chore(deps): bump the uv group across 22 directories with 13 updates

[dependabot]

Bumps the uv group with 3 updates in the /gemini/agents/genai-experience-concierge directory: pyasn1, requests and tornado.
Bumps the uv group with 4 updates in the /gemini/agents/genai-experience-concierge/langgraph-demo/backend directory: pyasn1, requests, tornado and langgraph-checkpoint.
Bumps the uv group with 4 updates in the /gemini/agents/genai-experience-concierge/langgraph-demo/frontend directory: pyasn1, requests, tornado and langgraph-checkpoint.
Bumps the uv group with 4 updates in the /gemini/evaluation/synthetic-data-evals directory: pyasn1, requests, black and google-cloud-aiplatform.
Bumps the uv group with 3 updates in the /gemini/function-calling/function_calling_service directory: google-cloud-aiplatform, flask and werkzeug.
Bumps the uv group with 5 updates in the /gemini/mcp/adk_mcp_app directory:

Package	From	To
pyasn1	0.6.1	0.6.3
requests	2.32.3	2.33.0
google-cloud-aiplatform	1.95.0	1.133.0
authlib	1.6.0	1.6.9
cryptography	45.0.3	46.0.6

Bumps the uv group with 5 updates in the /gemini/mcp/adk_multiagent_mcp_app directory:

Package	From	To
pyasn1	0.6.1	0.6.3
requests	2.32.3	2.33.0
google-cloud-aiplatform	1.95.0	1.133.0
authlib	1.6.0	1.6.9
cryptography	45.0.3	46.0.6

Bumps the uv group with 1 update in the /gemini/multimodal-live-api/project-livewire/server directory: requests.
Bumps the uv group with 1 update in the /gemini/sample-apps/genwealth/function-scripts/analyze-prospectus directory: langchain-core.
Bumps the uv group with 1 update in the /gemini/sample-apps/genwealth/function-scripts/process-pdf directory: langchain-core.
Bumps the uv group with 2 updates in the /gemini/sample-apps/photo-discovery/ag-web/app directory: flask and werkzeug.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/conversational-app-multi-playbook/backend directory: requests, langchain-core and google-cloud-aiplatform.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/conversational-app-multi-playbook/functions/create-intent directory: langchain-core, google-cloud-aiplatform and flask.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/conversational-app-single-playbook/backend directory: requests, langchain-core and google-cloud-aiplatform.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/conversational-app-single-playbook/functions/create-intent directory: langchain-core, google-cloud-aiplatform and flask.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/document-search-using-agent-builder/backend directory: requests, langchain-core and google-cloud-aiplatform.
Bumps the uv group with 2 updates in the /gemini/sample-apps/quickbot/image-background-changer-using-imagen3/backend directory: requests and google-cloud-aiplatform.
Bumps the uv group with 2 updates in the /gemini/sample-apps/quickbot/linkedin-profile-image-generation-using-imagen3/backend directory: requests and google-cloud-aiplatform.
Bumps the uv group with 2 updates in the /gemini/sample-apps/quickbot/text-to-image-using-imagen3/backend directory: requests and google-cloud-aiplatform.
Bumps the uv group with 3 updates in the /gemini/sample-apps/quickbot/website-search-using-agent-builder/backend directory: requests, langchain-core and google-cloud-aiplatform.
Bumps the uv group with 3 updates in the /gemini/tuning/genai-mlops-tune-and-eval directory: pyasn1, requests and google-cloud-aiplatform.
Bumps the uv group with 1 update in the /search/cloud-function/python directory: flask.

Updates pyasn1 from 0.6.1 to 0.6.3

Release notes

Sourced from pyasn1's releases.

Release 0.6.3

It's a minor release.

• Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
• Fixed OverflowError from oversized BER length field.
• Fixed DeprecationWarning stacklevel for deprecated attributes.
• Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Release 0.6.2

It's a minor release.

• Fixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).
• Added support for Python 3.14.
• Added SECURITY.md policy.
• Migrated to pyproject.toml packaging.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.3, released 16-03-2026

• CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (thanks for reporting, romanticpragmatism)
• Fixed OverflowError from oversized BER length field [issue #54](pyasn1/pyasn1#54) [pr #100](pyasn1/pyasn1#100)
• Fixed DeprecationWarning stacklevel for deprecated attributes [issue #86](pyasn1/pyasn1#86) [pr #101](pyasn1/pyasn1#101)
• Fixed asDateTime incorrect fractional seconds parsing [issue #81](pyasn1/pyasn1#81) [pr #102](pyasn1/pyasn1#102)

Revision 0.6.2, released 16-01-2026

• CVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet limits in OID/RELATIVE-OID decoder (thanks to tsigouris007)
• Added support for Python 3.14 [pr #97](pyasn1/pyasn1#97)
• Added SECURITY.md policy
• Fixed unit tests failing due to missing code [issue #91](pyasn1/pyasn1#91) [pr #92](pyasn1/pyasn1#92)
• Migrated to pyproject.toml packaging [pr #90](pyasn1/pyasn1#90)

Commits

• af65c3b Prepare release 0.6.3
• 5a49bd1 Merge commit from fork
• 5494ba4 Fix asDateTime incorrect fractional seconds parsing (#102)
• 71f486e Fix DeprecationWarning stacklevel for deprecated attributes (#101)
• d7cb42d Fix OverflowError from oversized BER length field (#100)
• e7356f8 Prepare release 0.6.2
• 3908f14 Merge commit from fork
• 0a7e067 Add support for Python 3.14 (#97)
• 33656e9 Create Security Policy
• fa62307 fix for issue #91: unit tests failing due to missing code (#92)
• Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

Updates tornado from 6.4.2 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

• 7d64650 Merge pull request #3586 from bdarnell/update-cibw
• d05d59b build: Bump cibuildwheel to 3.4.0
• c2f4673 Merge pull request #3585 from bdarnell/release-655
• e5f1aa4 Release notes and version bump for v6.5.5
• 78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
• 24a2d96 web: Validate characters in all cookie attributes.
• 119a195 httputil: Add limits on multipart form data parsing
• 63d4df4 Merge pull request #3564 from bdarnell/release-654
• eadbf9a Release notes and version bump for 6.5.4
• bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
• Additional commits viewable in compare view

Updates pyasn1 from 0.6.1 to 0.6.3

Release notes

Sourced from pyasn1's releases.

Release 0.6.3

It's a minor release.

• Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
• Fixed OverflowError from oversized BER length field.
• Fixed DeprecationWarning stacklevel for deprecated attributes.
• Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Release 0.6.2

It's a minor release.

• Fixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).
• Added support for Python 3.14.
• Added SECURITY.md policy.
• Migrated to pyproject.toml packaging.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.3, released 16-03-2026

• CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (thanks for reporting, romanticpragmatism)
• Fixed OverflowError from oversized BER length field [issue #54](pyasn1/pyasn1#54) [pr #100](pyasn1/pyasn1#100)
• Fixed DeprecationWarning stacklevel for deprecated attributes [issue #86](pyasn1/pyasn1#86) [pr #101](pyasn1/pyasn1#101)
• Fixed asDateTime incorrect fractional seconds parsing [issue #81](pyasn1/pyasn1#81) [pr #102](pyasn1/pyasn1#102)

Revision 0.6.2, released 16-01-2026

• CVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet limits in OID/RELATIVE-OID decoder (thanks to tsigouris007)
• Added support for Python 3.14 [pr #97](pyasn1/pyasn1#97)
• Added SECURITY.md policy
• Fixed unit tests failing due to missing code [issue #91](pyasn1/pyasn1#91) [pr #92](pyasn1/pyasn1#92)
• Migrated to pyproject.toml packaging [pr #90](pyasn1/pyasn1#90)

