chore(deps-dev): bump the langchain group across 1 directory with 2 updates - #1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
fe0fe0c to
413d518
Compare
413d518 to
a218e0f
Compare
81e1288 to
4e210e8
Compare
955020b to
cf83784
Compare
6eae19f to
3b492ed
Compare
10d8aa7 to
c4a09bb
Compare
1ce292f to
99df812
Compare
99df812 to
a1d2ff7
Compare
f0b9adf to
efc8733
Compare
b4f3478 to
a84b7ce
Compare
cca9da6 to
d21624f
Compare
041dff0 to
2174ea0
Compare
d5964fa to
fbde2e8
Compare
65b1549 to
3c368eb
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.5.2 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.5.2) Updates `langchain` from 1.2.13 to 1.3.15 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.3.15) --- updated-dependencies: - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
3c368eb to
7bd93de
Compare
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.5.2Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
5cfde66release(openai): 1.5.2 (#39719)65e5e3cfix(core): require all nested properties for strict tool schemas (#39306)32c15bbfix(openai): preserve reasoning item boundaries (#39278)91ed383fix(standard-tests): close quote inbind_toolsexample (#39722)94509fafix(core): remove stale sync-streamxfail[closes #39720] (#39723)1662ceachore(model-profiles): refresh model profile data (#39710)cccfbb1perf(core): Lazily import transformers (#38037)9f2d56erelease(openai): 1.5.2a1 (#39709)a2ff1bbfeat(openai): extract gateway metadata from response headers when available (...9c21d84fix(core): accept non-dict Mapping values in mustache templates (#39680)Updates
langchainfrom 1.2.13 to 1.3.15Release notes
Sourced from langchain's releases.
... (truncated)
Commits
f4bc503release(langchain): 1.3.15 (#39595)5ff19c6release(core): 1.5.4 (#39592)1925966feat(langchain): exposetrace_policyonAgentMiddleware(#38910)ce8e8bdchore(model-profiles): refresh model profile data (#39579)a2a9b1bfix(anthropic): report reasoning tokens in usage metadata (#39590)39b4e0fchore(langchain): fix type errors in tests (#39589)f78df6dchore(model-profiles): refresh model profile data (#39430)56daaccrelease(openai): 1.4.3 (#39485)24e8d2bchore(model-profiles): refresh model profile data (#39344)9b4ef2afix(openai): filter invalid tool calls from content (#39366)