Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 10 updates - #1003

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/file_organizer/minor-and-patch-eb65509981
Open

chore(deps): Bump the minor-and-patch group across 1 directory with 10 updates#1003
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/file_organizer/minor-and-patch-eb65509981

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 10 updates in the /a2a/file_organizer directory:

Package From To
langgraph 1.2.12 1.2.16
langchain-core 1.6.6 1.6.12
langchain-openai 1.6.6 1.7.2
openinference-instrumentation-langchain 0.1.76 0.1.79
pydantic-settings 2.15.0 2.16.0
opentelemetry-exporter-otlp 1.45.0 1.45.1
opentelemetry-proto 1.45.0 1.45.1
aiohttp 3.14.3 3.14.5
langsmith 0.14.1 0.14.12
orjson 3.12.0 3.13.0

Updates langgraph from 1.2.12 to 1.2.16

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

  • release(langgraph): 1.2.16 (#9334)
  • fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • fix(langgraph): apply a resumed Command's update once (#9322)
  • fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (#9315)
  • fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • release(prebuilt): 1.1.1 (#9316)
  • release(checkpoint-postgres): 3.2.0 (#9313)
  • feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver (#9290)
  • fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer (#9302)
  • release(checkpoint-postgres): 3.1.3 (#9287)
  • release(checkpoint-sqlite): 3.1.2 (#9288)

langgraph==1.2.15

Changes since 1.2.14

  • release(langgraph): 1.2.15 (#9283)
  • fix(langgraph): give every message written to a messages DeltaChannel an id (#9275)
  • fix(langgraph): save a cached node's writes like a node that ran (#9259)
  • fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it (#9281)
  • fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269)
  • fix(langgraph): store an update_state input's writes on the checkpoint it updates (#9258)
  • fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints (#9260)
  • fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets (#9263)
  • fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264)
  • fix(langgraph): don't save a checkpoint past a failed DeltaChannel write (#9235)
  • fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values (#9232)
  • fix(langgraph): never store exit-mode delta writes under the null task id (#9229)
  • fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 (#9219)
  • chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph (#9206)
  • fix(langgraph): give each bulk_update_state update its own task id (#9128)
  • fix(langgraph): replay a resumed exit-mode run's delta writes in live order (#9114)
  • fix: order delta channel replay by task path (#8544)

langgraph==1.2.14

Changes since 1.2.13

  • release(langgraph): 1.2.14 (#9215)

langgraph==1.2.13

Changes since 1.2.12

  • fix(langgraph): fork before replaying an update checkpoint the thread moved past (#9170)
  • fix(langgraph): keep an update_state on an older checkpoint out of its other branches (#9165)
  • fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
  • release(langgraph): 1.2.13 (#9205)
  • fix(langgraph): don't walk history for a DeltaChannel that was never written (#9141)
  • fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8548)

... (truncated)

Commits
  • 41c9c22 release(langgraph): 1.2.16 (#9334)
  • 5101865 release(sdk-py): 0.4.8 (#9335)
  • 9e6fc45 fix(sdk-py): surface thread stream errors and stop retrying a rejected stream...
  • b0cabd9 fix(langgraph): let other tasks finish when a resume value is invalid (#9265)
  • 4ac46ba release(cli): 0.4.36 (#9330)
  • e14f427 fix(langgraph): apply a resumed Command's update once (#9322)
  • 4e2dfe4 fix(cli): accept serverless and dedicated deployment aliases (#9325)
  • e77a5cb fix(cli): push through the active Docker context in langgraph deploy (#9321)
  • b0482d0 fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (...
  • 889a5ff fix(langgraph): save a resumed exit run's pending writes once (#9314)
  • Additional commits viewable in compare view