Commits

• af65c3b Prepare release 0.6.3
• 5a49bd1 Merge commit from fork
• 5494ba4 Fix asDateTime incorrect fractional seconds parsing (#102)
• 71f486e Fix DeprecationWarning stacklevel for deprecated attributes (#101)
• d7cb42d Fix OverflowError from oversized BER length field (#100)
• e7356f8 Prepare release 0.6.2
• 3908f14 Merge commit from fork
• 0a7e067 Add support for Python 3.14 (#97)
• 33656e9 Create Security Policy
• fa62307 fix for issue #91: unit tests failing due to missing code (#92)
• Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

Updates tornado from 6.4.2 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

• 7d64650 Merge pull request #3586 from bdarnell/update-cibw
• d05d59b build: Bump cibuildwheel to 3.4.0
• c2f4673 Merge pull request #3585 from bdarnell/release-655
• e5f1aa4 Release notes and version bump for v6.5.5
• 78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
• 24a2d96 web: Validate characters in all cookie attributes.
• 119a195 httputil: Add limits on multipart form data parsing
• 63d4df4 Merge pull request #3564 from bdarnell/release-654
• eadbf9a Release notes and version bump for 6.5.4
• bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
• Additional commits viewable in compare view

Updates langgraph-checkpoint from 2.0.23 to 4.0.0

Release notes

Sourced from langgraph-checkpoint's releases.

langgraph-checkpoint==4.0.0

Changes since checkpoint==3.0.1

• fix: flip default on base cache (#6677)
• fix(checkpoint): InMemorySaver context managers should return self in… (#6529)
• fix: docstring for serializer protocol (#6525)
• chore: clean up some refs (#6487)
• chore: add pyproject.toml links (#6364)

langgraph-checkpoint-postgres==3.0.5

Changes since checkpointpostgres==3.0.4

• release(checkpoint-postgres): 3.0.5 (#7221)
• fix: re-use connection (#7220)
• chore(deps): bump ruff from 0.15.5 to 0.15.6 in /libs/checkpoint-postgres in the all-dependencies group (#7194)
• chore(deps): bump the all-dependencies group across 1 directory with 2 updates (#7071)
• release(checkpoint): 0.4.1 (#6966)
• chore: add serde events (#6954)
• chore: update defaults (#6953)
• release: rc2 (#6949)
• release: Candidate (#6947)
• Merge commit from fork
• chore(deps): bump the all-dependencies group in /libs/checkpoint-postgres with 2 updates (#6916)
• chore: add make type target for type checking (#6748)
• chore: bump orjson (#6852)
• chore(deps): bump langchain-core from 1.2.7 to 1.2.11 in /libs/checkpoint-postgres (#6831)
• chore(deps): bump the all-dependencies group in /libs/checkpoint-postgres with 2 updates (#6808)

langgraph-checkpoint-postgres==3.0.4

Changes since checkpointpostgres==3.0.3

• chore: Omit lock when using connection pool (#6734)
• chore(deps): upgrade dependencies with uv lock --upgrade (#6671)
• chore: update twitter URLs (#6683)

langgraph-checkpoint-postgres==3.0.3

Changes since checkpointpostgres==3.0.2

• fix: flip default on base cache (#6677)
• docs: storage nits (#6651)

langgraph-checkpoint-sqlite==3.0.3

Changes since checkpointsqlite==3.0.2

• fix: aiosqlite's breaking change (#6699)
• chore(deps): upgrade dependencies with uv lock --upgrade (#6671)
• chore: update twitter URLs (#6683)

langgraph-checkpoint-postgres==3.0.2

Changes since checkpointpostgres==3.0.1

... (truncated)

Commits

• f91d79d fix: flip default on base cache (#6677)
• cb2faa7 fix(prebuilt): support generic type arguments for ToolRuntime injection (#6509)
• a5827c5 fix: change default recursion limit (#6676)
• 5212369 feat(sdk-py): add end-time to crons client (#6674)
• 7045a23 fix: add state attribute to ToolCallRequest overrides (#6668)
• 728db10 fix: suppress unintended deprecation warning (#6669)
• 454af21 feat(sdk-py): cron.on_run_completed support (#6662)
• b4630d8 chore: delete docs (#6488)
• 311465b fix: sanitize namespace for deeply nested graph jumps (#6665)
• 8ccead9 docs: x-refs and explainer in tool node docs (#6653)
• Additional commits viewable in compare view

