1d7d203576581a79cb6d9e8e"><code>9f95615</code></a> Bump the python-packages group with 4 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/850">#850</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/8916beeecc6d0510e3d0532a0ed839937400ddc3"><code>8916bee</code></a> Prepare release 2.14.0 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/848">#848</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/39e551c0910c85505b608ff85a103b2c9f7396c5"><code>39e551c</code></a> Fix CLI descriptions lost under <code>python -OO</code> by falling back to `json_schema_...</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/9ed7f48ea2c90f436a03b01f721fe6656c869b14"><code>9ed7f48</code></a> Bump the python-packages group with 4 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/847">#847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pydantic-settings&package-manager=uv&previous-version=2.13.1&new-version=2.14.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-19 22:08:52 -04:00
dependabot[bot]	88b4338842	chore: bump langsmith from 0.8.16 to 0.8.18 in /libs/partners/chroma (#38321 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.16 to 0.8.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.18</h2> <h2>What's Changed</h2> <ul> <li>chore(deps-dev): bump vitest from 3.2.4 to 3.2.6 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3002">langchain-ai/langsmith-sdk#3002</a></li> <li>chore(deps): bump pyjwt from 2.12.1 to 2.13.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3030">langchain-ai/langsmith-sdk#3030</a></li> <li>chore(deps): bump python-multipart from 0.0.27 to 0.0.31 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3036">langchain-ai/langsmith-sdk#3036</a></li> <li>chore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3037">langchain-ai/langsmith-sdk#3037</a></li> <li>chore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3038">langchain-ai/langsmith-sdk#3038</a></li> <li>chore(deps): bump starlette from 1.0.1 to 1.3.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3039">langchain-ai/langsmith-sdk#3039</a></li> <li>chore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3044">langchain-ai/langsmith-sdk#3044</a></li> <li>chore(deps): bump the npm_and_yarn group across 4 directories with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3046">langchain-ai/langsmith-sdk#3046</a></li> <li>chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3060">langchain-ai/langsmith-sdk#3060</a></li> <li>test(python): fix integration assertions for updated attachment error message by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3061">langchain-ai/langsmith-sdk#3061</a></li> <li>chore: reconcile bumpversion config and mandate release process for agents by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3062">langchain-ai/langsmith-sdk#3062</a></li> <li>release(py): 0.8.18 by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3063">langchain-ai/langsmith-sdk#3063</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18</a></p> <h2>v0.8.17</h2> <h2>What's Changed</h2> <ul> <li>feat: expose the resources from the generated openapi client in the langsmith client by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018">langchain-ai/langsmith-sdk#3018</a></li> <li>feat(js): port <code>isTracingEnabled</code> utility from Python by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3032">langchain-ai/langsmith-sdk#3032</a></li> <li>Add sandbox mount support to JS SDK by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3010">langchain-ai/langsmith-sdk#3010</a></li> <li>release(js): bump to 0.7.9 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3035">langchain-ai/langsmith-sdk#3035</a></li> <li>Add sandbox mount support to Python SDK by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3009">langchain-ai/langsmith-sdk#3009</a></li> <li>docs: note that _openapi_client directories are auto-generated by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3034">langchain-ai/langsmith-sdk#3034</a></li> <li>fix: update JS SDK type declarations with skipLibCheck disabled by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3043">langchain-ai/langsmith-sdk#3043</a></li> <li>release(js): 0.7.10 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3045">langchain-ai/langsmith-sdk#3045</a></li> <li>feat: adding python async for online evals by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3048">langchain-ai/langsmith-sdk#3048</a></li> <li>Add sandbox Git mount SDK helpers by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3040">langchain-ai/langsmith-sdk#3040</a></li> <li>fix: use insights tab in sdk report links [closes LSO-2936] by <a href="https://github.com/eric-langchain"><code>@eric-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050">langchain-ai/langsmith-sdk#3050</a></li> <li>feat(client): warn when backend version is below minimum required by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3041">langchain-ai/langsmith-sdk#3041</a></li> <li>chore: bump _MIN_BACKEND_VERSION to 0.16.5rc1 by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3053">langchain-ai/langsmith-sdk#3053</a></li> <li>fix(sandbox): use built-in gcp auth host matching by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3055">langchain-ai/langsmith-sdk#3055</a></li> <li>chore(python): py to 0.8.17 by <a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3056">langchain-ai/langsmith-sdk#3056</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/sineha-mani"><code>@sineha-mani</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018">langchain-ai/langsmith-sdk#3018</a></li> <li><a href="https://github.com/eric-langchain"><code>@eric-langchain</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050">langchain-ai/langsmith-sdk#3050</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/31c2bf650b84a44577d8b4443298fb7e78025b8f"><code>31c2bf6</code></a> release(py): 0.8.18 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3063">#3063</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8955b688689fdf47871d44013787410a42ea13fd"><code>8955b68</code></a> chore: reconcile bumpversion config and mandate release process for agents (#...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/411401f6ca5ff401c29772ed097c9c9ed97f994c"><code>411401f</code></a> test(python): fix integration assertions for updated attachment error message...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/9c5515620f9bfa2145fc65d6f4353c4c8a3e96b6"><code>9c55156</code></a> Merge commit from fork</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/5b2bd8db3c50d3f19e98f41288c87d9c0ac0b136"><code>5b2bd8d</code></a> chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d8642f9099a48025d00c7283ad3cd2ce56fec775"><code>d8642f9</code></a> chore(deps): bump the npm_and_yarn group across 4 directories with 4 updates ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/953c2e5e25e41ecb4dba428adbac1c446c0a0071"><code>953c2e5</code></a> chore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3044">#3044</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/5513699e2d25c2147e02c296bc3b90f7d0923d8a"><code>5513699</code></a> chore(deps): bump starlette from 1.0.1 to 1.3.1 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3039">#3039</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8becdefdf422a02e03f78cf3ebb4c62c136b7cf3"><code>8becdef</code></a> chore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3038">#3038</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1a9c522febbf313bbe649ca75c39158fec048934"><code>1a9c522</code></a> chore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3037">#3037</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.18">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.16&new-version=0.8.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-19 22:08:29 -04:00
dependabot[bot]	cb6320c401	chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/partners/chroma (#38323 ) Bumps [vcrpy](https://github.com/kevin1024/vcrpy) from 8.1.1 to 8.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/kevin1024/vcrpy/releases">vcrpy's releases</a>.</em></p> <blockquote> <h2>v8.2.1</h2> <h2>What's Changed</h2> <ul> <li><strong>SECURITY:</strong> Cassettes are now loaded with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded. Previously a crafted cassette containing a Python object tag (e.g. <code>!!python/object/apply:os.system</code>) would execute code on load, including via the normal <code>vcr.use_cassette()</code> path. Existing cassettes (including file-upload/streaming bodies) continue to load. Advisory: GHSA-rpj2-4hq8-938g — thanks <a href="https://github.com/RamiAltai"><code>@RamiAltai</code></a> and <a href="https://github.com/EQSTLab"><code>@EQSTLab</code></a> for the reports.</li> <li>Validate <code>record_mode</code> and raise a clear error on an invalid value (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/208">#208</a>)</li> <li>Recommend pytest-recording over the unmaintained pytest-vcr in the docs (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/986">#986</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/kevin1024/vcrpy/compare/v8.2.0...v8.2.1">https://github.com/kevin1024/vcrpy/compare/v8.2.0...v8.2.1</a></p> <h2>v8.2.0</h2> <h2>What's Changed</h2> <ul> <li>Add support for httpx 2.x (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/993">#993</a>) - thanks <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a></li> <li>Patch httpx transports instead of httpcore (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/972">#972</a>) - thanks <a href="https://github.com/seowalex"><code>@seowalex</code></a></li> <li>Fix aiohttp 3.14 compatibility: <code>AsyncStreamReaderMixin</code> removed and <code>ClientResponse</code> now requires <code>stream_writer</code> (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/995">#995</a>) - thanks <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a></li> <li>Account for modified requests when storing played cassettes, so <code>drop_unused_requests</code> honours <code>before_record_request</code> filtering (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/962">#962</a>) - thanks <a href="https://github.com/jamesbraza"><code>@jamesbraza</code></a></li> <li>Make the request URL available on <code>VCRHTTPResponse</code> (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/976">#976</a>) - thanks <a href="https://github.com/dAnjou"><code>@dAnjou</code></a></li> <li>Improve error message when a matching request has already been consumed (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/985">#985</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>Fix body check in <code>convert_body_to_unicode</code> to use an explicit type check (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/982">#982</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>Add env proxy cassette regression test (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/994">#994</a>) - thanks <a href="https://github.com/tine1117"><code>@tine1117</code></a></li> <li>Remove milestone references from docs (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/984">#984</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/973">#973</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/kevin1024/vcrpy/compare/v8.1.1...v8.2.0">https://github.com/kevin1024/vcrpy/compare/v8.1.1...v8.2.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst">vcrpy's changelog</a>.</em></p> <blockquote> <h2>Changelog</h2> <p>All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.