Patch bump of `langchain` from 1.3.17 to 1.3.18 to prepare a release.
Picks up the `PIIMiddleware` redaction fix (#39894): message content
that is a list of content blocks was being flattened into the string
`repr` of the list during redaction, and redacted messages were losing
fields such as `additional_kwargs`.
Standard three-file bump — `__version__`, `pyproject.toml`, and the
`langchain` entry in `uv.lock`. Running `uv lock` locally also pulled in
unrelated dependency drift (upstream specifier changes and
environment-dependent marker lines), so that churn was reverted and only
the version line kept, matching prior release PRs.
---
*Written with the help of an AI agent (Claude Code).*
`PIIMiddleware` redacted message content via `str(message.content)`.
When `.content` is a list of content blocks rather than a plain string,
`str(...)` produces the `repr` of the list — so a redacted user message
was stored as the literal string:
```
"[{'type': 'text', 'text': 'my email is [REDACTED_EMAIL]'}]"
```
The PII itself was still detected and redacted; only the shape of the
message was destroyed. Anyone sending multimodal or provider-native
block content through an agent with `PIIMiddleware` had their messages
silently flattened into that repr before reaching the model.
`_process_content` now accepts either shape and walks content blocks,
redacting the text of each block in place and leaving non-text blocks
untouched. Plain-string content behaves exactly as before.
While fixing the call sites, this also drops the hand-rebuilding of
messages (`HumanMessage(content=..., id=..., name=...)`) in favor of
`model_copy`. The enumerated rebuild had been quietly discarding every
field it did not list — `additional_kwargs`, `response_metadata`, and so
on — on any message that contained PII.
## Release note
Fixed `PIIMiddleware` flattening list-of-content-blocks message content
into its string `repr` during redaction. Redaction now preserves the
original content shape, and no longer drops message fields such as
`additional_kwargs` on redacted messages.
---
*Written with the help of an AI agent (Claude Code).*
## Problem
`StructuredTool` cannot be dumped to JSON:
```python
@tool
def write_file(file_path: str, content: str) -> str:
"""Write content to the given path."""
return "ok"
write_file.model_dump(mode="json")
# PydanticSerializationError: Unable to serialize unknown type:
# <class 'pydantic._internal._model_construction.ModelMetaclass'>
```
`args_schema` holds a Pydantic model class, and `func` / `coroutine`
hold callables. None of them have a JSON form. Python-mode
`model_dump()` works; only the JSON modes raise.
This also costs tracing performance. The [LangSmith
SDK](https://github.com/langchain-ai/langsmith-sdk/blob/main/python/langsmith/_internal/_serde.py)
catches the error, dumps again in Python mode, and then sends every
class and function left in the result through its own `default` hook.
## Change
A `PlainSerializer(..., when_used="json-unless-none")` on the three
fields.
- `args_schema` dumps as its own JSON schema: `model_json_schema()` for
a Pydantic v2 class, `schema()` for a v1 one. A dict schema passes
through unchanged. A schema holding an arbitrary type has no JSON schema
at all, so it falls back to its repr instead of raising.
- `func` and `coroutine` dump as strings.
- Python-mode dumps are unchanged — still the live schema class and
callables.
- `exclude` / `include` / `exclude_none` keep working.
- Attached with `Annotated`, not `@field_serializer`. A field has only
one serializer slot, so `@field_serializer` would break any subclass
that declares its own serializer for the same field.
- Schema generation is cached per class. Pydantic does not memoize it,
and tracing would pay for it on every run.
## Result
The dump is JSON-native, and the schema it carries has the same shape a
dict `args_schema` already has, so it validates back into a working
tool.
Measured on the 8 filesystem tools of a deepagents agent, dumped through
the LangSmith serializer:
| | master | this PR |
|---|---|---|
| time per dump | 0.119 ms | **0.025 ms** |
| payload | 7,706 B | 12,213 B |
| objects reaching the SDK's `default` hook | 32 | 8 |
The payload grows because `args_schema` now carries the real schema
instead of `"<class ...>"`. Only the tool itself still enters the
`default` hook; the class and functions inside it no longer do. Without
the per-class cache the same dump takes 1.10 ms, so the cache is what
makes this a win rather than a regression.
## Why not on `BaseTool`
`args_schema` is declared there as well, so `Tool` and custom subclasses
hit the same error. But an `Annotated` serializer only applies where the
field is declared, and `StructuredTool` redeclares `args_schema` — it
would not inherit one from `BaseTool`.
## Tests
In `libs/core/tests/unit_tests/test_tools.py`: JSON round trip, Python
mode unchanged, dump options respected, dict `args_schema` preserved,
Pydantic v1 schema class, arbitrary-type fallback, and a subclass
declaring its own serializers for the same fields.