Updates langgraph from 0.3.21 to 1.1.4

Release notes

Sourced from langgraph's releases.

langgraph==1.1.4

Changes since 1.1.3

• release(langgraph): 1.1.4 (#7356)
• fix(langgraph): avoid recursion limit default sentinel collision (#7355)
• feat: Add LangSmith integration metadata to langgraph (#7203)
• chore(deps): bump pygments from 2.19.2 to 2.20.0 in /libs/langgraph (#7353)
• chore(deps): bump cryptography from 46.0.5 to 46.0.6 in /libs/langgraph (#7324)
• chore(deps): bump types-requests from 2.32.4.20260107 to 2.32.4.20260324 in /libs/langgraph (#7297)
• chore(deps): bump the minor-and-patch group in /libs/langgraph with 2 updates (#7296)
• chore(deps): bump requests from 2.32.5 to 2.33.0 in /libs/langgraph (#7284)
• chore(deps): bump the all-dependencies group in /libs/langgraph with 3 updates (#7253)

langgraph==1.1.3

Changes since 1.1.2

• release(checkpoint-postgres): 3.0.5 (#7221)
• release(langgraph): 1.1.3 (#7215)
• feat: add execution info to runtime (#7143)
• chore(deps): bump the all-dependencies group in /libs/sdk-py with 2 updates (#7197)
• chore(deps): bump the all-dependencies group in /libs/langgraph with 2 updates (#7200)
• chore(deps): bump pyjwt from 2.10.1 to 2.12.0 in /libs/langgraph (#7189)
• chore(deps): bump orjson from 3.11.5 to 3.11.6 in /libs/langgraph (#7147)

langgraph==1.1.2

Changes since 1.1.1

• release(langgraph): 1.1.2 (#7135)
• fix: stream part generic order (#7134)
• feat: add context for remote graph api (#7132)
• chore: fix typo (#7131)
• chore(deps): bump tornado from 6.5.4 to 6.5.5 in /libs/langgraph (#7122)

langgraph==1.1.1

Changes since 1.1.0

• release(langgraph): 1.1.1 (#7120)
• fix: replay bug, direct to subgraphs (#7115)
• chore: remove md notes (#7103)

langgraph==1.1.0

Changes since 1.0.10

• release(langgraph): 1.1 (#7102)
• fix: replay behavior for parent + subgraphs! (#7038)
• feat: type safe stream/invoke w/ proper output type coercion (#6961)

Type-Safe Streaming & Invoke

LangGraph 1.1 introduces version="v2" — a new opt-in streaming format that brings full type safety to stream(), astream(), invoke(), and ainvoke().

... (truncated)

Commits

• 5c9c1d5 release(langgraph): 1.1.4 (#7356)
• 13528ef fix: moving threat model to .github/ (#7360)
• 1fd51e8 docs: add threat model for LangGraph monorepo (#7026)
• d344a22 ci: auto-reopen PRs on issue assignment (#7358)
• 13fa882 chore(deps): bump pygments from 2.19.2 to 2.20.0 in /libs/checkpoint-postgres...
• 6204281 chore(deps): bump pygments from 2.19.2 to 2.20.0 in /libs/sdk-py (#7351)
• a05e521 chore(deps): bump pygments from 2.19.2 to 2.20.0 in /libs/checkpoint-sqlite (...
• ec04547 chore(deps): bump pygments from 2.19.2 to 2.20.0 in /libs/checkpoint (#7348)
• 2fb367e fix(langgraph): avoid recursion limit default sentinel collision (#7355)
• 0475497 feat: Add LangSmith integration metadata to langgraph (#7203)
• Additional commits viewable in compare view

Updates langchain-core from 0.3.49 to 1.2.23

Release notes

Sourced from langchain-core's releases.

