chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
fe0fe0c to
413d518
Compare
413d518 to
a218e0f
Compare
81e1288 to
4e210e8
Compare
955020b to
cf83784
Compare
6eae19f to
3b492ed
Compare
10d8aa7 to
c4a09bb
Compare
1ce292f to
99df812
Compare
99df812 to
a1d2ff7
Compare
ee7e0f7 to
85394ec
Compare
62416fb to
c668e33
Compare
121f668 to
b111832
Compare
22a00e6 to
91167f4
Compare
d21624f to
d198f44
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.3.5 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.3.5) Updates `langchain` from 1.2.13 to 1.3.14 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.3.14) --- updated-dependencies: - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
d198f44 to
7c56ae8
Compare
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.3.5Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
1c6bfc8release(openai): 1.3.5 (#38785)4717cfcfeat(openai): support explicit prompt caching (#38762)2f527dechore(model-profiles): refresh model profile data (#38774)a07356ffix(anthropic): add advisor_ prefix to builtin tool recognition (#38686)8107ff4release(fireworks): 1.4.4 (#38753)ea24fb1fix(fireworks): report cached prompt token usage (#38751)a4294f9chore(deps): refresh lockfiles (#38746)d73ba5bchore(model-profiles): refresh model profile data (#38739)bc15400release(openai): 1.3.4 (#38731)123d832release(langchain): 1.3.12 (#38730)Updates
langchainfrom 1.2.13 to 1.3.14Release notes
Sourced from langchain's releases.
... (truncated)
Commits
185119frelease(langchain): 1.3.14 (#38883)0a3bde6fix(langchain): only retry retryable exceptions inToolRetryMiddleware(#38...7bf8fe2chore(model-profiles): refresh model profile data (#38856)2286932fix: patch Dependabot dependency vulnerabilities (#38853)d260c52chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (#38750)ceb1e4efeat(langchain):ToolErrorMiddleware(#38781)2f29107chore: bump soupsieve from 2.8 to 2.8.4 in /libs/langchain (#38749)6cd44e0chore: bump soupsieve from 2.8 to 2.8.4 in /libs/text-splitters (#38748)4e57abdchore: bump nltk from 3.9.4 to 3.10.0 in /libs/text-splitters (#38747)3e983cbchore: bump mistune from 3.2.1 to 3.3.0 in /libs/text-splitters (#38826)