</p> <ul> <li> <p>8.2.1</p> <ul> <li>SECURITY: Load cassettes with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded (GHSA-rpj2-4hq8-938g) - thanks <a href="https://github.com/RamiAltai"><code>@RamiAltai</code></a> and <a href="https://github.com/EQSTLab"><code>@EQSTLab</code></a></li> <li>Validate <code>record_mode</code> and raise a clear error on an invalid value (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/208">#208</a>)</li> <li>Recommend pytest-recording over the unmaintained pytest-vcr in the docs (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/986">#986</a>)</li> </ul> </li> <li> <p>8.2.0</p> <ul> <li>Add support for httpx 2.x (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/993">#993</a>) - thanks <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a></li> <li>Patch httpx transports instead of httpcore (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/972">#972</a>) - thanks <a href="https://github.com/seowalex"><code>@seowalex</code></a></li> <li>Fix aiohttp 3.14 compatibility: <code>AsyncStreamReaderMixin</code> removed and <code>ClientResponse</code> now requires <code>stream_writer</code> (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/995">#995</a>) - thanks <a href="https://github.com/dsfaccini"><code>@dsfaccini</code></a></li> <li>Account for modified requests when storing played cassettes, so <code>drop_unused_requests</code> honours <code>before_record_request</code> filtering (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/962">#962</a>) - thanks <a href="https://github.com/jamesbraza"><code>@jamesbraza</code></a></li> <li>Make the request URL available on <code>VCRHTTPResponse</code> (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/976">#976</a>) - thanks <a href="https://github.com/dAnjou"><code>@dAnjou</code></a></li> <li>Improve error message when a matching request has already been consumed (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/985">#985</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>Fix body check in <code>convert_body_to_unicode</code> to use an explicit type check (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/982">#982</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>Add env proxy cassette regression test (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/994">#994</a>) - thanks <a href="https://github.com/tine1117"><code>@tine1117</code></a></li> <li>Remove milestone references from docs (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/984">#984</a>) - thanks <a href="https://github.com/Polandia94"><code>@Polandia94</code></a></li> <li>CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/973">#973</a>)</li> </ul> </li> <li> <p>8.1.1</p> <ul> <li>Fix sync requests in async contexts for HTTPX (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/965">#965</a>) - thanks <a href="https://github.com/seowalex"><code>@seowalex</code></a></li> <li>CI: bump peter-evans/create-pull-request from 7 to 8 (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/969">#969</a>)</li> </ul> </li> <li> <p>8.1.0</p> <ul> <li>Enable brotli decompression if available (via <code>brotli</code>, <code>brotlipy</code> or <code>brotlicffi</code>) (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/620">#620</a>) - thanks <a href="https://github.com/immerrr"><code>@immerrr</code></a></li> <li>Fix aiohttp allowing both <code>data</code> and <code>json</code> arguments when one is None (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/624">#624</a>) - thanks <a href="https://github.com/leorochael"><code>@leorochael</code></a></li> <li>Fix usage of io-like interface with VCR.py (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/906">#906</a>) - thanks <a href="https://github.com/tito"><code>@tito</code></a> and <a href="https://github.com/kevdevg"><code>@kevdevg</code></a></li> <li>Migrate to declarative Python package config (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/767">#767</a>) - thanks <a href="https://github.com/deronnax"><code>@deronnax</code></a></li> <li>Various linting fixes - thanks <a href="https://github.com/jairhenrique"><code>@jairhenrique</code></a></li> <li>CI: bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/955">#955</a>)</li> </ul> </li> <li> <p>8.0.0</p> <ul> <li>BREAKING: Drop support for Python 3.9 (major version bump) - thanks <a href="https://github.com/jairhenrique"><code>@jairhenrique</code></a></li> <li>BREAKING: Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/926">#926</a>, <a href="https://redirect.github.com/kevin1024/vcrpy/issues/880">#880</a>) - thanks <a href="https://github.com/jairhenrique"><code>@jairhenrique</code></a></li> <li>New feature: <code>drop_unused_requests</code> option to remove unused interactions from cassettes (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/763">#763</a>) - thanks <a href="https://github.com/danielnsilva"><code>@danielnsilva</code></a></li> <li>Rewrite httpx support to patch httpcore instead of httpx (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/943">#943</a>) - thanks <a href="https://github.com/seowalex"><code>@seowalex</code></a> <ul> <li>Fixes <code>httpx.ResponseNotRead</code> exceptions (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/832">#832</a>, <a href="https://redirect.github.com/kevin1024/vcrpy/issues/834">#834</a>)</li> <li>Fixes <code>KeyError: 'follow_redirects'</code> (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/945">#945</a>)</li> <li>Adds support for custom httpx transports</li> </ul> </li> <li>Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/809">#809</a>, <a href="https://redirect.github.com/kevin1024/vcrpy/issues/914">#914</a>) - thanks <a href="https://github.com/alga"><code>@alga</code></a></li> <li>Fix <code>iscoroutinefunction</code> deprecation warning on Python 3.14 - thanks <a href="https://github.com/kloczek"><code>@kloczek</code></a></li> <li>Only log message if response is appended - thanks <a href="https://github.com/talfus-laddus"><code>@talfus-laddus</code></a></li> <li>Optimize urllib.parse calls - thanks <a href="https://github.com/Martin-Brunthaler"><code>@Martin-Brunthaler</code></a></li> <li>Fix CI for Ubuntu 24.04 - thanks <a href="https://github.com/hartwork"><code>@hartwork</code></a></li> <li>Various CI improvements: migrate to uv, update GitHub Actions - thanks <a href="https://github.com/jairhenrique"><code>@jairhenrique</code></a></li> <li>Various linting and test improvements - thanks <a href="https://github.com/jairhenrique"><code>@jairhenrique</code></a> and <a href="https://github.com/hartwork"><code>@hartwork</code></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kevin1024/vcrpy/commit/85312039e9ade8f1290f7e556b18d2889cf9f6e0"><code>8531203</code></a> Release v8.2.1</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/045acb1b5f8940f82adbb3faafd13e43e46289d6"><code>045acb1</code></a> Use a safe YAML loader for cassettes to prevent code execution</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/de43f46247e763c2e36dc8dd9c36173be3069f81"><code>de43f46</code></a> Fix lint failures from merged PRs (codespell + ruff UP032)</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/514c374796ba8b53402d3cad86682a7d3f0c34cc"><code>514c374</code></a> Validate record_mode and raise a clear error on invalid values</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/b736cadd58d3f4088c0e440a1196e4b14d369dd2"><code>b736cad</code></a> docs: recommend pytest-recording over unmaintained pytest-vcr</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/06758c9879f18a46b24b450591a295ae9443d097"><code>06758c9</code></a> Release v8.2.0</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/6554837e023f97aee5edcc7cd8359408686cca98"><code>6554837</code></a> Add env proxy cassette regression test (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/994">#994</a>)</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/62cf5e127201c050b6b8f8c8a20910eb7eab753a"><code>62cf5e1</code></a> Accounting for modified requests when storing played cassettes, with a test (...</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/13f201a820b71288829df9470d629bfd0b4183de"><code>13f201a</code></a> make url available in VCRHTTPResponse (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/976">#976</a>)</li> <li><a href="https://github.com/kevin1024/vcrpy/commit/d57b55339e1bd386fed791621bb0094de2a8a4b2"><code>d57b553</code></a> improve error message on repeated requestt (<a href="https://redirect.github.com/kevin1024/vcrpy/issues/985">#985</a>)</li> <li>Additional commits viewable in <a href="https://github.com/kevin1024/vcrpy/compare/v8.1.1...v8.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vcrpy&package-manager=uv&previous-version=8.1.1&new-version=8.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-19 22:07:16 -04:00
dependabot[bot]	33e4c456d7	chore: bump pytest from 9.0.3 to 9.1.0 in /libs/partners/chroma (#38237 ) Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to 9.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.1.0</h2> <h1>pytest 9.1.0 (2026-06-13)</h1> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14533">#14533</a>: When using <code>--doctest-modules</code>, autouse fixtures with <code>module</code>, <code>package</code> or <code>session</code> scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.</p> <p>If this is undesirable, move the fixture definition to a <code>conftest.py</code> file if possible.</p> <p>Technical explanation for those interested: When using <!-- raw HTML omitted -->--doctest-modules<!-- raw HTML omitted -->, pytest possibly collects Python modules twice, once as <code>pytest.Module</code> and once as a <code>DoctestModule</code> (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the <code>DoctestModule</code> collects a fixture, it is now visible to it only, and not to the <code>Module</code>. This means that both need to register the fixtures independently.</p> </li> </ul> <h2>Deprecations (removal in next major release)</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/10819">#10819</a>: Added a deprecation warning for class-scoped fixtures defined as instance methods (without <code>@classmethod</code>). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use <code>@classmethod</code> decorator instead -- by <code>yastcher</code>.</p> <p>See <code>10819</code> and <code>14011</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12882">#12882</a>: Calling <code>request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue></code> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.</p> <p>See <code>dynamic-fixture-request-during-teardown</code> for details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13409">#13409</a>: Using non-<code>~collections.abc.Collection</code> iterables (such as generators, iterators, or custom iterable objects) for the <code>argvalues</code> parameter in <code>@pytest.mark.parametrize <pytest.mark.parametrize ref></code> and <code>metafunc.parametrize <pytest.Metafunc.parametrize></code> is now deprecated.</p> <p>These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running <code>pytest.main()</code> multiple times, using class-level parametrize decorators, or collecting tests multiple times.</p> <p>See <code>parametrize-iterators</code> for details and suggestions.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>: The private <code>config.inicfg</code> attribute is now deprecated. Use <code>config.getini() <pytest.Config.getini></code> to access configuration values instead.</p> <p>See <code>config-inicfg</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14004">#14004</a>: Passing <code>baseid</code> to <code>~pytest.FixtureDef</code> or <code>nodeid</code> strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.</p> <p>Use the <code>node</code> parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used <code>nodeid=None</code>, pass <code>node=session</code> instead.</p> <p>This will be removed in pytest 10.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14335">#14335</a>: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See <code>hook-markers</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14434">#14434</a>: The <code>--pastebin</code> option is now deprecated.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytest-dev/pytest/commit/b2522cf0b11fb33ecc1f4895fa1dffbb9252a63d"><code>b2522cf</code></a> Prepare release version 9.1.0</li> <li><a href="https://github.com/pytest-dev/pytest/commit/368d2fca78e86ac79ec269bb078fcb1259a94fed"><code>368d2fc</code></a> [refactor] Tighten <code>SetComparisonFunction</code> to <code>Iterator[str]</code> (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14587">#14587</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/ff77cd8b66b43a88c26ca54384bbcab72d079497"><code>ff77cd8</code></a> [refactor] Make base assertion comparisons return an iterator instead of a li...</li> <li><a href="https://github.com/pytest-dev/pytest/commit/0d8491a4ecf971800de0479ef55c7f5292c54937"><code>0d8491a</code></a> build(deps): Bump actions/stale from 10.2.0 to 10.3.0</li> <li><a href="https://github.com/pytest-dev/pytest/commit/4a809d9c892f6abb5ba92b77b06f1dd878f4660a"><code>4a809d9</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14568">#14568</a> from pytest-dev/register-fixture</li> <li><a href="https://github.com/pytest-dev/pytest/commit/5dfa38541becfb77d0f52cac4cc8cce71849ab61"><code>5dfa385</code></a> Fix recursion traceback test to cover all styles (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14582">#14582</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/f52ff0c1778c15038cf2bbb00b7668dac674cc26"><code>f52ff0c</code></a> Add <code>pytest.register_fixture</code></li> <li><a href="https://github.com/pytest-dev/pytest/commit/a8ac094e80df788aec844794170b126eab0be7a4"><code>a8ac094</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14567">#14567</a> from pytest-dev/more-visibility-deprecate</li> <li><a href="https://github.com/pytest-dev/pytest/commit/e5620cd21ec62f5a5f9a5141a3c76fb3953729b6"><code>e5620cd</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pytest-dev/pytest/issues/14577">#14577</a>)</li> <li><a href="https://github.com/pytest-dev/pytest/commit/2ce9c6d94eb691ea4da7f91f330602cbb67a6daf"><code>2ce9c6d</code></a> Merge pull request <a href="https://redirect.github.com/pytest-dev/pytest/issues/14540">#14540</a> from minbang930/fix-14533-doctest-module-fixtures</li> <li>Additional commits viewable in <a href="https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest&package-manager=uv&previous-version=9.0.3&new-version=9.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-18 00:46:25 -04:00
