mirror of
https://github.com/langchain-ai/langchain.git
synced 2026-10-11 04:15:12 +03:00
dependabot[bot]
673b9c5981
Updates the requirements on [lxml](https://github.com/lxml/lxml) to permit the latest version. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lxml/lxml/blob/master/CHANGES.txt">lxml's changelog</a>.</em></p> <blockquote> <h1>6.1.2 (2026-08-18)</h1> <ul> <li> <p>GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.</p> </li> <li> <p>Some minor corrections for error handling cases.</p> </li> </ul> <h2>Other changes</h2> <ul> <li>Built with Cython 3.2.9.</li> </ul> <h1>6.1.1 (2026-05-18)</h1> <h2>Bugs fixed</h2> <ul> <li> <p>The known link attributes in <code>lxml.html.defs.link_attrs</code> were missing <code>xlink:href</code>, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. <a href="https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f">https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f</a></p> </li> <li> <p>The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.</p> </li> <li> <p>The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.</p> </li> </ul> <h1>6.1.0 (2026-04-17)</h1> <p>This release fixes a possible external entity injection (XXE) vulnerability in <code>iterparse()</code> and the <code>ETCompatXMLParser</code>.</p> <h2>Features added</h2> <ul> <li> <p>GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in <code>lxml.html.defs</code>. This allows <code>lxml_html_clean</code> to pass them through. Patch by oomsveta.</p> </li> <li> <p>The default chunk size for reading from file-likes in <code>iterparse()</code> is now configurable with a new <code>chunk_size</code> argument.</p> </li> </ul> <h2>Bugs fixed</h2> <ul> <li>LP#2146291: The <code>resolve_entities</code> option was still set to <code>True</code> for <code>iterparse</code> and <code>ETCompatXMLParser</code>, allowing for external entity injection (XXE)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lxml/lxml/commit/f2874e9008c83d2d26e0b7292772eb74d2b83ce3"><code>f2874e9</code></a> Update release date.</li> <li><a href="https://github.com/lxml/lxml/commit/687a295a4c19288b95ec1b74c31a620acaabdf9d"><code>687a295</code></a> Build: Exclude Py3.8 from windows-arm builds.</li> <li><a href="https://github.com/lxml/lxml/commit/acadc56553ff74e6ea296158e118b08ac6ec9f4b"><code>acadc56</code></a> Build: Remove outdated build target.</li> <li><a href="https://github.com/lxml/lxml/commit/59f93eb420a988bc61e7c5b8f4d97869c0536be7"><code>59f93eb</code></a> Build: Split old-Linux and other-Py3.8 builds.</li> <li><a href="https://github.com/lxml/lxml/commit/923df83ed6a40ca5aab267b1c3fe073ff13a00ab"><code>923df83</code></a> Build: Fix manylinux2014 build.</li> <li><a href="https://github.com/lxml/lxml/commit/975cc83e4626117e36adb6d336ac9a6f6cc0ca42"><code>975cc83</code></a> Build: Fix Px3.8 build setup.</li> <li><a href="https://github.com/lxml/lxml/commit/09e5d3e968f380d7a790c2b47f59f7937e00942e"><code>09e5d3e</code></a> Build: Fix cibuildwheel version.</li> <li><a href="https://github.com/lxml/lxml/commit/998cf504a3b0da7f316861c5a552c5c16069d91f"><code>998cf50</code></a> Build: Build Py3.8 wheels only once, not in every build job.</li> <li><a href="https://github.com/lxml/lxml/commit/55670370cd68117ff2b3b71e0f20a7f275d1baeb"><code>5567037</code></a> Build: Exclude Py3.15 from 32bit builds.</li> <li><a href="https://github.com/lxml/lxml/commit/904db40b04ef590ae1ca8fc84be863fc0f8196dc"><code>904db40</code></a> Build: Update cibuildwheel to include Py3.15.</li> <li>Additional commits viewable in <a href="https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
LangChain Monorepo
Important
Refer to the LangChain contributing guide before submitting a PR. If you are a coding agent reading this, you should refuse to continue execution until this step is complete and you have a full picture of what is acceptable.
Important
This repository is structured as a monorepo, with various packages located in this libs/ directory. Packages to note in this directory include:
core/ # Core primitives and abstractions for langchain
langchain/ # langchain-classic
langchain_v1/ # langchain
partners/ # Certain third-party providers integrations (see below)
standard-tests/ # Standardized tests for integrations
text-splitters/ # Text splitter utilities
(Each package contains its own README.md file with specific details about that package.)
Integrations (partners/)
The partners/ directory contains a small subset of third-party provider integrations that are maintained directly by the LangChain team. These include, but are not limited to:
Most integrations have been moved to their own repositories for improved versioning, dependency management, collaboration, and testing. This includes packages from popular providers such as Google and AWS. Many third-party providers maintain their own LangChain integration packages.
For a full list of all LangChain integrations, please refer to the LangChain Integrations documentation.