Fixes#39935
---
`gpt-5`, `gpt-5-mini`, `gpt-5-nano` and `gpt-5.1` no longer advertise a
reasoning effort level they reject, and the GPT-5 models advertise
`minimal` again.
The profile augmentations currently give all four models `["none",
"low", "medium", "high", "xhigh"]`. OpenAI's [GPT-5 model
page](https://developers.openai.com/api/docs/models/gpt-5) states that
effort supports "minimal, low, medium, and high", and the [GPT-5.1
page](https://developers.openai.com/api/docs/models/gpt-5.1) lists "none
(default), low, medium, and high". `xhigh` arrived later, with
GPT-5.1-Codex-Max.
A client that reads `profile["reasoning_effort_levels"]` to build its
settings therefore offers `xhigh` on models that reject it, and hides
`minimal`, which GPT-5 accepts. The corrected values match the
models.dev entries for the same models.
The `gpt-5.2` / `gpt-5.4` / `gpt-5.6` profiles are already correct and
are untouched. A few other entries (`gpt-5-pro`, `gpt-5.2-pro`,
`gpt-5.4-pro`, `gpt-5.2-chat-latest`) also differ from models.dev, but I
could not confirm those from OpenAI's own docs, so I left them alone.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Mason Daugherty <mason@langchain.dev>
Patch release of the `langchain` package (langchain_v1): `1.3.16` →
`1.3.17`.
Bumps `version` in `pyproject.toml`, `__version__` in
`langchain/__init__.py`, and the corresponding entry in `uv.lock`.
---
*Prepared with the assistance of an AI agent.*
Human-provided HITL rejection reasons now retain enough context for the
model to understand that the tool was rejected rather than executed.
Previously, a custom `RejectDecision.message` replaced all rejection
framing, while the bare-rejection fallback instructed the model not to
retry. `HumanInTheLoopMiddleware` now uses minimal user-rejection
context in both cases without prescribing future model behavior.
## Release note
Human-in-the-loop rejection results now identify the user rejection
without instructing the model whether to retry.
_Developed with AI-agent assistance._
Made by [Open
SWE](https://openswe.vercel.app/agents/3df8f29d-d7d4-5296-9369-26755096058d)
---------
Co-authored-by: Harrison Chase <11986836+hwchase17@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Updates compatible minor and patch dependencies across `model-profiles`,
`standard-tests`, and `text-splitters`.
The `text-splitters` lockfile retains spaCy 3.8.13 because 3.8.15 cannot
install on Python 3.14, and retains ty 0.0.64 because 0.0.73 introduces
new diagnostics in existing NLTK and spaCy integrations. The compatible
pytest-socket, Ruff, NLTK, Transformers, and tiktoken updates remain
included.
Made by [Open
SWE](https://openswe.vercel.app/agents/0dfa86b3-bffc-58fa-b47a-d18f508e848f)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Add a repository-wide `<corridor>` block to `AGENTS.md` requiring agents
to plan first and run Corridor `analyzePlan` before generating or
modifying code.
This mirrors langchain-ai/deepagents#5740. The tags are explicit and
balanced so Corridor-specific guidance remains scoped.
---
Validation: `git diff --check` and a tag-balance assertion.
---------
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
Bumps the minor-and-patch group with 1 update in the /libs/langchain
directory: python.
Updates `python` from 3.11-slim-bookworm to 3.14-slim-bookworm
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [types-toml](https://github.com/python/typeshed) from
0.10.8.20260408 to 0.10.8.20260518.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [types-pyyaml](https://github.com/python/typeshed) from
6.0.12.20260408 to 6.0.12.20260815.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [types-requests](https://github.com/python/typeshed) from
2.33.0.20260518 to 2.33.0.20260712.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- add monthly Dependabot coverage for the maintained
development-container Compose file
- add monthly Dependabot coverage for the LangChain development
Dockerfile
- keep major updates separate from minor and patch updates
## Test Plan
- parsed `.github/dependabot.yml` with Ruby `YAML.safe_load_file`
- ran `git diff --check`
- verified the staged diff contains only `.github/dependabot.yml`
This contribution was prepared with AI-agent assistance.
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
Replace legacy sonar/sonar-pro examples in the ChatPerplexity docstring
with the Agent API pattern that 1.4.1 supports:
- use_responses_api=True with model_kwargs.preset + built-in web_search
tool
- explicit Agent API model IDs such as openai/gpt-5.6-sol
- pointer to the six current presets (fast, low, medium, high, xhigh,
wide-research) and to the Agent API models catalog
The rendered library docstring is what users see from IDEs and
help(ChatPerplexity), so this keeps it in sync with what 1.4.1 actually
routes to.
