Update dependency langchain to v0.1.11 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
langchain	==0.0.285 -> ==0.1.11

---

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

CVE-2023-39631 / GHSA-f73w-4m7g-ch9x / PYSEC-2023-162 / PYSEC-2023-163

More information

Details

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Patches: Released in v.0.0.308. numexpr dependency is optional for langchain.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-39631
• https://github.com/langchain-ai/langchain/issues/8363
• https://github.com/pydata/numexpr/issues/442
• https://github.com/langchain-ai/langchain/pull/11302
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.308
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-162.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/numexpr/PYSEC-2023-163.yaml

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2023-39631 / GHSA-f73w-4m7g-ch9x / PYSEC-2023-162 / PYSEC-2023-163

More information

Details

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/pydata/numexpr/issues/442
• https://github.com/langchain-ai/langchain/issues/8363
• https://github.com/langchain-ai/langchain/pull/11302

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

langchain vulnerable to arbitrary code execution

CVE-2023-36281 / GHSA-7gfq-f96f-g85j / PYSEC-2023-151

More information

Details

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. This is related to __subclasses__ or a template.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-36281
• https://github.com/hwchase17/langchain/issues/4394
• https://github.com/langchain-ai/langchain/pull/10252
• https://github.com/langchain-ai/langchain/commit/22abeb9f6cc555591bf8e92b5e328e43aa07ff6c
• https://aisec.today/LangChain-2e6244a313dd46139c5ef28cbcab9e55
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.312
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-151.yaml

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2023-46229 / GHSA-655w-fm8m-m478 / PYSEC-2023-205

More information

Details

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Severity

Unknown

References

• https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8
• https://github.com/langchain-ai/langchain/pull/11925

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

LangChain Server Side Request Forgery vulnerability

CVE-2023-46229 / GHSA-655w-fm8m-m478 / PYSEC-2023-205

More information

Details

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-46229
• https://github.com/langchain-ai/langchain/pull/11925
• https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8
• https://github.com/langchain-ai/langchain
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-205.yaml

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LangChain vulnerable to arbitrary code execution

CVE-2023-39659 / GHSA-prgp-w7vf-ch62 / PYSEC-2023-147

More information

Details

An issue in langchain langchain-ai before version 0.0.325 allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-39659
• https://github.com/langchain-ai/langchain/issues/7700
• https://github.com/langchain-ai/langchain/pull/12427
• https://github.com/langchain-ai/langchain/pull/5640
• https://github.com/langchain-ai/langchain/commit/cadfce295f8a33828fc635c2e5ea28b883e5c992
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.325

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Langchain Server-Side Request Forgery vulnerability

CVE-2023-32786 / GHSA-6h8p-4hx9-w66c

More information

Details

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-32786
• https://github.com/langchain-ai/langchain/pull/12747
• https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.329

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

LangChain directory traversal vulnerability

CVE-2024-28088 / GHSA-h59x-p739-982c / PYSEC-2024-43 / PYSEC-2024-45

More information

Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Severity

Low

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-28088
• https://github.com/langchain-ai/langchain/pull/18600
• https://github.com/langchain-ai/langchain/commit/e1924b3e93d513ca950c72f8e80e1c133749fba5
• https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-core/PYSEC-2024-45.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-43.yaml

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

langchain vulnerable to path traversal

CVE-2024-3571 / GHSA-rgp8-pm28-3759

More information

Details

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-3571
• https://github.com/langchain-ai/langchain/commit/aad3d8bd47d7f5598156ff2bdcc8f736f24a7412
• https://github.com/langchain-ai/langchain
• https://huntr.com/bounties/2df3acdc-ee4f-4257-bbf8-a7de3870a9d8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

langchain Server-Side Request Forgery vulnerability

CVE-2024-0243 / GHSA-h9j7-5xvc-qhg5

More information

Details

With the following crawler configuration:

from bs4 import BeautifulSoup as Soup

url = "https://example.com"
loader = RecursiveUrlLoader(
    url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text 
)
docs = loader.load()

An attacker in control of the contents of https://example.com could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though prevent_outside=True.

https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51

Resolved in https://github.com/langchain-ai/langchain/pull/15559

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-0243
• https://github.com/langchain-ai/langchain/pull/15559
• https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51
• https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2024-28088 / GHSA-h59x-p739-982c / PYSEC-2024-43 / PYSEC-2024-45

More information

Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Severity

Unknown

References

• https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
• https://github.com/langchain-ai/langchain/blob/f96dd57501131840b713ed7c2e86cbf1ddc2761f/libs/core/langchain_core/utils/loading.py

