chore(deps-dev): bump the langchain group across 1 directory with 2 updates - #1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
fe0fe0c to
413d518
Compare
413d518 to
a218e0f
Compare
81e1288 to
4e210e8
Compare
955020b to
cf83784
Compare
6eae19f to
3b492ed
Compare
10d8aa7 to
c4a09bb
Compare
1ce292f to
99df812
Compare
99df812 to
a1d2ff7
Compare
85394ec to
7fcc752
Compare
c668e33 to
f0b9adf
Compare
b4f3478 to
a84b7ce
Compare
cca9da6 to
d21624f
Compare
041dff0 to
2174ea0
Compare
d5964fa to
fbde2e8
Compare
fbde2e8 to
226e8ba
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.4.3 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.4.3) Updates `langchain` from 1.2.13 to 1.3.15 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.3.15) --- updated-dependencies: - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
226e8ba to
42bf3fc
Compare
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.4.3Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
56daaccrelease(openai): 1.4.3 (#39485)24e8d2bchore(model-profiles): refresh model profile data (#39344)9b4ef2afix(openai): filter invalid tool calls from content (#39366)9f738f5fix(core): compat with pydantic 2.14 (#39328)d048fbechore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain (#39325)a0a434cchore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain_v1 (#39324)c318abefix(text-splitters): raise TypeError for non-dict, non-convertible input to R...1499aa9fix(core): stop StructuredPrompt from mutating caller kwargs (#39174)0424e03fix(core): preserve flat tool args schema forRootModelrunnables (#39307)bc16168fix(langchain): preserve history onSummarizationMiddlewaresummary failure...Updates
langchainfrom 1.2.13 to 1.3.15Release notes
Sourced from langchain's releases.
... (truncated)
Commits
f4bc503release(langchain): 1.3.15 (#39595)5ff19c6release(core): 1.5.4 (#39592)1925966feat(langchain): exposetrace_policyonAgentMiddleware(#38910)ce8e8bdchore(model-profiles): refresh model profile data (#39579)a2a9b1bfix(anthropic): report reasoning tokens in usage metadata (#39590)39b4e0fchore(langchain): fix type errors in tests (#39589)f78df6dchore(model-profiles): refresh model profile data (#39430)56daaccrelease(openai): 1.4.3 (#39485)24e8d2bchore(model-profiles): refresh model profile data (#39344)9b4ef2afix(openai): filter invalid tool calls from content (#39366)