langchain-core==1.2.22

Changes since langchain-core==1.2.21

release(core): 1.2.22 (#36201) fix(core): validate paths in prompt.save and load_prompt, deprecate methods (#36200)

langchain-core==1.2.21

Changes since langchain-core==1.2.20

release(core): 1.2.21 (#36179) fix(core,model-profiles): add missing ModelProfile fields, warn on schema drift (#36129) chore(core): remove stale blockbuster allowlist for deleted context module (#36168) ci: suppress pytest streaming output in CI (#36092)

langchain-core==1.2.20

Changes since langchain-core==1.2.19

release(core): 1.2.20 (#36085) fix(core): trace invocation params in metadata (#36080) feat: Add LangSmith integration metadata to create_agent and init_chat_model (#35810) feat(core): harden anti-ssrf (#35960) ci: avoid unnecessary dep installs in lint targets (#36046) docs(core): document base_url in mermaid api (#35961) chore: bump orjson from 3.11.5 to 3.11.6 in /libs/core (#35805) chore: housekeeping (#35850)

langchain-core==1.2.19

Changes since langchain-core==1.2.18

release(core): 1.2.19 (#35832) chore(core): move BaseCrossEncoder to langchain-core (#35809) chore: bump tornado from 6.5.2 to 6.5.5 in /libs/core (#35775)

langchain-core==1.2.18

Changes since langchain-core==1.2.17

release(core): 1.2.18 (#35704) fix(core): fix double backticks in deprecation docstring for alternative_import (#35658) fix(core): preserve default_factory when generating tool call schema (#35550) feat(openai): support tool search (#35582) chore: bump the minor-and-patch group across 3 directories with 7 updates (#35605)

langchain-core==1.2.17

Changes since langchain-core==1.2.16

release(core): 1.2.17 (#35527) fix(core): extract usage metadata from serialized tracer message outputs (#35526) chore: bump the langchain-deps group across 3 directories with 7 updates (#35513) chore: bump the langchain-deps group across 3 directories with 14 updates (#35441)

... (truncated)

Commits

• d22df94 release(core): 1.2.22 (#36201)
• 27add91 fix(core): validate paths in prompt.save and load_prompt, deprecate metho...
• 7563fce chore(model-profiles): refresh model profile data (#36195)
• 3e64c25 chore: use repo permissions instead of org membership for maintainer override...
• 1778b08 chore(partners): bump langchain-core min to 1.2.21 (#36183)
• ad574fc fix(openai): bump min core version (#36180)
• 19f81cf release(core): 1.2.21 (#36179)
• 6d07ef2 release(openai): 1.1.12 (#36178)
• 2f64d80 fix(core,model-profiles): add missing ModelProfile fields, warn on schema d...
• 5ffece5 chore(core): remove stale blockbuster allowlist for deleted context module (#...
• Additional commits viewable in compare view

Updates orjson from 3.10.16 to 3.11.8

Release notes

Sourced from orjson's releases.

3.11.8

Changed

• Build and compatibility improvements.

3.11.7

Changed

• Use a faster library to serialize float. Users with byte-exact regression tests should note positive exponents are now written using a +, e.g., 1.2e+30 instead of 1.2e30. Both formats are spec-compliant.
• ABI compatibility with CPython 3.15 alpha 5 free-threading.

3.11.6

Changed

• orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
• Drop support for Python 3.9.
• ABI compatibility with CPython 3.15 alpha 5.
• Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

• Fix sporadic crash serializing deeply nested list of dict.

3.11.5

Changed

• Show simple error message instead of traceback when attempting to build on unsupported Python versions.

3.11.4

Changed

• ABI compatibility with CPython 3.15 alpha 1.
• Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7, manylinux ppc64le, manylinux s390x.
• Build now requires a C compiler.

3.11.3

Fixed

• Fix PyPI project metadata when using maturin 1.9.2 or later.

3.11.2

Fixed

• Fix build using Rust 1.89 on amd64.

Changed

... (truncated)

Changelog

Sourced from orjson's changelog.

3.11.8 - 2026-03-31

Changed

• Build and compatibility improvements.

3.11.7 - 2026-02-02

Changed

• Use a faster library to serialize float. Users with byte-exact regression tests should note positive exponen...

  Description has been truncated