[dependabot]

Bumps the langgraph group with 3 updates in the / directory: @langchain/langgraph, @langchain/langgraph-checkpoint-sqlite and @langchain/quickjs.

Updates @langchain/langgraph from 1.4.21 to 1.5.1

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph-api@​1.5.1

Patch Changes

• #2883 545c7d1 Thanks @​casparb! - Fix langgraph dev --no-reload with the default TypeScript loader. Pass the tsx --clear-screen=false option only in watch mode so Node can start the server when reload is disabled.
• Updated dependencies []:
  • @​langchain/langgraph-ui@​1.5.1

@​langchain/langgraph-cli@​1.5.1

Patch Changes

• #2874 92e250c Thanks @​ataller-lc! - Add --studio-url to langgraphjs dev, so the printed and auto-opened Studio link can point at a self-hosted LangSmith instance instead of https://smith.langchain.com. The flag takes precedence over the host derived from LANGSMITH_ENDPOINT, matching the Python CLI, and is forwarded when dev serves a Python project.

• #2872 686504e Thanks @​sz-lc-mdm-captive! - Resolve the docker binary from the inherited environment instead of a synthesised PATH, fixing build, up, deploy and dockerfile --add-docker-compose on Linux and Windows.

  The CLI previously discarded the caller's PATH and rebuilt one, first by probing the login shell through dscl (macOS Directory Services) and then by falling back to a hardcoded list of macOS install locations. Both strategies originate from LangGraph Studio's desktop app, where a Finder-launched process inherits launchd's minimal environment; neither applies to a CLI invoked from a terminal or from CI.

  On Linux the dscl probe reported success with empty output, because the missing command sat on the left of a pipe and the shell returned sed's exit status. Discovery then degraded to the hardcoded list, which omits /usr/local/bin — where Docker's install script and most CI images place the binary — so the CLI reported "Docker is required but not installed" on machines where docker was installed and on PATH. On Windows the fallback could never succeed, since verification shelled out to which.

  Docker is now spawned the way any other command is, so PATH, DOCKER_HOST and credential helpers all behave as the caller configured them. A missing binary is reported separately from a daemon that is not running, matching the Python CLI.

• Updated dependencies [545c7d1]:

  • @​langchain/langgraph-api@​1.5.1

@​langchain/langgraph-ui@​1.5.1

No changes in this release.

@​langchain/langgraph@​1.5.1

Patch Changes

• #3017 61b0049 Thanks @​eliornl! - A field that changes from a DeltaChannel to a plain reducer, for example to MessagesAnnotation, keeps its value on threads written under the DeltaChannel: reads rebuild it from the stored writes instead of returning the empty default, and the next run adds to it instead of replacing it.

• #3027 af7e421 Thanks @​eliornl! - With durability: "exit", resuming parallel interrupts one at a time no longer applies a finished task's output twice: the save at exit keeps only the writes made during that run, instead of storing the ones loaded with the checkpoint again under new indexes.

• #2986 53cc627 Thanks @​byhow! - When one answer in a multi-answer resume fails its interrupt's responseSchema, the other tasks in the step now finish before the ZodError is thrown, instead of being aborted. A task aborted after its side effects kept its answer and ran again on the next resume. The error is unchanged, and the new isInvalidResume(error) tells it apart from other errors, as is_invalid_resume does in langgraph (Python).

• #3038 bc01023 Thanks @​eliornl! - messagesStateReducer and messagesDeltaReducer store message chunks as their non-chunk class, as Python's add_messages does. A graph run with streamMode: "messages" or streamEvents now checkpoints the same AIMessage as invoke, without a duplicate tool_call_chunks copy of every tool call, and an in-place edit to tool_calls (for example a rejected call in humanInTheLoopMiddleware) is no longer undone when the thread is reloaded.

• #3028 ec1854a Thanks @​eliornl! - Resuming after some parallel interrupts were answered no longer reruns the nodes and task() calls that already finished, in a subgraph or when the resume is sent with the id of the thread's latest checkpoint. Finished tasks now rerun only on time travel, or on a resume at a checkpoint the thread has moved past.

• Updated dependencies [2e1fe5b, 0acf88d, 9cc54cc, 4690a5b]:

  • @​langchain/langgraph-sdk@​1.12.5

@​langchain/langgraph-api@​1.5.1-rc.0

Patch Changes

• Updated dependencies [7a12289]:
  • @​langchain/langgraph-sdk@​1.12.0-rc.0
  • @​langchain/langgraph@​1.4.18-rc.0
  • @​langchain/langgraph-ui@​1.5.1-rc.0

@​langchain/langgraph-cli@​1.5.1-rc.0

Patch Changes

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.5.1

Patch Changes

• #3017 61b0049 Thanks @​eliornl! - A field that changes from a DeltaChannel to a plain reducer, for example to MessagesAnnotation, keeps its value on threads written under the DeltaChannel: reads rebuild it from the stored writes instead of returning the empty default, and the next run adds to it instead of replacing it.

• #3027 af7e421 Thanks @​eliornl! - With durability: "exit", resuming parallel interrupts one at a time no longer applies a finished task's output twice: the save at exit keeps only the writes made during that run, instead of storing the ones loaded with the checkpoint again under new indexes.

• #2986 53cc627 Thanks @​byhow! - When one answer in a multi-answer resume fails its interrupt's responseSchema, the other tasks in the step now finish before the ZodError is thrown, instead of being aborted. A task aborted after its side effects kept its answer and ran again on the next resume. The error is unchanged, and the new isInvalidResume(error) tells it apart from other errors, as is_invalid_resume does in langgraph (Python).

• #3038 bc01023 Thanks @​eliornl! - messagesStateReducer and messagesDeltaReducer store message chunks as their non-chunk class, as Python's add_messages does. A graph run with streamMode: "messages" or streamEvents now checkpoints the same AIMessage as invoke, without a duplicate tool_call_chunks copy of every tool call, and an in-place edit to tool_calls (for example a rejected call in humanInTheLoopMiddleware) is no longer undone when the thread is reloaded.

• #3028 ec1854a Thanks @​eliornl! - Resuming after some parallel interrupts were answered no longer reruns the nodes and task() calls that already finished, in a subgraph or when the resume is sent with the id of the thread's latest checkpoint. Finished tasks now rerun only on time travel, or on a resume at a checkpoint the thread has moved past.

• Updated dependencies [2e1fe5b, 0acf88d, 9cc54cc, 4690a5b]:

  • @​langchain/langgraph-sdk@​1.12.5

1.5.0

Minor Changes

• #2961 1631fd8 Thanks @​soarez! - order parallel writes by task path, like langgraph (Python) — one sort key for live execution and every saver, instead of the task-id order #2544 added for DeltaChannel writes

  When two or more tasks in one superstep write the same DeltaChannel, their writes are now applied and replayed in (task_path, task_id, idx) order — the order Python's langgraph#8544 established — instead of task-id order. Task ids are uuid5 hashes that include the checkpoint id, so the old order permuted parallel writers from run to run and disagreed with Python.

  • BaseCheckpointSaver.putWrites takes an optional taskPath (the serialized task path, taskPathStr), and getTuple/list must return pendingWrites in the new writesSortKey order. writesSortKey and compareWritesSortKeys are new exports of @langchain/langgraph-checkpoint; every saver (memory, SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the path and sorts in JS — no database collation is involved.
  • SQLite and Postgres gain a task_path column (migrated automatically on setup(); read-only pre-column SQLite databases keep reading, with their rows keeping the old order). Redis and MongoDB documents gain a task_path field. Rows written before the upgrade keep their old order.
  • Exit-durability resumes replay delta writes in live order (port of langgraph#9114): the resumed superstep's writes interleave with the loaded ones by task path, later supersteps sort after every real write, and writes loaded with the checkpoint are no longer stored twice.
  • bulkUpdateState seals the first update superstep: DeltaChannels touched by the base checkpoint's pending writes (and whose version moved) snapshot on the update checkpoint, so a finished sibling's writes and the update's can't replay in the wrong order (partial port of langgraph#8548).
  • bulkUpdateState/updateState update tasks carry (__interrupt__, i) task paths, as in langgraph#9128, so several updates in one superstep writing the same DeltaChannel replay in the order given.
  • Send task paths become [PUSH, i, false] and node-error-handler paths become [*failedTask.path[:3], "node_error_handler", false] (the failed task's first three path elements), matching Python's shapes — langgraph_path task metadata changes accordingly, and task ids of functional task() calls under a Send or handler task change with them. The SDK's Send-task detection accepts both the old and new shapes.

  Upgrade notes:

  • PostgresSaver: run setup() once after upgrading, from one process, before the new version serves traffic. The task_path column comes from the first new migration since the saver shipped, and until it runs, reads and writes fail with column "task_path" does not exist. Several processes running setup() at once on a database that still needs the migration can fail with a duplicate key error on checkpoint_migrations.
  • Third-party checkpoint savers remain source-compatible but must now persist the taskPath they are given and return pendingWrites in writesSortKey order; the conformance suite's new base tests enforce this. A saver that ignores the new argument replays in task-id order and can rebuild a different DeltaChannel value than the run produced.
  • An incomplete superstep containing stored delta writes that must interleave with resumed or retried task writes is affected by the upgrade, whether the incompleteness came from an interrupt, a task error, a crash, or a drain: finish such threads with the old runtime before upgrading writers. A single interrupted node with no finished delta-writing siblings is safe to resume. The same applies to resuming work that includes functional task() calls under a Send or error-handler task, whose child task ids change.
  • @langchain/langgraph-checkpoint 1.2.0 must be released before any package requiring its new exports; the consumers' minimum ranges are raised accordingly.

Patch Changes

• #2980 5c81e5f Thanks @​eliornl! - A node served from the node cache now saves its writes like a node that ran. They were applied but never saved, so a DeltaChannel read back without them once the state was loaded again, under every durability. A cache hit is still streamed as cached and isn't written back to the cache.

• #2989 7789c52 Thanks @​eliornl! - An exit-durability run that starts from a checkpoint the thread has moved past, addressed by checkpoint_id, no longer stores its DeltaChannel writes on that checkpoint, where the branch that already grew from it read them too. The run now snapshots the channels it wrote instead.

• #2969 5a4f831 Thanks @​eliornl! - fix(langgraph): a checkpoint save now waits for the DeltaChannel writes the run sent before it and is skipped if one of them failed, so a failed write no longer leaves the channel reading back without it.

• #2974 0dc519c Thanks @​eliornl! - fix(langgraph): a DeltaChannel no longer reads back writes from another branch. The first checkpoint of a new branch snapshots the delta channels its base has pending writes for, an updateState on a checkpoint the thread moved past stores none of its writes there, and a replay of such a checkpoint forks before storing a Command's writes.

• #2981 3f763ae Thanks @​eliornl! - A run's input to a DeltaChannel input channel of a raw Pregel graph reads back only on the checkpoints built from it. With "sync" or "async" durability it was saved as the starting checkpoint's own state: on a new thread the first run's input was lost, the previous run's last checkpoint read the next run's input, and a run from an older checkpoint leaked its input into the branch that already grew from it. Now the input is stored on the starting checkpoint under its own task id, or, on a new thread or an addressed checkpoint, the input checkpoint snapshots the channel. Threads saved before this keep the input already stored on their checkpoints.

... (truncated)

Commits

• cc29753 chore: version packages (#3018)
• 53cc627 fix(langgraph): let other tasks finish when a resume value is invalid (#2986)
• ec1854a fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (...
• af7e421 fix(langgraph): save a resumed exit run's pending writes once (#3027)
• bc01023 fix(langgraph): store message chunks as messages in the messages reducers (#3...
• b762123 chore(langgraph): consolidate DeltaChannel regression suites (#3019)
• 61b0049 fix(langgraph): keep a DeltaChannel's value when its field changes to a plain...
• 4510774 chore: version packages (#2977)
• 13d848e fix(langgraph): give every message written to a messages DeltaChannel an id (...
• f07064c fix(langgraph): stop at an interruptBefore breakpoint when a drain is request...
• Additional commits viewable in compare view

Updates @langchain/langgraph-checkpoint-sqlite from 1.0.4 to 1.1.0

Release notes

Sourced from @​langchain/langgraph-checkpoint-sqlite's releases.

@​langchain/langgraph-checkpoint-sqlite@​1.1.0

Minor Changes

• #2961 1631fd8 Thanks @​soarez! - order parallel writes by task path, like langgraph (Python) — one sort key for live execution and every saver, instead of the task-id order #2544 added for DeltaChannel writes

  When two or more tasks in one superstep write the same DeltaChannel, their writes are now applied and replayed in (task_path, task_id, idx) order — the order Python's langgraph#8544 established — instead of task-id order. Task ids are uuid5 hashes that include the checkpoint id, so the old order permuted parallel writers from run to run and disagreed with Python.

  • BaseCheckpointSaver.putWrites takes an optional taskPath (the serialized task path, taskPathStr), and getTuple/list must return pendingWrites in the new writesSortKey order. writesSortKey and compareWritesSortKeys are new exports of @langchain/langgraph-checkpoint; every saver (memory, SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the path and sorts in JS — no database collation is involved.
  • SQLite and Postgres gain a task_path column (migrated automatically on setup(); read-only pre-column SQLite databases keep reading, with their rows keeping the old order). Redis and MongoDB documents gain a task_path field. Rows written before the upgrade keep their old order.
  • Exit-durability resumes replay delta writes in live order (port of langgraph#9114): the resumed superstep's writes interleave with the loaded ones by task path, later supersteps sort after every real write, and writes loaded with the checkpoint are no longer stored twice.
  • bulkUpdateState seals the first update superstep: DeltaChannels touched by the base checkpoint's pending writes (and whose version moved) snapshot on the update checkpoint, so a finished sibling's writes and the update's can't replay in the wrong order (partial port of langgraph#8548).
  • bulkUpdateState/updateState update tasks carry (__interrupt__, i) task paths, as in langgraph#9128, so several updates in one superstep writing the same DeltaChannel replay in the order given.
  • Send task paths become [PUSH, i, false] and node-error-handler paths become [*failedTask.path[:3], "node_error_handler", false] (the failed task's first three path elements), matching Python's shapes — langgraph_path task metadata changes accordingly, and task ids of functional task() calls under a Send or handler task change with them. The SDK's Send-task detection accepts both the old and new shapes.

  Upgrade notes:

  • PostgresSaver: run setup() once after upgrading, from one process, before the new version serves traffic. The task_path column comes from the first new migration since the saver shipped, and until it runs, reads and writes fail with column "task_path" does not exist. Several processes running setup() at once on a database that still needs the migration can fail with a duplicate key error on checkpoint_migrations.
  • Third-party checkpoint savers remain source-compatible but must now persist the taskPath they are given and return pendingWrites in writesSortKey order; the conformance suite's new base tests enforce this. A saver that ignores the new argument replays in task-id order and can rebuild a different DeltaChannel value than the run produced.
  • An incomplete superstep containing stored delta writes that must interleave with resumed or retried task writes is affected by the upgrade, whether the incompleteness came from an interrupt, a task error, a crash, or a drain: finish such threads with the old runtime before upgrading writers. A single interrupted node with no finished delta-writing siblings is safe to resume. The same applies to resuming work that includes functional task() calls under a Send or error-handler task, whose child task ids change.
  • @langchain/langgraph-checkpoint 1.2.0 must be released before any package requiring its new exports; the consumers' minimum ranges are raised accordingly.

Changelog

Sourced from @​langchain/langgraph-checkpoint-sqlite's changelog.

1.1.0

Minor Changes

• #2961 1631fd8 Thanks @​soarez! - order parallel writes by task path, like langgraph (Python) — one sort key for live execution and every saver, instead of the task-id order #2544 added for DeltaChannel writes

  When two or more tasks in one superstep write the same DeltaChannel, their writes are now applied and replayed in (task_path, task_id, idx) order — the order Python's langgraph#8544 established — instead of task-id order. Task ids are uuid5 hashes that include the checkpoint id, so the old order permuted parallel writers from run to run and disagreed with Python.

  • BaseCheckpointSaver.putWrites takes an optional taskPath (the serialized task path, taskPathStr), and getTuple/list must return pendingWrites in the new writesSortKey order. writesSortKey and compareWritesSortKeys are new exports of @langchain/langgraph-checkpoint; every saver (memory, SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the path and sorts in JS — no database collation is involved.
  • SQLite and Postgres gain a task_path column (migrated automatically on setup(); read-only pre-column SQLite databases keep reading, with their rows keeping the old order). Redis and MongoDB documents gain a task_path field. Rows written before the upgrade keep their old order.
  • Exit-durability resumes replay delta writes in live order (port of langgraph#9114): the resumed superstep's writes interleave with the loaded ones by task path, later supersteps sort after every real write, and writes loaded with the checkpoint are no longer stored twice.
  • bulkUpdateState seals the first update superstep: DeltaChannels touched by the base checkpoint's pending writes (and whose version moved) snapshot on the update checkpoint, so a finished sibling's writes and the update's can't replay in the wrong order (partial port of langgraph#8548).
  • bulkUpdateState/updateState update tasks carry (__interrupt__, i) task paths, as in langgraph#9128, so several updates in one superstep writing the same DeltaChannel replay in the order given.
  • Send task paths become [PUSH, i, false] and node-error-handler paths become [*failedTask.path[:3], "node_error_handler", false] (the failed task's first three path elements), matching Python's shapes — langgraph_path task metadata changes accordingly, and task ids of functional task() calls under a Send or handler task change with them. The SDK's Send-task detection accepts both the old and new shapes.

  Upgrade notes:

  • PostgresSaver: run setup() once after upgrading, from one process, before the new version serves traffic. The task_path column comes from the first new migration since the saver shipped, and until it runs, reads and writes fail with column "task_path" does not exist. Several processes running setup() at once on a database that still needs the migration can fail with a duplicate key error on checkpoint_migrations.
  • Third-party checkpoint savers remain source-compatible but must now persist the taskPath they are given and return pendingWrites in writesSortKey order; the conformance suite's new base tests enforce this. A saver that ignores the new argument replays in task-id order and can rebuild a different DeltaChannel value than the run produced.
  • An incomplete superstep containing stored delta writes that must interleave with resumed or retried task writes is affected by the upgrade, whether the incompleteness came from an interrupt, a task error, a crash, or a drain: finish such threads with the old runtime before upgrading writers. A single interrupted node with no finished delta-writing siblings is safe to resume. The same applies to resuming work that includes functional task() calls under a Send or error-handler task, whose child task ids change.
  • @langchain/langgraph-checkpoint 1.2.0 must be released before any package requiring its new exports; the consumers' minimum ranges are raised accordingly.

Commits

• 4510774 chore: version packages (#2977)
• 1631fd8 fix(langgraph): order parallel writes by task path, like langgraph (Python) (...
• 6fb9a3f chore(deps): bump vitest from 4.1.10 to 4.1.11 (#2818)
• See full diff in compare view

Updates @langchain/quickjs from 0.6.4 to 0.6.5

Release notes

Sourced from @​langchain/quickjs's releases.

@​langchain/quickjs@​0.6.5

Patch Changes

• #957 8b1c1de Thanks @​open-swe! - Add maxSubagentConcurrency to configure the interpreter's per-REPL task() concurrency cap, retaining the default of 32. The prompt reflects the configured limit and treats batching around 10 as advisory.

Commits

• 9f3bfd5 chore: version packages (#926)
• 289ebba fix(quickjs): classify subagent concurrency changeset as patch (#958)
• 8b1c1de feat(quickjs): make subagent concurrency configurable (#957)
• 5f42f2d fix(deepagents): check filesystem permissions against the symlink-resolved pa...
• 02ff0f5 fix: patch axios and grpc security vulnerabilities (#952)
• 389e8da feat(deepagents): pin skills by name via pinnedSkills (#932)
• 9333679 feat(deepagents): load a skill's tools only when the skill is read (#929)
• b448f22 fix(deepagents): match CompositeBackend routes on path-segment boundaries (#919)
• 7839cda chore: version packages (#914)
• 279ad29 build(deps): bump hono from 4.13.5 to 4.13.7 (#918)
• Additional commits viewable in compare view