dependabot[bot]	408dc88c8a	chore: bump langsmith from 0.8.14 to 0.8.16 in /libs/partners/chroma (#38236 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.14 to 0.8.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.16</h2> <h2>What's Changed</h2> <ul> <li>feat(py): add sync/async conversion for Sandbox and SandboxClient [INF-0000] by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3019">langchain-ai/langsmith-sdk#3019</a></li> <li>fix(experiments): extract keys from wrapped evaluator function by <a href="https://github.com/shamikkarkhanis"><code>@shamikkarkhanis</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3014">langchain-ai/langsmith-sdk#3014</a></li> <li>chore: repoint <a href="mailto:support@langchain.dev">support@langchain.dev</a> mentions to the Support Portal by <a href="https://github.com/lutan-langchain"><code>@lutan-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3024">langchain-ai/langsmith-sdk#3024</a></li> <li>fix(python): derive create_child run id from start_time [LSDK-220] by <a href="https://github.com/harisaiharish"><code>@harisaiharish</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3027">langchain-ai/langsmith-sdk#3027</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3020">langchain-ai/langsmith-sdk#3020</a></li> <li>chore: js to 0.7.8 and py to 0.8.16 by <a href="https://github.com/shamikkarkhanis"><code>@shamikkarkhanis</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3029">langchain-ai/langsmith-sdk#3029</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lutan-langchain"><code>@lutan-langchain</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3024">langchain-ai/langsmith-sdk#3024</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.15...v0.8.16">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.15...v0.8.16</a></p> <h2>v0.8.15</h2> <h2>What's Changed</h2> <ul> <li>chore(js): exclude generated _openapi_client from linters and type-checker by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3015">langchain-ai/langsmith-sdk#3015</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3006">langchain-ai/langsmith-sdk#3006</a></li> <li>chore: protect JS openapi client in workflow by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3017">langchain-ai/langsmith-sdk#3017</a></li> <li>fix(js): deliver sandbox output callbacks across stream reconnects by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3022">langchain-ai/langsmith-sdk#3022</a></li> <li>fix(python): deliver sandbox output callbacks across stream reconnects by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3023">langchain-ai/langsmith-sdk#3023</a></li> <li>chore: bump JS to 0.7.7 and Python to 0.8.15 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3025">langchain-ai/langsmith-sdk#3025</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.14...v0.8.15">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.14...v0.8.15</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/65d0b5d4c2fee7fba12f568ffd8e4e2ff7740440"><code>65d0b5d</code></a> chore: js to 0.7.8 and py to 0.8.16 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3029">#3029</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d9dc6ca9c3630b9e079ccb131040353e420d27c7"><code>d9dc6ca</code></a> chore: sync langsmith_api (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3020">#3020</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/47b5b70b78f6c2ac1a8393a852ec12b40cedbcd5"><code>47b5b70</code></a> fix(python): derive create_child run id from start_time [LSDK-220] (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3027">#3027</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/24f4907bba23fec0c4695cddc15463197cdc8ee7"><code>24f4907</code></a> chore: repoint <a href="mailto:support@langchain.dev">support@langchain.dev</a> mentions to the Support Portal (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3024">#3024</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d4deaa0bbcd04e039b3efd279a9ad4c07586f36f"><code>d4deaa0</code></a> fix(experiments): extract keys from wrapped evaluator function (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3014">#3014</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/46279499e0800312ff4f669356b151d28c39dabd"><code>4627949</code></a> feat(py): add sync/async conversion for Sandbox and SandboxClient (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3019">#3019</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/84b7144242e5cc53ce55752cc5be6369ffc1bd9f"><code>84b7144</code></a> chore: bump JS to 0.7.7 and Python to 0.8.15 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3025">#3025</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/909390fb9ac66d15e3630ad6e2bf01ac5c9e1774"><code>909390f</code></a> fix(python): deliver sandbox output callbacks across stream reconnects (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3023">#3023</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/504f641d0ff0d4dfa6b3fb8ed1617d9bb9754f64"><code>504f641</code></a> fix(js): deliver sandbox output callbacks across stream reconnects (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3022">#3022</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/f10fe78b0d1efbab7c76d6d99e0fa6ac48fb285d"><code>f10fe78</code></a> chore: protect JS openapi client in workflow (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3017">#3017</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.14...v0.8.16">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.14&new-version=0.8.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-18 00:46:18 -04:00
Mason Daugherty	63cc1f4e7d	docs: refresh `README` installation and resources (#38119 ) README installation examples now use `uv add` consistently, matching the repo's `uv`-based Python workflow. The top-level README also gets a cleaner quickstart and resource section with current links for docs, community, learning, and contribution guidance. ## Changes - Replaced `pip install` snippets with `uv add` across package quick install docs, including the Hugging Face extras and `sentence-transformers` upgrade examples. - Updated the top-level quickstart to show only `uv add langchain` and refreshed the example model to `openai:gpt-5.5`. - Pointed the LangGraph orchestration link at the LangGraph GitHub repository. - Consolidated top-level documentation and additional-resource links under a single `Resources` section covering docs, ecosystem overview, API reference, discussions, Academy, contributing, and the Code of Conduct. - Added LangChain Academy and Code of Conduct links to package README resource sections.	2026-06-12 17:38:22 -04:00
Mason Daugherty	4108c0738c	release(core): 1.4.7 (#38111 ) Bumps `langchain-core` to `1.4.7` for the next patch release and updates downstream minimum `langchain-core` requirements so package locks resolve against the new core version. This also refreshes the runnable snapshots that embed `lc_versions` metadata so the version consistency check continues to validate checked-in artifacts. Validated with `python libs/core/scripts/check_version.py`, `uv lock --check` across package lockfiles, and the core runnable tests that own the updated snapshots with local LangSmith tracing env disabled.	2026-06-12 14:54:25 -04:00
dependabot[bot]	51daae5c13	chore: bump langsmith from 0.8.9 to 0.8.14 in /libs/partners/chroma (#38092 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.9 to 0.8.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.14</h2> <h2>What's Changed</h2> <ul> <li>feat: add deepagent compatibility smoke tests to Python and JS CI [LSDK-214] by <a href="https://github.com/QuentinBrosse"><code>@QuentinBrosse</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2997">langchain-ai/langsmith-sdk#2997</a></li> <li>chore(py): bump Python SDK to 0.8.14 by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3013">langchain-ai/langsmith-sdk#3013</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.13...v0.8.14">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.13...v0.8.14</a></p> <h2>v0.8.13</h2> <h2>What's Changed</h2> <ul> <li>fix(py): type sandbox startup errors by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3004">langchain-ai/langsmith-sdk#3004</a></li> <li>chore(py): bump Python SDK to 0.8.13 by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3012">langchain-ai/langsmith-sdk#3012</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.12...v0.8.13">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.12...v0.8.13</a></p> <h2>v0.8.12</h2> <h2>What's Changed</h2> <ul> <li>ci: protect _openapi_client from unauthorized changes by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2999">langchain-ai/langsmith-sdk#2999</a></li> <li>fix: gemini double counting of over 200k tokens by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3003">langchain-ai/langsmith-sdk#3003</a></li> <li>feat(python): cross-process OAuth refresh filesystem lock by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2988">langchain-ai/langsmith-sdk#2988</a></li> <li>feat(js): cross-process OAuth refresh filesystem lock by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2989">langchain-ai/langsmith-sdk#2989</a></li> <li>fix: avoid duplicate /v1 in hub URLs when endpoint includes /api/v1 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3008">langchain-ai/langsmith-sdk#3008</a></li> <li>chore: bump JS to 0.7.6 and Python to 0.8.12 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3011">langchain-ai/langsmith-sdk#3011</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.11...v0.8.12">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.11...v0.8.12</a></p> <h2>v0.8.11</h2> <h2>What's Changed</h2> <ul> <li>fix: match async feedback client to sync behavior [LSEN-206] by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3001">langchain-ai/langsmith-sdk#3001</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.10...v0.8.11">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.10...v0.8.11</a></p> <h2>v0.8.10</h2> <h2>What's Changed</h2> <ul> <li>feat(sandbox): size the dockerfile-build sandbox via vCpus/memBytes (js) by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2980">langchain-ai/langsmith-sdk#2980</a></li> <li>feat(python): support trace_id and retry-on-NotFound in async create_… by <a href="https://github.com/baskaryan"><code>@baskaryan</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2963">langchain-ai/langsmith-sdk#2963</a></li> <li>feat(python): expose pairwise comparison URL on ComparativeExperimentResults [LSE-2270] by <a href="https://github.com/harisaiharish"><code>@harisaiharish</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2975">langchain-ai/langsmith-sdk#2975</a></li> <li>feat(js): exposed pairwise comparison URL on ComparativeExperimentResults [LSE-2374] by <a href="https://github.com/harisaiharish"><code>@harisaiharish</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2981">langchain-ai/langsmith-sdk#2981</a></li> <li>feat(python): expose LS_MESSAGE_VIEW_EXCLUDE constant [lso-2605] by <a href="https://github.com/ybathula707"><code>@ybathula707</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2982">langchain-ai/langsmith-sdk#2982</a></li> <li>feat: support JS prompt commit tags by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2987">langchain-ai/langsmith-sdk#2987</a></li> <li>fix(lint): exclude _openapi_client from ruff