chore(deps-dev): bump the langchain group across 1 directory with 2 updates - #1622
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
fe0fe0c to
413d518
Compare
413d518 to
a218e0f
Compare
81e1288 to
4e210e8
Compare
955020b to
cf83784
Compare
6eae19f to
3b492ed
Compare
10d8aa7 to
c4a09bb
Compare
1ce292f to
99df812
Compare
99df812 to
a1d2ff7
Compare
22a00e6 to
91167f4
Compare
0f29612 to
682afc8
Compare
041dff0 to
2174ea0
Compare
d5964fa to
fbde2e8
Compare
65b1549 to
3c368eb
Compare
94ea9df to
460f090
Compare
cf68ba5 to
7431f95
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.6.3 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.6.3) Updates `langchain` from 1.2.13 to 1.4.2 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.4.2) --- updated-dependencies: - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.6.3Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
7e89d6crelease(openai): 1.6.3 (#40719)9762d68docs: update OpenWiki (#40359)99d0d06release(core): 1.6.4 (#40718)17d3d89fix(openai): expose inferred Responses API routing at initialization (#40715)8caf770chore(langchain): remove commented-out cohere extra (#40713)3290757chore(core): deprecate chat message history (#40711)d5fbcdbchore(model-profiles): refresh model profile data (#40705)4af7ab8release(typesafe): 0.0.1a3 (#40693)4145131chore(model-profiles): refresh model profile data (#40685)115dbbdfeat(typesafe): make classifier questions invocation-scoped (#40659)Updates
langchainfrom 1.2.13 to 1.4.2Release notes
Sourced from langchain's releases.
... (truncated)
Commits
a18de59release(langchain): 1.4.2 (#40621)5bf6a15fix(langchain): preserve model-generated tool calls in HITL tool call edits a...a893bbdchore(model-profiles): refresh model profile data (#40600)fd4f161chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/text-splitters (#40579)3b81e02chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/chroma (#40582)fa369c9chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/chroma (#...eb544d3chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/fireworks (#4...5e8888fchore(deps): bump filelock from 3.32.5 to 4.0.0 in /libs/partners/chroma (#40...a62361achore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/fireworks...e2d39c4chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/fireworks ...