Fixes#39775
Closes#39568
Related: #33999
> [!WARNING]
> This PR expands the surface area for arbitrary code execution during
tool setup. Detecting injected arguments now requires calling
`typing.get_type_hints`, which *evaluates* string annotations (e.g.
those created by `from __future__ import annotations` or quoted forward
references) as Python expressions. As with existing type-hint resolution
paths, wrapped tool callables must be trusted application code — never
point `StructuredTool` at a callable whose module or annotations come
from an untrusted source.
Tools with a custom `args_schema` could drop injected arguments such as
`ToolRuntime` when the wrapped function's module uses postponed
annotations. The injected value was removed during input validation, so
an otherwise valid tool call failed at invocation.
---
`StructuredTool` now resolves annotations with
`typing.get_type_hints(..., include_extras=True)` before identifying
injected parameters. If an unrelated forward reference prevents
resolving the complete signature, each string annotation is resolved
independently so resolvable injected arguments are still preserved.
Callable wrappers resolve annotations from the source of their effective
signature, honoring `__wrapped__` and `__signature__`, while other
callable objects use their `__call__` method. `functools.partial`
callables retain their effective signature so already-bound injected
arguments remain excluded.
<details>
<summary><b>Before/after:</b> injected arg dropped under <code>from
__future__ import annotations</code></summary>
With postponed annotations, every annotation is stored as a plain
string. Previously `_injected_args_keys` read the raw `signature()`
annotations, so `runtime` was never recognized as injected and was
stripped during `args_schema` validation:
```python
from __future__ import annotations # all annotations become strings
from pydantic import BaseModel
from langchain_core.tools import tool, ToolRuntime
class InputSchema(BaseModel):
query: str
@tool(args_schema=InputSchema)
def my_tool(query: str, runtime: ToolRuntime) -> str:
"""Echo the query."""
return query
```
| | Behavior |
|---|---|
| **Before** | `runtime` not detected as injected → removed during
validation → tool call fails at invocation |
| **After** | `runtime` detected via `get_type_hints` → survives
validation and is injected at invocation; hidden from the model-facing
schema |
</details>
<details>
<summary><b>Before/after:</b> one unresolvable annotation disabling
injection for the whole signature</summary>
`get_type_hints` resolves *all* annotations at once and raises on the
first failure. A single unresolvable forward reference — even on an
unrelated parameter — previously meant *no* hints were available, so the
resolvable injected arg was dropped too:
```python
@tool(args_schema=InputSchema)
def my_tool(
query: "SomeTypeThatDoesNotExist", # unresolvable forward reference
runtime: "ToolRuntime", # resolvable injected arg
) -> str:
"""Echo the query."""
return query
```
| | Behavior |
|---|---|
| **Before** | `get_type_hints` raises on `query` → all hints discarded
→ `runtime` not detected as injected |
| **After** | each annotation is retried independently → `query` falls
back to its raw string (not injected), `runtime` still resolves and is
injected |
</details>
<details>
<summary><b>Before/after:</b> callable objects and wrappers</summary>
For non-function callables, the annotations now come from the source of
the *effective* signature: `__call__` for callable objects, and the
wrapped function for wrappers (`__wrapped__` / `__signature__`):
```python
class MyCallableTool:
def __call__(self, query: str, runtime: ToolRuntime) -> str:
return query
tool = StructuredTool.from_function(
func=MyCallableTool(),
name="my_tool",
description="Echo the query.",
args_schema=InputSchema,
)
```
| | Behavior |
|---|---|
| **Before** | annotations read from the wrong callable (or left as
unresolved strings) → `runtime` dropped |
| **After** | annotations resolved from `__call__` / the unwrapped
function → `runtime` injected correctly |
</details>
<details>
<summary><b>Unchanged:</b> <code>functools.partial</code> with an
already-bound injected arg</summary>
A `partial` that already binds an injected argument keeps its effective
signature — the bound parameter is absent, so nothing is re-injected
over it:
```python
from functools import partial
def fn(x: int, runtime: ToolRuntime, y: int) -> int:
return x + y
tool = StructuredTool.from_function(
func=partial(fn, 1, bound_runtime),
name="fn",
description="Add two numbers.",
args_schema=InputSchema,
)
```
**Before & after:** `runtime` is already bound by the `partial` →
excluded from the signature → the bound value is used as-is
</details>
Co-authored-by: Soban Shankar
<165470467+Soban-2004@users.noreply.github.com>
ccurme