by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2993">langchain-ai/langsmith-sdk#2993</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2911">langchain-ai/langsmith-sdk#2911</a></li> <li>fix(lint): exclude _openapi_client from mypy by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2995">langchain-ai/langsmith-sdk#2995</a></li> <li>chore: sync langsmith_api by <a href="https://github.com/langtions-bot"><code>@langtions-bot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2994">langchain-ai/langsmith-sdk#2994</a></li> <li>Add AWS auth proxy helpers to Python SDK by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2991">langchain-ai/langsmith-sdk#2991</a></li> <li>Add AWS auth proxy helpers to JS SDK by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2992">langchain-ai/langsmith-sdk#2992</a></li> <li>feat(evaluation): adding examples and repetitions to create tracer sessions calls by <a href="https://github.com/shamikkarkhanis"><code>@shamikkarkhanis</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2954">langchain-ai/langsmith-sdk#2954</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/3ac6bb8a5cde1f079265842f6f82273b0ce9e543"><code>3ac6bb8</code></a> chore(py): bump Python SDK to 0.8.14 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3013">#3013</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/36fe84563405928b73cdb2f28b2be8349c897515"><code>36fe845</code></a> feat: add deepagent compatibility smoke tests to Python and JS CI [LSDK-214] ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/572014cd2cbad1c26e6372614a1a972be9b086c7"><code>572014c</code></a> chore(py): bump Python SDK to 0.8.13 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3012">#3012</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/03f3b8c741efcbd595dd39849199b7ffa18b9c03"><code>03f3b8c</code></a> fix(py): type sandbox startup errors (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3004">#3004</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/607a3b6559eb6d3f30cb143e019019ea63563144"><code>607a3b6</code></a> chore: bump JS to 0.7.6 and Python to 0.8.12 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3011">#3011</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/fb6b283a8e482c8f3cdfbd76adc5dcf81eb22759"><code>fb6b283</code></a> fix: avoid duplicate /v1 in hub URLs when endpoint includes /api/v1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3008">#3008</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/faaaa13e2cdfd194674591a36768edadaaec2de8"><code>faaaa13</code></a> feat(js): cross-process OAuth refresh filesystem lock (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2989">#2989</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/cba1712f0071702ff0d0255847e6fa984697da24"><code>cba1712</code></a> feat(python): cross-process OAuth refresh filesystem lock (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2988">#2988</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/c4408f44c839d1f8947dbbfb0db3c086e8f7f579"><code>c4408f4</code></a> fix: gemini double counting of over 200k tokens (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/3003">#3003</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/cec161e7c57bfc0731d79f6b7a8757599abdfe9a"><code>cec161e</code></a> ci: protect _openapi_client from unauthorized changes (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2999">#2999</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.9...v0.8.14">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.9&new-version=0.8.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-11 21:44:42 -04:00
Mason Daugherty	05cc55f1bc	release(core): 1.4.6 (#38061 )	2026-06-11 02:58:40 -04:00
Mason Daugherty	447663fd8b	feat(partners): expose package versions for remaining partners (#38060 ) Chroma, Exa, Nomic, and Qdrant now expose package `__version__` values through package-local `_version.py` modules, matching the version-file pattern used by the other partner packages. Each package also gets a `check_version` target so release version drift between `pyproject.toml` and runtime exports is caught consistently.	2026-06-11 02:37:04 -04:00
Christophe BornetandMason Daugherty	1de100f278	chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (#36470 ) Originally a narrow bump of mypy to `1.20` in four packages. Expanded to get the whole monorepo onto a single, current mypy and a consistent type-check configuration, so contributors no longer hit different mypy versions and divergent behavior depending on which package they touch. ### What changed - Unified the mypy pin to `>=2.1.0,<2.2.0` in every mypy-using package (6 libs + 14 partners), replacing the previously scattered pins (`1.10`/`1.17`/`1.18`/`1.19`/`1.20`, with assorted upper bounds). - Unified the `[tool.mypy]` base per tier: - libs: `plugins = ["pydantic.mypy"]`, `strict = true`, `enable_error_code = "deprecated"`, `warn_unreachable = true` - partners: `disallow_untyped_defs = true` - Normalized style (`disallow_untyped_defs = "True"` string → bool, quote/key consistency). - Fixed the 20 real errors mypy 2.1 surfaces: `redundant-cast` from improved narrowing (`core`, `langchain-classic`), a `var-annotated` for `_LOGGED`, a return-type widening in `langchain-groq`'s `_convert_from_v1_to_groq` (it can legitimately return a bare `str`), and stale `type-arg`/`unused-ignore` in `langchain-model-profiles` tests. ### Deliberate non-uniformity (documented inline in the relevant `pyproject.toml`s) Going fully byte-identical would surface ~196 additional errors that are not real bugs, so two settings are kept package-appropriate: - `warn_unreachable` is enabled on every strict lib except `core`, where it false-flags intentional defensive code — including the SSRF / IP-policy guards in `_security/` — as unreachable. - `pydantic.mypy` plugin is used only on `anthropic` and `perplexity` (their code is authored against it and reports ~99/~132 errors without it). It is not added to the other partners, where it only flags the public alias constructor API (e.g. `ChatGroq(model=...)`) in tests rather than finding bugs. - `ollama` is left on its `ty` type checker; it does not use mypy. --------- Co-authored-by: Mason Daugherty <github@mdrxy.com>	2026-06-11 00:24:59 -04:00
Mason Daugherty	c0103c3d2c	hotfix(openai): min core dep (#37990 )	2026-06-09 16:32:08 -04:00
Mason Daugherty	3b999176c8	test(langchain,partners): disable pytest-benchmark under xdist to silence `PytestBenchmarkWarning` (#37901 ) Test targets run with `-n auto`, which makes `pytest-benchmark` (present via `langchain-tests`) auto-disable itself and emit a `PytestBenchmarkWarning` once per xdist worker. Passing `--benchmark-disable` turns the plugin off explicitly so the warning never fires, matching what `core` and `langchain_v1` already do. ## Changes - Add `--benchmark-disable` to the `-n auto` test targets across `langchain` (unit) and 14 partner packages' integration targets: `anthropic`, `chroma`, `deepseek`, `exa`, `fireworks`, `groq`, `huggingface`, `mistralai`, `nomic`, `ollama`, `openai`, `openrouter`, `qdrant`, `xai`. - Deliberately excluded `text-splitters` and `model-profiles`: their `test` group doesn't install `pytest-benchmark`, so the flag would fail with `unrecognized arguments`. Verified by importing the plugin under each package's actual dependency group before editing.	2026-06-04 13:25:26 -04:00
dependabot[bot]	d55c08bc72	chore: bump langsmith from 0.8.7 to 0.8.9 in /libs/partners/chroma (#37884 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.7 to 0.8.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.9</h2> <h2>What's Changed</h2> <ul> <li>feat(sandbox): add JS Dockerfile snapshots by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2951">langchain-ai/langsmith-sdk#2951</a></li> <li>chore(deps-dev): bump the js-minor-and-patch group across 1 directory with 11 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2931">langchain-ai/langsmith-sdk#2931</a></li> <li>chore(deps): bump websockets from 15.0.1 to 16.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2811">langchain-ai/langsmith-sdk#2811</a></li> <li>chore(deps): update myst-parser requirement from >=3 to >=4.0.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2841">langchain-ai/langsmith-sdk#2841</a></li> <li>chore(deps): bump the py-minor-and-patch group across 1 directory with 19 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2934">langchain-ai/langsmith-sdk#2934</a></li> <li>chore(deps): bump typescript from 5.9.3 to 6.0.3 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2839">langchain-ai/langsmith-sdk#2839</a></li> <li>chore(deps-dev): bump google-adk from 1.10.0 to 2.1.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2960">langchain-ai/langsmith-sdk#2960</a></li> <li>chore(deps-dev): bump wrapt from 1.17.3 to 2.2.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2961">langchain-ai/langsmith-sdk#2961</a></li> <li>chore(deps-dev): bump the py-minor-and-patch group in /python with 6 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2958">langchain-ai/langsmith-sdk#2958</a></li> <li>chore(deps-dev): bump types-tqdm from 4.67.3.20260408 to 4.67.3.20260518 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2959">langchain-ai/langsmith-sdk#2959</a></li> <li>ci: add minimum workflow permissions by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2967">langchain-ai/langsmith-sdk#2967</a></li> <li>chore: update dependabot.yml to comply with posture checks by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2966">langchain-ai/langsmith-sdk#2966</a></li> <li>test(python): deflake test_tracing_queue_limit_drops_when_full by <a href="https://github.com/baskaryan"><code>@baskaryan</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2964">langchain-ai/langsmith-sdk#2964</a></li> <li>feat(sandbox): size the dockerfile-build sandbox via vcpus/mem_bytes (python) by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2979">langchain-ai/langsmith-sdk#2979</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.8...v0.8.9">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.8...v0.8.9</a></p> <h2>v0.8.8</h2> <h2>What's Changed</h2> <ul> <li>fix(python): retry sandbox pool timeouts by <a href="https://github.com/baskaryan"><code>@baskaryan</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2953">langchain-ai/langsmith-sdk#2953</a></li> <li>fix(sandbox): build Dockerfile snapshots off /tmp by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2956">langchain-ai/langsmith-sdk#2956</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.7...v0.8.8">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.7...v0.8.8</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1eda04b4e86a93befecbd869aef6022e7f516837"><code>1eda04b</code></a> feat(sandbox): size the dockerfile-build sandbox via vcpus/mem_bytes (python)...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/5960910cbe044dca6a0961f099577f41166f9601"><code>5960910</code></a> test(python): deflake test_tracing_queue_limit_drops_when_full (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2964">#2964</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/846d4c5b17580b86618bd9a1573759e19d0cf647"><code>846d4c5</code></a> chore: update dependabot.yml to comply with posture checks (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2966">#2966</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/48b66b3ccaa0d2a305ffd1656e18bd4297af019f"><code>48b66b3</code></a> ci: add minimum workflow permissions (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2967">#2967</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d0a93ac8a2872cf2dc6f7cb7a17645b21816d9c7"><code>d0a93ac</code></a> chore(deps-dev): bump types-tqdm from 4.67.3.20260408 to 4.67.3.20260518 in /...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/fc9ba745e3797950d0c97fce8d68c63c7915e60c"><code>fc9ba74</code></a> chore(deps-dev): bump the py-minor-and-patch group in /python with 6 updates ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d54e69b689029994d23cb6876a8e87c6e64a3e79"><code>d54e69b</code></a> chore(deps-dev): bump wrapt from 1.17.3 to 2.2.1 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2961">#2961</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1d212585b886f79130db74c6741240ab79fc62bd"><code>1d21258</code></a> chore(deps-dev): bump google-adk from 1.10.0 to 2.1.0 in /python (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2960">#2960</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/b66d791bfec699eb5fc26df1e81be8b9a6677c2c"><code>b66d791</code></a> chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /js (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2839">#2839</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/a0f9eff836623cce60bdcabb2a33275d8ec741ee"><code>a0f9eff</code></a> chore(deps): bump the py-minor-and-patch group across 1 directory with 19 upd...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.7...v0.8.9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.7&new-version=0.8.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 19:11:00 -04:00