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Release Notes

langchain-ai/langchain (langchain)

v0.1.11

Compare Source

What's Changed

• more query analysis docs by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18358
• docs: anthropic qa quickstart by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18459
• docs: anthropic quickstart by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18440
• Adding Azure Cosmos Mongo vCore Vector DB Cache by @​aayush3011 in https://github.com/langchain-ai/langchain/pull/16856
• community[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18454
• community[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18452
• community[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18449
• community[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18448
• community[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18447
• nvidia-trt[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18446
• improve query analysis docs by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18426
• langchain[patch]: add tools renderer for various non-openai agents by @​mackong in https://github.com/langchain-ai/langchain/pull/18307
• community: Add you.com tool, add async to retriever, add async testing, add You tool doc by @​scottnath in https://github.com/langchain-ai/langchain/pull/18032
• [Evals] Session-level feedback by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18463
• Update Notebook Image by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18470
• Evaluate on Version by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18471
• Improve notebook wording by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18472
• 👥 Update LangChain people data by @​jacoblee93 in https://github.com/langchain-ai/langchain/pull/18473
• Docs: Updated callbacks/index.mdx adding example on invoke method by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18403
• anthropic[minor]: claude 3 by @​efriis in https://github.com/langchain-ai/langchain/pull/18508
• docs: add groq to list of providers by @​sepiatone in https://github.com/langchain-ai/langchain/pull/18503
• docs: quickstart models by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18511
• docs:Update function "run" to "invoke" in llm_math.ipynb by @​standby24x7 in https://github.com/langchain-ai/langchain/pull/18505
• docs: Update function "run" to "invoke" by @​standby24x7 in https://github.com/langchain-ai/langchain/pull/18499
• community: Improved notebook for vector store "HANA Cloud" by @​MartinKolbAtWork in https://github.com/langchain-ai/langchain/pull/18496
• partners[anthropic]: update to docstrings of ChatAnthropic class by @​sepiatone in https://github.com/langchain-ai/langchain/pull/18493
• docs: update documentation of stackexchange component by @​sepiatone in https://github.com/langchain-ai/langchain/pull/18486
• RAPTOR by @​rlancemartin in https://github.com/langchain-ai/langchain/pull/18467
• [Evals] Support list examples by dataset version tag by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18534
• core: Release 0.1.29 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18530
• docs: update stack graphic by @​efriis in https://github.com/langchain-ai/langchain/pull/18532
• docs[minor]: Add thumbs up/down to all docs pages by @​bracesproul in https://github.com/langchain-ai/langchain/pull/18526
• Evals wording by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18542
• community[patch]: deprecate community fireworks by @​efriis in https://github.com/langchain-ai/langchain/pull/18544
• anthropic[patch]: multimodal by @​efriis in https://github.com/langchain-ai/langchain/pull/18517
• Update chain.py fixewd typo in chain by @​akashAD98 in https://github.com/langchain-ai/langchain/pull/18551
• anthropic[patch]: model type string by @​efriis in https://github.com/langchain-ai/langchain/pull/18510
• langchain[patch]: Release 0.1.11 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18558

New Contributors

• @​aayush3011 made their first contribution in https://github.com/langchain-ai/langchain/pull/16856