Updates langchain-core from 1.6.6 to 1.6.12

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.12

Changes since langchain-core==1.6.11

release(core): 1.6.12 (#41277) fix(core): propagate extras on content-block-start events (#41272)

langchain-core==1.6.11

Changes since langchain-core==1.6.10

release(core): 1.6.11 (#41260) feat(core): accept address inside LangChainTracer (#41006)

langchain-core==1.6.10

Changes since langchain-core==1.6.9

release(core): 1.6.10 (#41220) feat(core,anthropic,openai): declare mid-conversation support in model profiles (#41180)

langchain-core==1.6.9

Changes since langchain-core==1.6.8

release(core): 1.6.9 (#41160) feat(core): accept a callable in with_retry (#41158)

langchain-core==1.6.8

Changes since langchain-core==1.6.7

release(core): 1.6.8 (#41153) fix(core): harden scoped and compatible IPv6 SSRF checks (#41151)

langchain-core==1.6.7

Changes since langchain-core==1.6.6

release(core): 1.6.7 (#41087) fix(core): include openai redacted_content in v1 output for bedrock converse (#41086) fix(core): python 3.14 hardening around inspect.signature (#41059) chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/core (#41057) chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/core (#40992) chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/core (#40972) chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/core (#40970)

Commits

Updates langchain-openai from 1.6.6 to 1.7.2

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.7.2

Changes since langchain-openai==1.7.1

release(openai): 1.7.2 (#41245) fix(openai): keep Responses stream items on one block when output_index drifts (#41121)

langchain-openai==1.7.1

Changes since langchain-openai==1.7.0

release(openai): 1.7.1 (#41222) feat(core,anthropic,openai): declare mid-conversation support in model profiles (#41180)

langchain-openai==1.7.0

Changes since langchain-openai==1.6.7

release(openai): 1.7.0 (#41154) feat(openai): support decisions api (#41125) chore(deps): bump langgraph-sdk from 0.4.4 to 0.4.6 in /libs/partners/openai (#41096) chore(deps): bump langgraph-sdk from 0.4.2 to 0.4.4 in /libs/partners/openai (#41072) chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/partners/openai (#40951) chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/openai (#40952)

langchain-openai==1.6.7

Changes since langchain-openai==1.6.6

release(openai): 1.6.7 (#40933) chore(model-profiles): refresh model profile data (#40924) test(openai): drop retired completions live tests (#40910) chore(model-profiles): refresh model profile data (#40869) feat(openai): discover Azure workload identity (#40532)

Commits

Updates openinference-instrumentation-langchain from 0.1.76 to 0.1.79

Release notes

Sourced from openinference-instrumentation-langchain's releases.

python-openinference-instrumentation-langchain: v0.1.79

0.1.79 (2026-10-09)

Bug Fixes

  • bump openinference-instrumentation minimum to >=0.1.71 (#3975) (3fbad7d)
Commits
  • 453da0e chore: release main (#3979)
  • d69ab8e fix(google-genai): apply base64_image_max_length to output.value (#3974)
  • 197f7e7 feat(llama_index): Add Finish Reason Attribute (#3986)
  • 12f2cc0 fix(mistralai): end the LLM span when a stream is closed, abandoned, or used ...
  • b625e5c chore(deps): update opentelemetry-sdk requirement from >=1.20.0 to >=1.45.0 i...
  • 3fbad7d fix: bump openinference-instrumentation minimum to >=0.1.71 (#3975)
  • 35e9efd chore: release main (#3976)
  • 29d97da fix(cohere): end LLM span when stream is abandoned or closed early (#3784) (#...
  • dde040f fix(google-adk): forward ADK 2.x invoke_workflow and invoke_node spans (#3846)
  • be777f6 fix(bedrock): record every toolResult block of a Converse message (#3787)
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
  • CliSubCommand aliases keep their case with case_sensitive=False (#989).
  • Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
  • CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

  • Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
  • Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
  • A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
  • collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
  • A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
  • Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

  • With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
  • secrets_case_sensitive=True is now honored on Windows (#1001).
  • An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
  • TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

  • Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
  • Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
  • NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • 6ea85e6 Decode optional Annotated named union aliases (#1041)
  • ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
  • b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
  • bedb60e Honor explicit empty TOML table header overrides (#1027)
  • Additional commits viewable in compare view

Updates opentelemetry-exporter-otlp from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-exporter-otlp's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-exporter-otlp's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates opentelemetry-proto from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-proto's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-proto's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates langsmith from 0.14.1 to 0.14.12

Release notes

Sourced from langsmith's releases.

v0.14.12

0.14.12 (2026-10-21)

Features

  • agents: add agent registry CRUD to SDKs and CLI (d3de1d5)
  • authz: add root_run_metadata policy conditions and compiled trace_filters (64684e0)
  • cli: expose runs share and get-url to the CLI (fcfae7c)
  • evaluators: add trajectory input type for code evaluators (9b6f6e5)
  • sandboxes: let LangSmith login service URLs be embedded by named origins (dcf7c3e)
  • sdk-python: create enforced feedback configs (1e3cd15)

Bug Fixes

  • sandboxes: add cursor pagination to registry listing (1a44460)
  • sdk-python: use reference outputs for example creation (f995f42)
  • sdk-python: use reference outputs for example creation (7cbb508)
  • sdk: keep wrap_openai Responses stream output when it ends incomplete or failed (e88c57c)
  • support Standard Units in sandbox cost breakdowns (e9bee5c)

Chores

  • remove langsmith-sdk and staging repo leftovers, update SDK docs (459d4bd)

Documentation

  • move sandbox auth options to the bottom of README.md (#71) (be8a4db)

v0.14.11

[!NOTE] The LangSmith Python SDK now lives in langchain-ai/langsmith-python. Releases ship from here starting with 0.14.10. langchain-ai/langsmith-sdk is frozen for Python and JS.

Nothing changes for you:, same langsmith package on PyPI and same imports. Open new issues and PRs here.

0.14.11 (2026-10-16)

Chores

  • drop the release-as pin now that 0.14.10 is out (#68) (1b41cc8)

v0.14.10

0.14.10 (2026-10-15)

Chores

... (truncated)

Changelog

Sourced from langsmith's changelog.

Commits

Updates orjson from 3.12.0 to 3.13.0

Release notes

Sourced from orjson's releases.

3.13.0

Changed

  • No longer publish PyPI wheels for Windows x86/i686.

Added

  • Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814).
Changelog

Sourced from orjson's changelog.

3.13.0 - 2026-08-17

Changed

  • No longer publish PyPI wheels for Windows x86/i686.

Added

  • Serialize new Python 3.15 built-in type frozendict identical to dict (PEP 814).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 1…
c2422b8 
…0 updates

---
updated-dependencies:
- dependency-name: langgraph
  dependency-version: 1.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-core
  dependency-version: 1.6.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-openai
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: openinference-instrumentation-langchain
  dependency-version: 0.1.79
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: opentelemetry-exporter-otlp
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: opentelemetry-proto
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langsmith
  dependency-version: 0.14.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: orjson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from a team and pdettori as code owners October 23, 2026 05:12
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 23, 2026
@clawgenti clawgenti mentioned this pull request Nov 3, 2026
Open
@clawgenti

clawgenti commented Nov 3, 2026

Copy link
Copy Markdown

Security Bump Escalation

Package: minor-and-patch group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 3 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2026-28684

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

1 similar comment
@clawgenti

clawgenti commented Nov 3, 2026

Copy link
Copy Markdown

Security Bump Escalation

Package: minor-and-patch group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 3 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2026-28684

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

@clawgenti

clawgenti commented Nov 5, 2026

Copy link
Copy Markdown

Security Bump Escalation

Package: minor-and-patch group ((grouped update))
Severity: high | SLA: 7 days | Overdue: 3 days
CI Status: unknown

Advisory Context

Vulnerability references: CVE-2026-28684

Release notes

Sourced from langgraph's releases.

langgraph==1.2.16

Changes since 1.2.15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pdettori pdettori Awaiting requested review from pdettori pdettori is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Rossoctl Issue Prioritization
Status: New/ToDo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@clawgenti