Repository navigation
chore(deps-dev): bump the langchain group across 1 directory with 2 updates - #2003
dependabot[bot] wants to merge 1 commit into
Conversation
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-core](https://github.com/langchain-ai/langchain) and [langchain-openai](https://github.com/langchain-ai/langchain). Updates `langchain-core` from 1.2.22 to 1.6.7 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-core==1.2.22...langchain-core==1.6.7) Updates `langchain-openai` from 1.1.12 to 1.6.7 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==1.1.12...langchain-openai==1.6.7) --- updated-dependencies: - dependency-name: langchain-core dependency-version: 1.6.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: langchain - dependency-name: langchain-openai dependency-version: 1.6.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this lockfile bump and didn't find any bugs. The langchain bump also pulls the dev environment's openai from 2.29.0 to 3.26.0, a major version, so a human should confirm the OpenAI integration tests still pass before merging.
What was reviewed:
- The openai jump from 2.x to 3.x (now built on httpx2, with distro and tqdm dropped). langfuse/openai.py imports private openai modules (
_types,_constants,_legacy_response,_response) and has version-gated resource patching, so it is the code most likely to break. - httpx 0.x is still locked, so the SDK's own httpx-based code paths are unaffected.
- In the
[options]block, uv rewrote the absolute exclude-newer timestamps to the0001-01-01placeholder. It kept the P7D/P3D spans, which matchexclude-newer = "7 days"in pyproject.toml.
Extended reasoning...
Only uv.lock changes. It bumps langchain-core and langchain-openai, and through them openai goes up a major version, from 2.29.0 to 3.26.0, and new packages are added (httpx2, httpcore2, truststore, langchain-protocol). No auth, crypto or data-handling code changes, but the SDK's OpenAI wrapper in langfuse/openai.py relies on private openai internals and version checks, which a major upgrade can break. pyproject.toml allows openai>=1.0.0 without an upper bound, so nothing stops the v3 resolution. That compatibility risk is why this should be deferred rather than approved.
Bumps the langchain group with 2 updates in the / directory: langchain-core and langchain-openai.
Updates
langchain-corefrom 1.2.22 to 1.6.7Release notes
Sourced from langchain-core's releases.
... (truncated)
Commits
f40f58drelease(core): 1.6.7 (#41087)2c2cf93fix(core): include openai redacted_content in v1 output for bedrock converse ...0c24e89chore(model-profiles): refresh model profile data (#41084)dc3a689fix(core): python 3.14 hardening aroundinspect.signature(#41059)67ba389chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/core (#41057)f8aaa99chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langchain (#41056)b564ebcchore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/text-splitters (#41055)7ca02f3release(huggingface): 1.2.3 (#41058)7974332chore(langchain): bump minimum FastMCP to 4.0.11 (#41054)6564f7efix(huggingface): hidehuggingfacehub_api_tokenfromrepr(#41047)Updates
langchain-openaifrom 1.1.12 to 1.6.7Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
026c3darelease(openai): 1.6.7 (#40933)de484a5chore(model-profiles): refresh model profile data (#40924)a9780cddocs: update OpenWiki (#40903)d6167c0release(anthropic): 1.7.5 (#40912)aaf25d0test(openai): drop retired completions live tests (#40910)04ac76cchore(model-profiles): refresh model profile data (#40902)08064f4release(core): 1.6.6 (#40906)ce90661fix(anthropic): support Claude Sonnet 5.5 compatibility (#40882)78a3cbchotfix(fireworks): replace unavailable integration test model (#40890)316c045release(fireworks): 1.7.0 (#40889)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions