chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
5 times, most recently
from
fe0fe0c to
413d518
Compare
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
from
413d518 to
a218e0f
Compare
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
2 times, most recently
from
81e1288 to
4e210e8
Compare
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
4 times, most recently
from
955020b to
cf83784
Compare
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
from
cf83784 to
62e8054
Compare
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.2.1 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.2.1) Updates `langchain` from 1.2.13 to 1.3.1 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.3.1) --- updated-dependencies: - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/uv/langchain-5313e6a929
branch
from
62e8054 to
93bb246
Compare
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.2.1Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
87ba30fci(infra): label release jobs, resolve package name in run title (#36998)56d6e89hotfix: bump min core versions (#36996)a70e7abrelease(openai): 1.2.1 (#36995)5a37cd5fix(openai): add gpt-5.5 pro to Responses API check (#36994)c4498ccchore(core): mark stream_v2/astream_v2 as beta (#36992)fa0f0d8release(core): 1.3.2 (#36990)9ce72ebfeat(core): add content-block-centric streaming (v2) (#36834)889a45bci(infra): overlay locallangchain-*installs for external partners (#36989)ffaac42ci(infra): addpytest-xdistto partner test groups (#36988)cc2feb1chore(model-profiles): refresh model profile data (#36982)Updates
langchainfrom 1.2.13 to 1.3.1Release notes
Sourced from langchain's releases.
... (truncated)
Commits
b6b769brelease(langchain): 1.3.1 (#37454)36c381bfix(langchain): alias Bedrock providers in summarization token check (#37453)0831e44docs(openai): documentbase_urlenv var fallback chain (#37436)e208f38chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/xai (#37411)a4a2be9chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/qdrant (#37412)f5322d9chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/perplexity (#37413)5d9ac69chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/openrouter (#37414)f42d80cfix(core): preserve chunkadditional_kwargsacross v3 stream assembly (#37435)649d82ffix(core): preserve reasoning blocks alongside tool_call in v3 stream (#37434)9f9a8a7chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/ollama (#37415)