Repository navigation
LangChain family 1.x / langgraph 1.2.14 line - #264
Merged
Merged
Conversation
marcelklehr
force-pushed
the
feat/sbom-langchain-1x
branch
from
October 21, 2026 07:49
b5084f8 to
96b10e9
Compare
marcelklehr
approved these changes
Oct 21, 2026
Member
|
please rebase |
Coordinated bump clearing the SBOM advisory ranges (report 04): - langchain 0.3.30 -> 1.4.3 (>=1.3.9, CVE-2026-55443) - langchain-core 0.3.86 -> 1.6.7 (>=1.4.7, CVE-2026-34070/26013; now direct dep) - langchain-community 0.3.31 -> 0.4.2 (1.x-era release; SitemapLoader remains unused/banned) - langchain-text-splitters 0.3.11 -> 1.1.3 (CVE-2026-41481) - langchain-mcp-adapters 0.1.14 -> 0.3.2 - langgraph 1.0.1 -> 1.2.14 (CVE-2026-28277 range) - langgraph-checkpoint 3.0.1 -> 4.2.0 (>=4.1.1, CVE-2026-27794/48775; now direct dep) - langgraph-sdk 0.2.15 -> 0.4.6 (CVE-2026-48776/104873) Signed-off-by: WSHAPER <42714629+WSHAPER@users.noreply.github.com> Assisted-by: opencode:zai/glm-5.3
langchain-core 1.6 changed Reviver() to warn about its pending default change for allowed_objects. Pin allowed_objects="core" explicitly, mirroring upstream langgraph-checkpoint 4.2.0's JsonPlusSerializer. Signed-off-by: WSHAPER <42714629+WSHAPER@users.noreply.github.com> Assisted-by: opencode:zai/glm-5.3
…nter, custom serde Regression guard for the LangChain 1.x family bump: builds the agent graph (get_graph) with the custom ChatWithNextcloud BaseChatModel and the vendored InMemorySaver on langgraph 1.2.14 / langchain-core 1.6.7 / checkpoint 4.2.0, drives an interrupt-before-dangerous-tools turn pair (tool call -> resume), and round-trips JsonPlusSerializer in both msgpack-typed and signed-token JSON shapes. Runnable standalone (python tests/test_graph_smoke.py) or pytest. Signed-off-by: WSHAPER <42714629+WSHAPER@users.noreply.github.com> Assisted-by: opencode:zai/glm-5.3
WSHAPER
force-pushed
the
feat/sbom-langchain-1x
branch
from
October 22, 2026 10:03
96b10e9 to
5590c96
Compare
Contributor
Author
|
smoke test initially 3/4, found real staleness during rebase: the test called the pre-#236 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Coordinated bump so the family lands on the lines where several published advisories are fixed: langchain 1.4.3, core 1.6.7 (direct now), community 0.4.2, mcp-adapters 0.3.2, langgraph 1.2.14, checkpoint 4.2.0 (direct), sdk 0.4.6. Also pins Reviver(allowed_objects="core") in the jsonplus serde the way upstream checkpoint 4.2.0 does.
The last commit adds a StateGraph smoke test, drop it with git reset --hard HEAD~1 if tests/ should not land here.
Smoke test 4/4, all all_tools modules and mcp_server import, msgpack roundtrip including the signed token shape, SitemapLoader unused.
community is sunset upstream (#674), the two community tools work on 0.4.2 and should re-home eventually. websockets is pinned down to 16.1.1. Integration checks fail on main (llm2 backend), unrelated.