chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
2d7394a to
32ca532
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.1.12 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.1.12) Updates `langchain` from 1.2.13 to 1.2.15 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.2.15) --- updated-dependencies: - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain ... Signed-off-by: dependabot[bot] <[email protected]>
32ca532 to
9ca4bbf
Compare
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.1.12Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
ad574fcfix(openai): bump min core version (#36180)19f81cfrelease(core): 1.2.21 (#36179)6d07ef2release(openai): 1.1.12 (#36178)2f64d80fix(core,model-profiles): add missingModelProfilefields, warn on schema d...5ffece5chore(core): remove stale blockbuster allowlist for deleted context module (#...936b0a6chore(model-profiles): refresh model profile data (#36152)900f8a3fix(openai): support phase parameter (#36161)64a848aci: add maintainer override torequire-issue-linkworkflow (#36147)7d05cfbfix(openai): preserve namespace field in streaming function_call chunks (#36108)74ade80chore(model-profiles): refresh model profile data (#36123)Updates
langchainfrom 1.2.13 to 1.2.15Release notes
Sourced from langchain's releases.
... (truncated)
Commits
dd63731release: langchain v1.2.15 (#36496)d1529ddfix(core): correct parameter names in filter_messages docstring example (#36462)e89afedrelease(core): 1.2.25 (#36473)0b5f2c0fix(core): harden check for txt files in deprecated prompt loading functions ...c9f51aefix(core): fixed typos in the documentation (#36459)cd394b7chore(model-profiles): refresh model profile data (#36455)34c4a2achore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/huggingface (#36436)914cef0chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/xai (#36435)66ad4f7chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/langchain (#36439)8fb12b8chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/fireworks (#36437)