Skip to content

chore(deps): bump the langchain group across 1 directory with 3 updates - #71

Merged
alphacrack merged 1 commit into
mainfrom
dependabot/pip/langchain-2a14f3a52a
Aug 7, 2026
Merged

chore(deps): bump the langchain group across 1 directory with 3 updates#71
alphacrack merged 1 commit into
mainfrom
dependabot/pip/langchain-2a14f3a52a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on langchain-openai, langchain-anthropic and langchain-community to permit the latest version.
Updates langchain-openai to 0.3.35

Commits

Updates langchain-anthropic to 0.3.22

Commits
  • a763ebe release(anthropic): 0.3.22 (#33394)
  • 5fa1094 fix(anthropic,standard-tests): carry over updates to v0.3 (#33393)
  • dd4de69 fix(core): handle parent/child mustache vars (#33346)
  • 809a021 chore: update v0.3 ref homepage (#33338)
  • 44ec72f fix(infra): allow prerelease installations for partner packages during api re...
  • 5459ff1 chore: cap lib upper bounds, run sync (#33320)
  • f95669a release(openai): 0.3.35 (#33299)
  • 3a465d6 feat(openai): enable stream_usage when using default base URL and client (#33...
  • 0b51de4 release(core): 0.3.78 (#33253)
  • 5904cbe feat(core): add optional include_id param to convert_to_openai_messages funct...
  • Additional commits viewable in compare view

Updates langchain-community to 0.4.2

Release notes

Sourced from langchain-community's releases.

langchain-community==0.4.2

Sunsetting langchain-community

langchain-community is being sunset. See langchain-ai/langchain-community#674 for details and guidance. Thank you to everyone who has contributed integrations, fixes, reviews, and maintenance over the years.

What's Changed

... (truncated)

Commits
  • 7c10a5f fix: bump deps and fix test (#676)
  • 0d3630d fix: sunset package (#675)
  • 3ade247 chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /libs/community (#662)
  • 27c60ba chore(deps): bump langsmith from 0.7.31 to 0.8.4 in /libs/community (#666)
  • 2e8d934 chore(deps): bump jupyter-server from 2.17.0 to 2.18.0 in /libs/community (#654)
  • f0b16c2 chore(deps): bump mistune from 3.2.0 to 3.2.1 in /libs/community (#656)
  • bfbfe3f chore(deps): update scikit-learn requirement from <2,>=1.2.2 to >=1.7.2,<2 in...
  • 4cbef29 chore(deps): update hdbcli requirement from <3,>=2.19.21 to >=2.28.20,<3 in /...
  • 22377e1 chore(deps): update keybert requirement from >=0.8.5 to >=0.9.0 in /libs/comm...
  • c4dbaa2 chore(deps): bump notebook from 7.5.4 to 7.5.6 in /libs/community (#646)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Runtime / dev dependency upgrade (Dependabot uses this name) label Jul 27, 2026
@dependabot
dependabot Bot requested a review from alphacrack as a code owner July 27, 2026 07:10
@dependabot dependabot Bot added the dependencies Runtime / dev dependency upgrade (Dependabot uses this name) label Jul 27, 2026
@alphacrack

Copy link
Copy Markdown
Owner

Maintainer note — holding this one for an explicit decision.

This widens the LangChain sub-package upper bounds:

  • langchain-openai <0.3.0<0.4.0
  • langchain-anthropic <0.3.0<0.4.0
  • langchain-community <0.4.0<0.5.0

In favor of merging: CI is fully green (20/20), and core langchain stays pinned >=0.3.0,<0.4.0. langchain-openai/-anthropic 0.3.x are compatible with langchain-core 0.3.x, so nothing conflicts today.

Why I'm not auto-merging: per CLAUDE.md, the LangChain surface is the one dependency area we treat as coordination-sensitive (llm/providers.py is the isolation boundary). This isn't a major bump — so the langchain* major-ignore rule correctly didn't catch it — but widening -community two minor versions (<0.5.0) is a broader loosening than a routine patch, and behavior changes in these SDKs surface at runtime, not always in unit tests.

Recommendation: either

  1. Merge — accept the wider bounds; CI covers the structured-output path via FakeLLMClient, and real-provider regressions would show in the nightly e2e run; or
  2. Close — stay conservatively pinned until we do a deliberate LangChain refresh with an e2e pass.

I'll do whichever you prefer. Defaulting to leaving it open (no action) until you weigh in.

@dependabot dependabot Bot changed the title chore(deps): bump the langchain group with 3 updates chore(deps): bump the langchain group across 1 directory with 3 updates Aug 5, 2026
Updates the requirements on [langchain-openai](https://github.com/langchain-ai/langchain), [langchain-anthropic](https://github.com/langchain-ai/langchain) and [langchain-community](https://github.com/langchain-ai/langchain-community) to permit the latest version.

Updates `langchain-openai` to 0.3.35
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==0.2.0...langchain-openai==0.3.35)

Updates `langchain-anthropic` to 0.3.22
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-anthropic==0.2.0...langchain-anthropic==0.3.22)

Updates `langchain-community` to 0.4.2
- [Release notes](https://github.com/langchain-ai/langchain-community/releases)
- [Commits](langchain-ai/langchain-community@libs/community/v0.3.23...libs/community/v0.4.2)

---
updated-dependencies:
- dependency-name: langchain-anthropic
  dependency-version: 0.3.22
  dependency-type: direct:production
  dependency-group: langchain
- dependency-name: langchain-community
  dependency-version: 0.4.2
  dependency-type: direct:production
  dependency-group: langchain
- dependency-name: langchain-openai
  dependency-version: 0.3.35
  dependency-type: direct:production
  dependency-group: langchain
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/langchain-2a14f3a52a branch from d6c90fd to 8887ffb Compare August 5, 2026 16:58

@alphacrack alphacrack left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Approved after CI (20/20 green) and a local e2e against the widened bounds.

E2E performed (fresh venv, pip install -e ".[all]" on this PR's pyproject.toml):

  • Resolution: no conflicts (pip check clean); pulls langchain-openai==0.3.35, langchain-anthropic==0.3.22, langchain-community==0.3.31, all against langchain-core==0.3.86.
  • Provider layer: iac_scanner.llm.providers imports cleanly; DEFAULT_MODELS intact.
  • CLI: iac-scan scan --scan-only works on both the Terraform and CDK samples.
  • Structured-output wiring: tests/test_providers.py + tests/test_runner.py — 21 passed.

langchain-openai/-anthropic 0.3.x are minor bumps within the 0.3 ecosystem and the with_structured_output path (our injection defense) is unchanged. Core langchain stays pinned <0.4.0. Real-provider behavior is still covered by the nightly e2e job.

Merging.

@alphacrack
alphacrack merged commit b397793 into main Aug 7, 2026
20 checks passed
@alphacrack
alphacrack deleted the dependabot/pip/langchain-2a14f3a52a branch August 7, 2026 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Runtime / dev dependency upgrade (Dependabot uses this name)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant