chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622
chore(deps-dev): bump the langchain group across 1 directory with 2 updates#1622dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
…pdates Bumps the langchain group with 2 updates in the / directory: [langchain-openai](https://github.com/langchain-ai/langchain) and [langchain](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 0.3.34 to 1.1.12 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-openai==0.3.34...langchain-openai==1.1.12) Updates `langchain` from 1.2.13 to 1.2.15 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain==1.2.13...langchain==1.2.15) --- updated-dependencies: - dependency-name: langchain-openai dependency-version: 1.1.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: langchain - dependency-name: langchain dependency-version: 1.2.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: langchain ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
The langchain-openai bump spans a major version boundary (0.3.34 → 1.1.12), which may introduce breaking API changes in the test suite — worth a human check that CI passes.
Extended reasoning...
Overview
This is a dependabot PR updating two dev-only dependencies in pyproject.toml and uv.lock: langchain-openai (0.3.34 → 1.1.12) and langchain (1.2.13 → 1.2.15). Incidentally, langgraph (1.1.3 → 1.1.5) and langgraph-prebuilt (1.0.8 → 1.0.9) are also bumped as transitive resolution changes. All changes are to the [dependency-groups] dev section — none affect the published package.
Security Risks
No security risks from the version bumps themselves. The langchain 1.2.14 release includes a pygments CVE fix (CVE-2026-4539), which is a minor positive. No auth, crypto, or data-exposure surface in these changes.
Level of Scrutiny
The langchain-openai jump from 0.3.34 to 1.1.12 crosses a major version boundary and skips many minor versions, meaning the upstream library may have introduced API breaking changes. Even though it is a dev dependency, the test suite relies on it and tests could silently pass or fail depending on API compatibility. The constraint in pyproject.toml was widened from <0.4 to <1.2 to accommodate this, which is a deliberate widening. A human should confirm CI is green before merging.
Other Factors
No bugs were found by the automated bug hunting system. The langchain and langgraph bumps are minor patch-level and low risk. The lock file hash updates are consistent with the version changes. The main concern is solely the magnitude of the langchain-openai version jump.
Bumps the langchain group with 2 updates in the / directory: langchain-openai and langchain.
Updates
langchain-openaifrom 0.3.34 to 1.1.12Release notes
Sourced from langchain-openai's releases.
... (truncated)
Commits
ad574fcfix(openai): bump min core version (#36180)19f81cfrelease(core): 1.2.21 (#36179)6d07ef2release(openai): 1.1.12 (#36178)2f64d80fix(core,model-profiles): add missingModelProfilefields, warn on schema d...5ffece5chore(core): remove stale blockbuster allowlist for deleted context module (#...936b0a6chore(model-profiles): refresh model profile data (#36152)900f8a3fix(openai): support phase parameter (#36161)64a848aci: add maintainer override torequire-issue-linkworkflow (#36147)7d05cfbfix(openai): preserve namespace field in streaming function_call chunks (#36108)74ade80chore(model-profiles): refresh model profile data (#36123)Updates
langchainfrom 1.2.13 to 1.2.15Release notes
Sourced from langchain's releases.
... (truncated)
Commits
dd63731release: langchain v1.2.15 (#36496)d1529ddfix(core): correct parameter names in filter_messages docstring example (#36462)e89afedrelease(core): 1.2.25 (#36473)0b5f2c0fix(core): harden check for txt files in deprecated prompt loading functions ...c9f51aefix(core): fixed typos in the documentation (#36459)cd394b7chore(model-profiles): refresh model profile data (#36455)34c4a2achore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/huggingface (#36436)914cef0chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/xai (#36435)66ad4f7chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/langchain (#36439)8fb12b8chore: bump aiohttp from 3.13.3 to 3.13.4 in /libs/partners/fireworks (#36437)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsDisclaimer: Experimental PR review
Greptile Summary
This dependabot PR bumps two dev-only LangChain packages:
langchain-openaifrom0.3.34to1.1.12(crossing a major version boundary) andlangchainfrom1.2.13to1.2.15. Onlyuv.lockand (optionally)pyproject.tomlare affected; the existing constraintlangchain-openai>=0.0.5,<1.2already permits1.1.12, so no constraint edits are needed. Both packages are in the[dependency-groups] devsection and have no effect on the production package.Confidence Score: 5/5
Safe to merge — both updated packages are dev-only dependencies and the existing version constraints already accommodate the new versions.
No production dependencies are affected. The langchain-openai 0.x→1.x jump is large but the pyproject.toml upper bound (< 1.2) already anticipated it, indicating the team planned for this upgrade. The langchain 1.2.13→1.2.15 bump is a routine patch. No P0/P1 findings were identified.
No files require special attention.
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[dev dependency group] --> B[langchain-openai] A --> C[langchain] B --> |bumped 0.3.34 → 1.1.12| D[langchain-core 1.2.22] C --> |bumped 1.2.13 → 1.2.15| D D --> E[uv.lock resolved graph] style B fill:#f9c74f style C fill:#90be6dReviews (1): Last reviewed commit: "chore(deps-dev): bump the langchain grou..." | Re-trigger Greptile