dependabot[bot]	4a7476093d	chore: bump chromadb from 1.5.5 to 1.5.9 in /libs/partners/chroma (#37779 ) Bumps [chromadb](https://github.com/chroma-core/chroma) from 1.5.5 to 1.5.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chroma-core/chroma/releases">chromadb's releases</a>.</em></p> <blockquote> <h2>1.5.9</h2> <p>Version: <code>1.5.9</code> Git ref: <code>refs/tags/1.5.9</code> Build Date: <code>2026-05-05T05:55</code> PIP Package: <code>chroma-1.5.9.tar.gz</code> Github Container Registry Image: <code>:1.5.9</code> DockerHub Image: <code>:1.5.9</code></p> <h2>What's Changed</h2> <ul> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/frontend">ENH</a>: block functions on topology dbs by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6836">chroma-core/chroma#6836</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/faults">ENH</a>: Add Tilt fault injection CLI by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6881">chroma-core/chroma#6881</a></li> <li>[CHORE] Debug TimeoutError in test_add.py by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6905">chroma-core/chroma#6905</a></li> <li>[ENH]: Enable rebuilds for sharded collections by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6916">chroma-core/chroma#6916</a></li> <li>[ENH]: Group by support with sharding by <a href="https://github.com/sanketkedia"><code>@sanketkedia</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6909">chroma-core/chroma#6909</a></li> <li>[CHORE]: Denormalize tenant and database into collection_compaction_cursors table by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6940">chroma-core/chroma#6940</a></li> <li>[CHORE] Use normalized record sets for test add by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6935">chroma-core/chroma#6935</a></li> <li>[ENH]: Add workflow to build and publish service container images by <a href="https://github.com/jasonvigil"><code>@jasonvigil</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6944">chroma-core/chroma#6944</a></li> <li>[ENH] - Updates language around Chroma Cloud to be more representative. by <a href="https://github.com/tjkrusinskichroma"><code>@tjkrusinskichroma</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6952">chroma-core/chroma#6952</a></li> <li>[ENH]: Add change stream to collection compaction cursors by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6955">chroma-core/chroma#6955</a></li> <li>[BUG] Switch to storing DOCKERHUB_USERNAME as var by <a href="https://github.com/jasonvigil"><code>@jasonvigil</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6962">chroma-core/chroma#6962</a></li> <li>[CHORE]: Standardize Tilt CI image build on root docker-bake.hcl by <a href="https://github.com/jasonvigil"><code>@jasonvigil</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6958">chroma-core/chroma#6958</a></li> <li>[BUG]: Rename database on soft delete by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6943">chroma-core/chroma#6943</a></li> <li>Revert "[CHORE]: Standardize Tilt CI image build on root docker-bake.hcl" by <a href="https://github.com/jasonvigil"><code>@jasonvigil</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6965">chroma-core/chroma#6965</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/system">ENH</a>: name and size all worker threads by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6936">chroma-core/chroma#6936</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/test">BUG</a>: simplify flaky indexing progress test by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6968">chroma-core/chroma#6968</a></li> <li>[CHORE] stabilize Tilt dev environment configs by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6937">chroma-core/chroma#6937</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/garbage_collector">BUG</a>: use correct version file per collection in ancestor walk by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6970">chroma-core/chroma#6970</a></li> <li>[ENH] Add SparsePostingBlock by <a href="https://github.com/HammadB"><code>@HammadB</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6823">chroma-core/chroma#6823</a></li> <li>[ENH] Add basic maxscore writer/reader by <a href="https://github.com/HammadB"><code>@HammadB</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6825">chroma-core/chroma#6825</a></li> <li>[ENH] Add maxscore lazy cursor by <a href="https://github.com/HammadB"><code>@HammadB</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6829">chroma-core/chroma#6829</a></li> <li>[ENH] Add SIMD for maxscore by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6865">chroma-core/chroma#6865</a></li> <li>[ENH] Benchmark maxscore by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6866">chroma-core/chroma#6866</a></li> <li>[ENH] Add maxscore option in schema by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6878">chroma-core/chroma#6878</a></li> <li>[ENH] Add maxscore index to metadata segment by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6880">chroma-core/chroma#6880</a></li> <li>[ENH] Wire maxscore reader in search by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6899">chroma-core/chroma#6899</a></li> <li>[PERF] Batch load lazy cursor by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6974">chroma-core/chroma#6974</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/garbage_collector">ENH</a>: add MCMR support for log GC by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6946">chroma-core/chroma#6946</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/test">ENH</a>: parameterize multi-region config by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6951">chroma-core/chroma#6951</a></li> <li>[CHORE] fix merge conflict in main by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6986">chroma-core/chroma#6986</a></li> <li>[ENH]: Refactor offset_id to be a mutable AtomicU32 in record by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6922">chroma-core/chroma#6922</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/spanner">ENH</a>: add spanner-cli wrapper binary by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6959">chroma-core/chroma#6959</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/sysdb">BUG</a>: preserve legacy hnsw: metadata keys by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6953">chroma-core/chroma#6953</a></li> <li>[TST] refactor repair collection log offset test by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6954">chroma-core/chroma#6954</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/garbage_collector">TST</a>: add MCMR hard delete test by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6947">chroma-core/chroma#6947</a></li> <li><a href="https://github.com/chroma-core/chroma/blob/HEAD/log-service">ENH</a>: defer Spanner init to first use by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6915">chroma-core/chroma#6915</a></li> <li>[CHORE]: Denormalize is_deleted in mcmr by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6989">chroma-core/chroma#6989</a></li> <li>[BUG] Reject NaN/Infinity in base64-encoded embeddings by <a href="https://github.com/philipithomas"><code>@philipithomas</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6664">chroma-core/chroma#6664</a></li> <li>Revert "<a href="https://github.com/chroma-core/chroma/blob/HEAD/garbage_collector">TST</a>: add MCMR hard delete test" by <a href="https://github.com/rescrv"><code>@rescrv</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6992">chroma-core/chroma#6992</a></li> <li>[ENH] Verify file path for compaction by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6991">chroma-core/chroma#6991</a></li> <li>[DOC]: Document file-upload sync API, AWS credential reuse, and EU region by <a href="https://github.com/philipithomas"><code>@philipithomas</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/6988">chroma-core/chroma#6988</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chroma-core/chroma/commit/11f3c7435e71024aa0a2b53710a28d3289d922d1"><code>11f3c74</code></a> [RELEASE] CLI 1.4.4 Python 1.5.9 JS 3.4.5 (<a href="https://redirect.github.com/chroma-core/chroma/issues/7018">#7018</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/f16d06a3b94dea8c337d481772e7f660164d0575"><code>f16d06a</code></a> [ENH]: add client header to Gemini embedding functions (<a href="https://redirect.github.com/chroma-core/chroma/issues/6990">#6990</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/b7cb6acb3fcedfd4cb310b8d550366de070dd56b"><code>b7cb6ac</code></a> [CHORE]: Remove foundation/ from chroma (<a href="https://redirect.github.com/chroma-core/chroma/issues/7017">#7017</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/bec3105aa071813cf6ec660b5040d7efd705fb61"><code>bec3105</code></a> <a href="foundation-cli">ENH</a>: Add login, logout, and whoami commands (<a href="https://redirect.github.com/chroma-core/chroma/issues/7007">#7007</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/1251ff7659e21f3f25cc53941cd2b95c17e4482f"><code>1251ff7</code></a> [DOC] Add CLAUDE.md, AGENTS.md, scoped Rust rule (<a href="https://redirect.github.com/chroma-core/chroma/issues/7010">#7010</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/f4bbbf2e3300c1c2e676b1b9339fb917b3842bd5"><code>f4bbbf2</code></a> [BLD] Add foundation CLI install script (<a href="https://redirect.github.com/chroma-core/chroma/issues/7005">#7005</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/2c8f49f0d06f45ea1dcf007a53afbe023935e387"><code>2c8f49f</code></a> <a href="ci">ENH</a>: move foundation/ to top-level so rust/** filters skip it (<a href="https://redirect.github.com/chroma-core/chroma/issues/7008">#7008</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/51eebdb588f15d22f3d91ac146f302224f869e92"><code>51eebdb</code></a> [ENH] scaffold foundation CLI project (<a href="https://redirect.github.com/chroma-core/chroma/issues/6999">#6999</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/874b700beb9d2ac5178ccf4538f3fecfe5469390"><code>874b700</code></a> <a href="gc">ENH</a>: GC empty MCMR collections (<a href="https://redirect.github.com/chroma-core/chroma/issues/6961">#6961</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/aedf9a668d9d14dc9b3211ba156f1f4fcb2e2a4c"><code>aedf9a6</code></a> <a href="rust-client">ENH</a>: Add read-only backend failover (<a href="https://redirect.github.com/chroma-core/chroma/issues/6985">#6985</a>)</li> <li>Additional commits viewable in <a href="https://github.com/chroma-core/chroma/compare/1.5.5...1.5.9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=chromadb&package-manager=uv&previous-version=1.5.5&new-version=1.5.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-29 18:20:43 -04:00
dependabot[bot]	7336690902	chore: bump langsmith from 0.8.3 to 0.8.7 in /libs/partners/chroma (#37780 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.8.3 to 0.8.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.7</h2> <h2>What's Changed</h2> <ul> <li>fix: reconnect sandbox command streams on EOF by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2941">langchain-ai/langsmith-sdk#2941</a></li> <li>feat(sandbox): build snapshots from Dockerfiles by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2950">langchain-ai/langsmith-sdk#2950</a></li> <li>fix(python): add organization id to context URLs by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2945">langchain-ai/langsmith-sdk#2945</a></li> <li>fix(js): add organization id to context URLs by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2946">langchain-ai/langsmith-sdk#2946</a></li> <li>release(py): 0.8.7 by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2947">langchain-ai/langsmith-sdk#2947</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.6...v0.8.7">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.6...v0.8.7</a></p> <h2>v0.8.6</h2> <h2>What's Changed</h2> <ul> <li>chore(deps-dev): bump <code>@google/genai</code> from 1.50.1 to 2.0.1 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2875">langchain-ai/langsmith-sdk#2875</a></li> <li>chore(deps): bump mako from 1.3.11 to 1.3.12 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2880">langchain-ai/langsmith-sdk#2880</a></li> <li>chore(deps): bump authlib from 1.6.11 to 1.6.12 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2888">langchain-ai/langsmith-sdk#2888</a></li> <li>chore(deps): bump hono from 4.12.15 to 4.12.18 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2894">langchain-ai/langsmith-sdk#2894</a></li> <li>chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2895">langchain-ai/langsmith-sdk#2895</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.94.0 to 0.95.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2881">langchain-ai/langsmith-sdk#2881</a></li> <li>chore(deps): bump postcss from 8.5.8 to 8.5.14 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2898">langchain-ai/langsmith-sdk#2898</a></li> <li>chore(deps): bump <code>@protobufjs/utf8</code> from 1.1.0 to 1.1.1 in /js/internal/environment_tests/test-exports-vite in the npm_and_yarn group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2908">langchain-ai/langsmith-sdk#2908</a></li> <li>chore(deps): bump hono from 4.12.18 to 4.12.19 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2909">langchain-ai/langsmith-sdk#2909</a></li> <li>chore(deps): bump protobufjs from 7.5.7 to 8.0.1 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2896">langchain-ai/langsmith-sdk#2896</a></li> <li>chore(deps): bump idna from 3.11 to 3.15 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2913">langchain-ai/langsmith-sdk#2913</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.95.0 to 0.95.1 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2912">langchain-ai/langsmith-sdk#2912</a></li> <li>AI SDK telemetry and AI SDK v7 support by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2901">langchain-ai/langsmith-sdk#2901</a></li> <li>feat: install websockets by default for sandbox by <a href="https://github.com/open-swe"><code>@open-swe</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2916">langchain-ai/langsmith-sdk#2916</a></li> <li>release(js): 0.7.2 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2922">langchain-ai/langsmith-sdk#2922</a></li> <li>feat: add list_runs_from_annotation_queue method [closes LSDK-193] by <a href="https://github.com/open-swe"><code>@open-swe</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2892">langchain-ai/langsmith-sdk#2892</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.95.1 to 0.95.2 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2917">langchain-ai/langsmith-sdk#2917</a></li> <li>chore(deps-dev): bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260518 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2927">langchain-ai/langsmith-sdk#2927</a></li> <li>chore(deps): update pydata-sphinx-theme requirement from >=0.15 to >=0.18.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2928">langchain-ai/langsmith-sdk#2928</a></li> <li>chore: exclude langsmith_api from ruff linter by <a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2933">langchain-ai/langsmith-sdk#2933</a></li> <li>fix(python): retry sandbox connect timeouts by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2940">langchain-ai/langsmith-sdk#2940</a></li> <li>fix(js): [LSDK-202] return context hub URLs for pushed contexts by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2939">langchain-ai/langsmith-sdk#2939</a></li> <li>fix(python): RunTree.create_child appends to self.child_runs LSE-2221 by <a href="https://github.com/catherine-langchain"><code>@catherine-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2942">langchain-ai/langsmith-sdk#2942</a></li> <li>release(js): 0.7.3 by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2943">langchain-ai/langsmith-sdk#2943</a></li> <li>fix(python): [LSDK-202] return context hub URLs for pushed contexts by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2938">langchain-ai/langsmith-sdk#2938</a></li> <li>release(py): 0.8.6 by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2944">langchain-ai/langsmith-sdk#2944</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/KiewanVillatel"><code>@KiewanVillatel</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2933">langchain-ai/langsmith-sdk#2933</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.5...v0.8.6">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.5...v0.8.6</a></p> <h2>v0.8.5</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.7.0 by <a href="https://github.com/ramon-langchain"><code>@ramon-langchain</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2890">langchain-ai/langsmith-sdk#2890</a></li> <li>fix(js): add alias for <code>experimental/sandbox</code> to appease broad peer dep range within <code>deepagents</code> by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2893">langchain-ai/langsmith-sdk#2893</a></li> <li>feat(js): allow disabling multipart streaming via env variable by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2900">langchain-ai/langsmith-sdk#2900</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1b3bfc44efe00643c5906af90eb7868e45ad830a"><code>1b3bfc4</code></a> release(py): 0.8.7 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2947">#2947</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/9303f0b9187140ff4ed89b89553b499fe369d48d"><code>9303f0b</code></a> fix(js): add organization id to context URLs (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2946">#2946</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/cf028ed6f4d3aac3b8bd762b0440b69ae5fa5bbd"><code>cf028ed</code></a> fix(python): add organization id to context URLs (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2945">#2945</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/52305b2815bfc693f64db9b211f588ac2cd99845"><code>52305b2</code></a> feat(sandbox): build snapshots from Dockerfiles (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2950">#2950</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/cb9e116bed4d8854118c1fb4a654a3afb0efa875"><code>cb9e116</code></a> fix: reconnect sandbox command streams on EOF (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2941">#2941</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/29f6e07681b25e874a887135edf82ba249c584d8"><code>29f6e07</code></a> release(py): 0.8.6 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2944">#2944</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/33f89aaf1900318c864e1572d326b65fa5f96b3f"><code>33f89aa</code></a> fix(python): [LSDK-202] return context hub URLs for pushed contexts (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2938">#2938</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/4e1a29b8ecdf6d80e974a9ae3f1b29e77c9b9b6c"><code>4e1a29b</code></a> release(js): 0.7.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2943">#2943</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/6bd9365bafc246e337b67ab29e6d87f66f96c8ca"><code>6bd9365</code></a> fix(python): RunTree.create_child appends to self.child_runs LSE-2221 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2942">#2942</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/df9735d0badd2b07f557e8ecf1f4765e1c03e1ab"><code>df9735d</code></a> fix(js): [LSDK-202] return context hub URLs for pushed contexts (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2939">#2939</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.3...v0.8.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.8.3&new-version=0.8.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-29 18:20:35 -04:00
Mason Daugherty	aef86c476d	chore(infra): bump `langchain-tests` floor to 1.1.9 (#37610 ) Bumps the `langchain-tests` minimum across the monorepo from `1.0.0` to `1.1.9` and adds a partner-level `Makefile` so partner lockfiles can be regenerated in one command, matching the existing convention under `libs/`.	2026-05-21 13:36:22 -05:00
dependabot[bot]	0e97e85a09	chore: bump idna from 3.10 to 3.15 in /libs/partners/chroma (#37562 ) Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> <h2>3.11 (2025-10-12)</h2> <ul> <li>Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.10...v3.15">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 17:58:17 +00:00
Mason Daugherty	abd9d4ce31	ci(infra): harden Dependabot version-bound preservation (#37510 ) Dependabot has been stripping upper/lower bounds from internal `langchain-*` deps in partner `pyproject.toml` files (e.g. #37288 reduced `langchain-core>=1.3.2,<2.0.0` to bare `langchain-core`). Locks down the config so bumps preserve existing specifiers, and restores the bounds it already mangled across the monorepo. ## Changes - Add `versioning-strategy: increase` to every `uv` ecosystem block in `.github/dependabot.yml` so future bumps move the lower bound in place instead of rewriting the constraint. - Ignore workspace-internal packages (`langchain-core`, `langchain`, `langchain-classic`, `langchain-text-splitters`, `langchain-tests`, `langchain-model-profiles`) on every `uv` block — these are editable installs from local paths and their published constraints are hand-curated for release, not Dependabot's to bump. - Restore stripped bounds across all `libs/` packages — runtime `dependencies` and every dep group (`test`, `dev`, `test_integration`, `typing`, `lint`) — to `>=1.4.0,<2.0.0` for `langchain-core` and `>=1.0.0,<2.0.0` for the other internal packages.	2026-05-18 17:24:19 -05:00
dependabot[bot]	ac47d547af	chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/chroma (#37333 ) [//]: # (dependabot-start) ⚠️ Dependabot is rebasing this PR ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a> Release 2.7.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a> Fix a misleading example for <code>ProxyManager</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a> Switch to nightly PyPy3.11 in CI for now (<a href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a> Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when <code>amt=0</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a> Bump dev dependencies (<a href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a> Upgrade mypy to version 1.20.2 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a> Drop support for EOL PyPy3.10 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a> Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix warnings (<a href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=uv&previous-version=2.6.3&new-version=2.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-11 11:19:54 -07:00
dependabot[bot]	d972968b86	chore: bump langchain-core from 1.3.2 to 1.3.3 in /libs/partners/chroma (#37284 ) [//]: # (dependabot-start) ⚠️ Dependabot is rebasing this PR ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [langchain-core](https://github.com/langchain-ai/langchain) from 1.3.2 to 1.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.3.3</h2> <p>Changes since langchain-core==1.3.2</p> <p>release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>) fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>) fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>) chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37109">#37109</a>) chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37129">#37129</a>) fix(core): preserve structured <code>inputs</code> on tool runs in tracers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37108">#37108</a>) release(perplexity): 1.2.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37091">#37091</a>) chore(docs): update x handle references (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37081">#37081</a>) fix(core): make <code>removal</code> optional in <code>warn_deprecated</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37056">#37056</a>) fix(core): validate batch_size in _batch and _abatch to prevent infinite loop (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36663">#36663</a>) chore(core): mark stream_v2/astream_v2 as beta (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36992">#36992</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07"><code>5039dfe</code></a> release(core): 1.3.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37198">#37198</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82"><code>55a7707</code></a> fix(core): set deprecation <code>since</code> to 1.3.3 to match release (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37200">#37200</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22"><code>c979c61</code></a> fix(core, langchain): harden <code>load()</code> against untrusted manifests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37197">#37197</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b"><code>d703110</code></a> docs: update README.md (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37190">#37190</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7"><code>4d50a2a</code></a> ci(infra): run pre-release checks before TestPyPI publish (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37194">#37194</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25"><code>9bd730e</code></a> fix(fireworks): require <code>api_key</code> in <code>FireworksEmbeddings</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37193">#37193</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04"><code>f475f41</code></a> release(mistralai): 1.1.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37191">#37191</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97"><code>7dbff48</code></a> fix(mistralai): strip non-wire keys from <code>ToolMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37188">#37188</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c"><code>913816c</code></a> release(fireworks): 1.3.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37189">#37189</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114"><code>4498d3d</code></a> fix(fireworks): strip non-wire keys from <code>ToolMessage</code> text content blocks (#...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.3.2...langchain-core==1.3.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langchain-core&package-manager=uv&previous-version=1.3.2&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:55 -04:00
dependabot[bot]	d29a1804f5	chore: bump langsmith from 0.7.31 to 0.8.3 in /libs/partners/chroma (#37285 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.7.31 to 0.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.8.3</h2> <h2>What's Changed</h2> <ul> <li>fix(js): prevent sending [object Object] as span attribute when dealing with nested objects, send full langsmith.usage_metadata if present by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2845">langchain-ai/langsmith-sdk#2845</a></li> <li>release(js): bump to 0.6.2 by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2856">langchain-ai/langsmith-sdk#2856</a></li> <li>sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_seconds by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2853">langchain-ai/langsmith-sdk#2853</a></li> <li>sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2854">langchain-ai/langsmith-sdk#2854</a></li> <li>Fix push_agent URL owner for name-only identifiers by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2862">langchain-ai/langsmith-sdk#2862</a></li> <li>docs(langsmith): clarify trust boundaries when working with hub by <a href="https://github.com/eyurtsev"><code>@eyurtsev</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2861">langchain-ai/langsmith-sdk#2861</a></li> <li>release(py): 0.8.3 by <a href="https://github.com/vishnu-ssuresh"><code>@vishnu-ssuresh</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2863">langchain-ai/langsmith-sdk#2863</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.2...v0.8.3</a></p> <h2>v0.8.2</h2> <h2>What's Changed</h2> <ul> <li>Bump JS SDK version to 0.6.1 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2847">langchain-ai/langsmith-sdk#2847</a></li> <li>fix: parse urllib3 version with packaging.Version by <a href="https://github.com/justinwolfington"><code>@justinwolfington</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> <li>Bump Python SDK version to 0.8.2 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2855">langchain-ai/langsmith-sdk#2855</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/justinwolfington"><code>@justinwolfington</code></a> made their first contribution in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2851">langchain-ai/langsmith-sdk#2851</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.1...v0.8.2</a></p> <h2>v0.8.1</h2> <h2>What's Changed</h2> <ul> <li>chore(js): remove experimental opencode integration by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2836">langchain-ai/langsmith-sdk#2836</a></li> <li>chore(deps-dev): bump google-adk from 1.10.0 to 1.28.1 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2823">langchain-ai/langsmith-sdk#2823</a></li> <li>chore(deps): bump postcss from 8.5.8 to 8.5.12 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2827">langchain-ai/langsmith-sdk#2827</a></li> <li>Add JS profile loading by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2834">langchain-ai/langsmith-sdk#2834</a></li> <li>Add Python profile loading by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2835">langchain-ai/langsmith-sdk#2835</a></li> <li>Extract JS profile auth service by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2846">langchain-ai/langsmith-sdk#2846</a></li> <li>Bump Python SDK version to 0.8.1 by <a href="https://github.com/langchain-infra"><code>@langchain-infra</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2848">langchain-ai/langsmith-sdk#2848</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1">https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.0...v0.8.1</a></p> <h2>v0.8.0</h2> <h2>What's Changed</h2> <ul> <li>feat(js,py): JS 0.6.0, Py 0.8.0 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831">langchain-ai/langsmith-sdk#2831</a></li> <li>release(js): 0.6.0 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832">langchain-ai/langsmith-sdk#2832</a></li> <li>release(py): 0.8.0 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833">langchain-ai/langsmith-sdk#2833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0</a></p> <h2>v0.7.38</h2> <h2>What's Changed</h2> <ul> <li>feat(js): add tracing of opencode by <a href="https://github.com/dqbd"><code>@dqbd</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2776">langchain-ai/langsmith-sdk#2776</a></li> <li>chore(js): Remove types/uuid by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2814">langchain-ai/langsmith-sdk#2814</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/e2386ad8aae7f6deb5c182228007606494e69bc7"><code>e2386ad</code></a> release(py): 0.8.3 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2863">#2863</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/11d51a370f30c622c6eac4e9ba3ee9477ef220bb"><code>11d51a3</code></a> docs(langsmith): clarify trust boundaries when working with hub (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2861">#2861</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/d98c3ed8a991cce2fb2dc1658f502f7595c415a0"><code>d98c3ed</code></a> Fix push_agent URL owner for name-only identifiers (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2862">#2862</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/418fd415fc25c5229b12fb94f86ae3c319daf711"><code>418fd41</code></a> sdk(js): replace ttlSeconds with idleTtlSeconds + deleteAfterStopSeconds (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2854">#2854</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/1baa2c197d5e18b1e88021ca509250d12f5ff74c"><code>1baa2c1</code></a> sdk(py): replace ttl_seconds with idle_ttl_seconds + delete_after_stop_second...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/361c8dd869001f2dcc74ba868bee8ba869de1fb5"><code>361c8dd</code></a> release(js): bump to 0.6.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2856">#2856</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/0d42882f2dfdb713821b5710cbc51e6b412a8c59"><code>0d42882</code></a> fix(js): prevent sending [object Object] as span attribute when dealing with ...</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/619818ba8d953a149803ee444be19a200be07aa5"><code>619818b</code></a> Bump Python SDK version to 0.8.2 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2855">#2855</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/8a7d3c135679b2865a3ae92ccf6a07822f524158"><code>8a7d3c1</code></a> fix: parse urllib3 version with packaging.Version (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2851">#2851</a>)</li> <li><a href="https://github.com/langchain-ai/langsmith-sdk/commit/54f887704f36c2d51d9b6f8ac4c456c9021a375b"><code>54f8877</code></a> Bump JS SDK version to 0.6.1 (<a href="https://redirect.github.com/langchain-ai/langsmith-sdk/issues/2847">#2847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.31...v0.8.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.7.31&new-version=0.8.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 12:20:30 -04:00
open-swe[bot]open-swe[bot]Mason Daugherty	ba897ffa7e	chore(docs): update x handle references (#37081 ) ## Description Updates package metadata and README badges so LangChain social links point to the new `@langchain_oss` X handle. This was completed with AI-agent assistance. ## Test Plan - [ ] Validate README badges and package metadata links point to `https://x.com/langchain_oss` _Opened collaboratively by Mason Daugherty and open-swe._ --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Mason Daugherty <61371264+mdrxy@users.noreply.github.com>	2026-04-29 13:56:09 -04:00
Mason Daugherty	56d6e89be0	hotfix: bump min core versions (#36996 )	2026-04-24 15:23:28 -04:00
Nick Hollon	9ce72eba9f	feat(core): add content-block-centric streaming (v2) (#36834 )	2026-04-24 11:36:17 -04:00
Nick Hollon	ffaac42bf9	ci(infra): add `pytest-xdist` to partner test groups (#36988 )	2026-04-24 13:23:03 +00:00
Mason Daugherty	b57eea2aed	hotfix(ci): remove nobenchmark flag (#36959 )	2026-04-22 17:39:52 -04:00
Mason Daugherty	ec337534c5	chore(partners): standardize integration test invocation (#36958 ) Standardize the `integration_tests` Makefile target across all 15 partner packages in `libs/partners/`, mirroring the deepagents `libs/evals` pattern (`-v --tb=short`). Previously each partner had its own ad-hoc flag stack (some missing `-n auto`, some with `-vvv`, others with nothing), and every partner that used `-n auto` was emitting a `PytestBenchmarkWarning` because `pytest-benchmark` is pulled in transitively via `langchain-tests` even though no partner has benchmark tests.	2026-04-22 17:28:04 -04:00
dependabot[bot]	e3a781cc26	chore: bump python-dotenv from 1.1.1 to 1.2.2 in /libs/partners/chroma (#36926 ) Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.1.1 to 1.2.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/theskumar/python-dotenv/releases">python-dotenv's releases</a>.</em></p> <blockquote> <h2>v1.2.2</h2> <h3>Added</h3> <ul> <li>Support for Python 3.14, including the free-threaded (3.14t) build. (#)</li> </ul> <h3>Changed</h3> <ul> <li>The <code>dotenv run</code> command now forwards flags directly to the specified command by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/607">theskumar/python-dotenv#607</a></li> <li>Improved documentation clarity regarding override behavior and the reference page.</li> <li>Updated PyPy support to version 3.11.</li> <li>Documentation for FIFO file support.</li> <li>Support for Python 3.9.</li> </ul> <h3>Fixed</h3> <ul> <li>Improved <code>set_key</code> and <code>unset_key</code> behavior when interacting with symlinks by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href="https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311">#790c5</a></li> <li>Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by <a href="https://github.com/JYOuyang"><code>@JYOuyang</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/590">theskumar/python-dotenv#590</a></li> </ul> <h3>Breaking Changes</h3> <ul> <li> <p><code>dotenv.set_key</code> and <code>dotenv.unset_key</code> used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, <code>follow_symlinks=True</code> should be used.</p> </li> <li> <p>In the CLI, <code>set</code> and <code>unset</code> used to follow symlinks in some situations. This is no longer the case.</p> </li> <li> <p><code>dotenv.set_key</code>, <code>dotenv.unset_key</code> and the CLI commands <code>set</code> and <code>unset</code> used to reset the file mode of the modified .env file to <code>0o600</code> in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode <code>0o600</code> is used.</p> </li> </ul> <h3>Misc</h3> <ul> <li>skip 000 permission tests for root user by <a href="https://github.com/burnout-projects"><code>@burnout-projects</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/561">theskumar/python-dotenv#561</a></li> <li>Bump actions/checkout from 5 to 6 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/593">theskumar/python-dotenv#593</a></li> <li>Add Windows testing to CI by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/604">theskumar/python-dotenv#604</a></li> <li>Improve workflow efficiency with best practices by <a href="https://github.com/theskumar"><code>@theskumar</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/609">theskumar/python-dotenv#609</a></li> <li>Remove the use of <code>sh</code> in tests by <a href="https://github.com/bbc2"><code>@bbc2</code></a> in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/612">theskumar/python-dotenv#612</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/JYOuyang"><code>@JYOuyang</code></a> made their first contribution in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/590">theskumar/python-dotenv#590</a></li> <li><a href="https://github.com/burnout-projects"><code>@burnout-projects</code></a> made their first contribution in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/561">theskumar/python-dotenv#561</a></li> <li><a href="https://github.com/cpackham-atlnz"><code>@cpackham-atlnz</code></a> made their first contribution in <a href="https://redirect.github.com/theskumar/python-dotenv/pull/597">theskumar/python-dotenv#597</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2">https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2</a></p> <h2>v1.2.1</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md">python-dotenv's changelog</a>.</em></p> <blockquote> <h2>[1.2.2] - 2026-03-01</h2> <h3>Added</h3> <ul> <li>Support for Python 3.14, including the free-threaded (3.14t) build. (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/588">#588</a>)</li> </ul> <h3>Changed</h3> <ul> <li>The <code>dotenv run</code> command now forwards flags directly to the specified command by [<a href="https://github.com/bbc2"><code>@bbc2</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/607">#607</a></li> <li>Improved documentation clarity regarding override behavior and the reference page.</li> <li>Updated PyPy support to version 3.11.</li> <li>Documentation for FIFO file support.</li> <li>Dropped Support for Python 3.9.</li> </ul> <h3>Fixed</h3> <ul> <li>Improved <code>set_key</code> and <code>unset_key</code> behavior when interacting with symlinks by [<a href="https://github.com/bbc2"><code>@bbc2</code></a>] in [790c5c0]</li> <li>Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [<a href="https://github.com/JYOuyang"><code>@JYOuyang</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/590">#590</a></li> </ul> <h3>Breaking Changes</h3> <ul> <li> <p><code>dotenv.set_key</code> and <code>dotenv.unset_key</code> used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, <code>follow_symlinks=True</code> should be used.</p> </li> <li> <p>In the CLI, <code>set</code> and <code>unset</code> used to follow symlinks in some situations. This is no longer the case.</p> </li> <li> <p><code>dotenv.set_key</code>, <code>dotenv.unset_key</code> and the CLI commands <code>set</code> and <code>unset</code> used to reset the file mode of the modified .env file to <code>0o600</code> in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode <code>0o600</code> is used.</p> </li> </ul> <h2>[1.2.1] - 2025-10-26</h2> <ul> <li>Move more config to <code>pyproject.toml</code>, removed <code>setup.cfg</code></li> <li>Add support for reading <code>.env</code> from FIFOs (Unix) by [<a href="https://github.com/sidharth-sudhir"><code>@sidharth-sudhir</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/586">#586</a></li> </ul> <h2>[1.2.0] - 2025-10-26</h2> <ul> <li>Upgrade build system to use PEP 517 & PEP 518 to use <code>build</code> and <code>pyproject.toml</code> by [<a href="https://github.com/EpicWink"><code>@EpicWink</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/583">#583</a></li> <li>Add support for Python 3.14 by [<a href="https://github.com/23f3001135"><code>@23f3001135</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/579">#579</a></li> <li>Add support for disabling of <code>load_dotenv()</code> using <code>PYTHON_DOTENV_DISABLED</code> env var. by [<a href="https://github.com/matthewfranglen"><code>@matthewfranglen</code></a>] in <a href="https://redirect.github.com/theskumar/python-dotenv/issues/569">#569</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d"><code>36004e0</code></a> Bump version: 1.2.1 → 1.2.2</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8"><code>eb20252</code></a> docs: update changelog for v1.2.2</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"><code>790c5c0</code></a> Merge commit from fork</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1"><code>43340da</code></a> Remove the use of <code>sh</code> in tests (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/612">#612</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c"><code>09d7cee</code></a> docs: clarify override behavior and document FIFO support (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/610">#610</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c"><code>c8de288</code></a> ci: improve workflow efficiency with best practices (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/609">#609</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4"><code>7bd9e3d</code></a> Add Windows testing to CI (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/604">#604</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81"><code>1baaf04</code></a> Drop Python 3.9 support and update to PyPy 3.11 (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/608">#608</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc"><code>4a22cf8</code></a> ci: enable testing on Python 3.14t (free-threaded) (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/588">#588</a>)</li> <li><a href="https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4"><code>e2e8e77</code></a> Fix license specifier (<a href="https://redirect.github.com/theskumar/python-dotenv/issues/597">#597</a>)</li> <li>Additional commits viewable in <a href="https://github.com/theskumar/python-dotenv/compare/v1.1.1...v1.2.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-dotenv&package-manager=uv&previous-version=1.1.1&new-version=1.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-21 15:05:43 -04:00
Mason Daugherty	7e81d09f2a	chore(deps): bump pytest to `9.0.3` (#36801 ) CVE-2025-71176 (medium severity) All are dev-only (test dependency group) — no impact on published packages. ### Why syrupy was also bumped syrupy 4.x (`<5.0.0`) constrains pytest to `<9.0.0`, blocking the CVE fix. Widening to `<6.0.0` allows syrupy 5.x which supports pytest 9.x.	2026-04-15 21:46:40 -06:00
dependabot[bot]	9ab05cb63a	chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/partners/chroma (#36781 ) Bumps [langsmith](https://github.com/langchain-ai/langsmith-sdk) from 0.6.3 to 0.7.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langsmith-sdk/releases">langsmith's releases</a>.</em></p> <blockquote> <h2>v0.7.31</h2> <h2>What's Changed</h2> <ul> <li>chore(deps-dev): bump langchain-core from 1.2.23 to 1.2.28 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2692">langchain-ai/langsmith-sdk#2692</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.82.0 to 0.84.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2684">langchain-ai/langsmith-sdk#2684</a></li> <li>chore(deps): bump cryptography from 46.0.6 to 46.0.7 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2693">langchain-ai/langsmith-sdk#2693</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.84.0 to 0.85.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2700">langchain-ai/langsmith-sdk#2700</a></li> <li>feat(py): Tag OpenAI Agent Python SDK runs with ls_agent_type by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2699">langchain-ai/langsmith-sdk#2699</a></li> <li>feat(js): Adds ls_agent_type metadata to AI SDK runs by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2701">langchain-ai/langsmith-sdk#2701</a></li> <li>chore(deps-dev): bump types-tqdm from 4.67.3.20260303 to 4.67.3.20260408 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2710">langchain-ai/langsmith-sdk#2710</a></li> <li>chore(deps): bump pnpm/action-setup from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2705">langchain-ai/langsmith-sdk#2705</a></li> <li>chore(deps): bump the py-minor-and-patch group across 1 directory with 10 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2711">langchain-ai/langsmith-sdk#2711</a></li> <li>chore(deps-dev): bump <code>@anthropic-ai/sdk</code> from 0.85.0 to 0.86.0 in /js by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2702">langchain-ai/langsmith-sdk#2702</a></li> <li>chore(deps): bump actions/github-script from 8 to 9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2706">langchain-ai/langsmith-sdk#2706</a></li> <li>chore(deps-dev): bump the js-minor-and-patch group across 1 directory with 7 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2712">langchain-ai/langsmith-sdk#2712</a></li> <li>chore(deps-dev): bump types-psutil from 7.2.2.20260130 to 7.2.2.20260408 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2709">langchain-ai/langsmith-sdk#2709</a></li> <li>chore(deps-dev): bump rich from 14.3.3 to 15.0.0 in /python by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2708">langchain-ai/langsmith-sdk#2708</a></li> <li>feat: Filter kwargs from new token events by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2714">langchain-ai/langsmith-sdk#2714</a></li> <li>release(py): 0.7.31 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2716">langchain-ai/langsmith-sdk#2716</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.30...v0.7.31">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.30...v0.7.31</a></p> <h2>v0.7.30</h2> <h2>What's Changed</h2> <ul> <li>feat(python): add service feature to sandbox by <a href="https://github.com/DanielKneipp"><code>@DanielKneipp</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2665">langchain-ai/langsmith-sdk#2665</a></li> <li>fix(js): Fix prototype pollution bug in anonymizers by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2690">langchain-ai/langsmith-sdk#2690</a></li> <li>release(js): 0.5.18 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2691">langchain-ai/langsmith-sdk#2691</a></li> <li>chore(js/sandbox): suppress warning log by <a href="https://github.com/hntrl"><code>@hntrl</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2694">langchain-ai/langsmith-sdk#2694</a></li> <li>feat(js): Add metadata to Claude Agent SDK JS tracing by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2695">langchain-ai/langsmith-sdk#2695</a></li> <li>fix(py): Fix run tree memory leak by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2696">langchain-ai/langsmith-sdk#2696</a></li> <li>release(py): 0.7.30 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2698">langchain-ai/langsmith-sdk#2698</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.29...v0.7.30">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.29...v0.7.30</a></p> <h2>v0.7.29</h2> <h2>What's Changed</h2> <ul> <li>release(js): 0.5.17 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2681">langchain-ai/langsmith-sdk#2681</a></li> <li>feat(py): Fix race condition around Claude Agent SDK instrumentation by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2685">langchain-ai/langsmith-sdk#2685</a></li> <li>release(py): 0.7.29 by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2686">langchain-ai/langsmith-sdk#2686</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.28...v0.7.29">https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.28...v0.7.29</a></p> <h2>v0.7.28</h2> <h2>What's Changed</h2> <ul> <li>feat(py): Support subagent tracing in Claude Agents SDK, fix usage and duplicate messages by <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a> in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2670">langchain-ai/langsmith-sdk#2670</a></li> <li>chore(deps-dev): bump the py-minor-and-patch group across 1 directory with 11 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2677">langchain-ai/langsmith-sdk#2677</a></li> <li>chore(deps-dev): bump the js-minor-and-patch group across 1 directory with 8 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2667">langchain-ai/langsmith-sdk#2667</a></li> <li>chore(deps): bump pnpm/action-setup from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2658">langchain-ai/langsmith-sdk#2658</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/langchain-ai/langsmith-sdk/commits/v0.7.31">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langsmith&package-manager=uv&previous-version=0.6.3&new-version=0.7.31)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-15 20:09:10 -06:00

1 2 3 4