[dependabot]

Updates the requirements on langchain-openai to permit the latest version.

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.3.3

Changes since langchain-openai==1.3.2

release(openai): 1.3.3 (#38375) fix(openai): drop response item ids when store is false (#38372) fix(langchain,openai): only set strict=True on tools for OpenAI-compatible models in ProviderStrategy (#38370) test(openai): clarify expected strict schema error (#38338) fix(openai): drop stop from Responses API payload (#38336) chore: bump langsmith from 0.8.5 to 0.8.18 in /libs/partners/openai (#38293) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/partners/openai (#38294) chore(model-profiles): refresh model profile data (#38274) test(openai): vcr embedding raw equivalence tests (#38199)

Commits

• 4a83756 release(openai): 1.3.3 (#38375)
• 792c1a7 fix(openai): drop response item ids when store is false (#38372)
• 9f7e46f release(anthropic): 1.4.7 (#38373)
• 9ef324c fix(langchain,openai): only set strict=True on tools for OpenAI-compatible ...
• 05b5af1 chore(infra): update workflow key name (#38367)
• 8e81774 test(groq): xfail flaky tool choice test (#38365)
• 946fbbb fix(groq): replace deprecated Groq llama models (#38363)
• d11b1fc chore(model-profiles): refresh model profile data (#38341)
• 9d14a5e feat(groq): add performance service tier (#38339)
• cc6b125 test(openai): clarify expected strict schema error (#38338)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[YiWang24]

代码审查报告

风险等级: 低 | 审查置信度: 高 | 结论: 可直接合入

变更摘要

这是 Dependabot 自动创建的依赖版本更新 PR：

• 依赖: langchain-openai
• 版本: >=1.2.2 → >=1.3.3
• 变更范围: 仅修改 pyproject.toml 1 行

风险评估

维度	结论	说明
安全	✅	无安全风险
兼容性	✅	语义化版本 minor 更新，向后兼容
回归风险	✅	依赖库内部修复，不改变 API 契约
功能影响	✅	仅版本要求变更，无代码改动

Release Notes 关键修复

• 修复 store=false 时移除响应项 ID
• 修复 ProviderStrategy 中工具 strict 参数设置
• 移除 Responses API 中的 stop 参数
• langsmith 和 vcrpy 依赖更新

结论

✅ 可直接合入 — 标准依赖维护更新，无破坏性变更。

[YiWang24]

代码审查报告

风险等级: 低 | 审查置信度: 高 | 结论: 可直接合入

摘要: Dependabot 依赖更新，将 从 升级到 。仅修改 1 行，无代码变更。

变更分析

维度	结论	说明
安全	✅	无安全风险
架构	✅	无架构影响
质量	✅	官方依赖更新
性能	✅	无性能影响
测试	✅	CI 已通过 (check_suite conclusion: success)

变更内容

• 文件: 第 53 行
• 修改: →
• 类型: 次要版本升级 (minor version bump)

版本更新亮点 (1.2.2 → 1.3.3)

根据官方 release notes，主要修复包括：

• 修复 时响应 item IDs 的处理
• 修复 中工具调用的 参数设置
• 修复 Responses API 中 参数的处理
• 依赖更新：langsmith 0.8.5→0.8.18, vcrpy 8.1.1→8.2.1

风险评估

✅ 无影响变更: 这是纯粹的依赖版本升级，不涉及业务逻辑修改。依赖升级的潜在风险（API 不兼容）已在 changelog 中明确标注为 bug fixes，且 CI 已通过。

结论

✅ 可直接合入 - 标准依赖维护更新，CI 已通过，无风险。

---

✅ Dependabot 自动化: 感谢 Dependabot 保持依赖更新，这是良好的安全实践。