Full Changelog: langchain-ai/langchain@v0.1.10...v0.1.11

v0.1.10

Compare Source

What's Changed

• community: Fix SparkLLM error by @​liugddx in https://github.com/langchain-ai/langchain/pull/18015
• community[patch]: Release 0.0.23 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18027
• community: fix openai streaming throws 'AIMessageChunk' object has no attribute 'text' by @​nicoloboschi in https://github.com/langchain-ai/langchain/pull/18006
• community[patch]: BaseLLM typing in init by @​efriis in https://github.com/langchain-ai/langchain/pull/18029
• community[patch]: Release 0.0.24 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18038
• infra: CI success for partner packages by @​efriis in https://github.com/langchain-ai/langchain/pull/18037
• infra: CI success for partner packages 2 by @​efriis in https://github.com/langchain-ai/langchain/pull/18043
• docs: recommend lambdas over runnablebranch by @​efriis in https://github.com/langchain-ai/langchain/pull/18033
• partners: Add Fireworks partner packages by @​benjibc in https://github.com/langchain-ai/langchain/pull/17694
• Updates to partners/exa README by @​DannyMac180 in https://github.com/langchain-ai/langchain/pull/18047
• openai[patch]: remove numpy dep by @​efriis in https://github.com/langchain-ai/langchain/pull/18034
• docs: fireworks fixes by @​efriis in https://github.com/langchain-ai/langchain/pull/18056
• infra: simplify and fix CI for docs-only changes by @​efriis in https://github.com/langchain-ai/langchain/pull/18058
• docs: fireworks tool calling docs by @​efriis in https://github.com/langchain-ai/langchain/pull/18057
• openai[patch]: refactor with_structured_output by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18052
• core[patch]: Runnable with message history to use add_messages by @​eyurtsev in https://github.com/langchain-ai/langchain/pull/17958
• community: Add async_client for Anyscale Chat model by @​kylehh in https://github.com/langchain-ai/langchain/pull/18050
• experimental: docstrings update by @​leo-gan in https://github.com/langchain-ai/langchain/pull/18048
• community: Add document manager and mongo document manager by @​2jimoo in https://github.com/langchain-ai/langchain/pull/17320
• docs[patch]: Remove redundant Pinecone import by @​jacoblee93 in https://github.com/langchain-ai/langchain/pull/18079
• docs:Add Cohere examples in documentation by @​BeatrixCohere in https://github.com/langchain-ai/langchain/pull/17794
• langchain_community: fix llama index imports and fields access by @​maximeperrindev in https://github.com/langchain-ai/langchain/pull/17870
• partners/astradb: Add AstraDBChatMessageHistory to langchain-astradb package by @​cbornet in https://github.com/langchain-ai/langchain/pull/17732
• community [enh] : adds callback handler for Fiddler AI by @​bhalder in https://github.com/langchain-ai/langchain/pull/17708
• community: Remove model limitation on Anyscale LLM by @​kylehh in https://github.com/langchain-ai/langchain/pull/17662
• docs: update azure search langchain notebook by @​mattgotteiner in https://github.com/langchain-ai/langchain/pull/18053
• langchain: Make BooleanOutputParser more robust to non-binary responses by @​dokato in https://github.com/langchain-ai/langchain/pull/17810
• Add additional examples for other modules to partners/exa README by @​DannyMac180 in https://github.com/langchain-ai/langchain/pull/18081
• Use astrapy's upsert_one method in AstraDBStore by @​cbornet in https://github.com/langchain-ai/langchain/pull/18063
• community: Fix GraphSparqlQAChain so that it works with Ontotext GraphDB by @​nelly-hateva in https://github.com/langchain-ai/langchain/pull/15009
• community: Fix GenericRequestsWrapper _aget_resp_content must be async by @​cbornet in https://github.com/langchain-ai/langchain/pull/18065
• anthropic[minor]: package move by @​efriis in https://github.com/langchain-ai/langchain/pull/17974
• google-genai, google-vertexai: move to langchain-google by @​efriis in https://github.com/langchain-ai/langchain/pull/17899
• docs: api docs for external repos by @​efriis in https://github.com/langchain-ai/langchain/pull/17904
• docs: Fix the bug in MongoDBChatMessageHistory notebook by @​rongchenlin in https://github.com/langchain-ai/langchain/pull/18128
• langchain: Import from langchain_core in langchain.smith to avoid deprecation warning by @​simonschmidt in https://github.com/langchain-ai/langchain/pull/18129
• langchain[patch]: Update doc-string for a method in ConversationBufferWindowMemory by @​keenborder786 in https://github.com/langchain-ai/langchain/pull/18090
• add run name for query constructor by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18101
• Add BaseMessage.id by @​nfcampos in https://github.com/langchain-ai/langchain/pull/17835
• docs: anthropic partner package docs by @​efriis in https://github.com/langchain-ai/langchain/pull/18109
• Fix bug with using configurable_fields after configurable_alternatives by @​nfcampos in https://github.com/langchain-ai/langchain/pull/18139
• Improve runnable generator error messages by @​nfcampos in https://github.com/langchain-ai/langchain/pull/18142
• infra: create api rst for specific pkg by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18144
• core[patch], langchain[patch], templates: move openai functions parser to core by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18060
• docs [patch] : fix import to use community path for handler in fiddler notebook by @​bhalder in https://github.com/langchain-ai/langchain/pull/18140
• [docs] Update doc-string for buffer_as_messages method in ConversationBufferWindowMemory by @​lgabs in https://github.com/langchain-ai/langchain/pull/18136
• Docs: azuresearch.ipynb (in docs/docs/integrations/vectorstores) -- fixed headings and comments by @​HeidiSteen in https://github.com/langchain-ai/langchain/pull/18135
• infra: api docs build commit dir by @​efriis in https://github.com/langchain-ai/langchain/pull/18147
• infra: api docs setup action location by @​efriis in https://github.com/langchain-ai/langchain/pull/18148
• community: Add Laser Embedding Integration by @​dstambler17 in https://github.com/langchain-ai/langchain/pull/18111
• community: make SET allow_experimental_[engine]_index configurabe in vectorstores.clickhouse by @​bgdsh in https://github.com/langchain-ai/langchain/pull/18107
• langchain[patch], core[patch], openai[patch], fireworks[minor]: ChatFireworks.with_structured_output by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18078
• Langchain vectorstore integration with Kinetica by @​am-kinetica in https://github.com/langchain-ai/langchain/pull/18102
• community: vectorstores.kdbai - Added support for when no docs are present by @​jaskirat8 in https://github.com/langchain-ai/langchain/pull/18103
• Experimental: Add other threshold types to SemanticChunker by @​matthaigh27 in https://github.com/langchain-ai/langchain/pull/16807
• partners: add Elasticsearch package by @​maxjakob in https://github.com/langchain-ai/langchain/pull/17467
• add optimization notebook by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18155
• core[patch]: support JS message serial namespaces by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18151
• mistral[minor]: Function calling and with_structured_output by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18150
• move document compressor base by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/17910
• core[patch]: Release 0.1.27 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18159
• openai[patch], mistral[patch], fireworks[patch]: releases 0.0.8, 0.0.5, 0.0.2 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18186
• Harrison/add structured output by @​hwchase17 in https://github.com/langchain-ai/langchain/pull/18165
• Adding documentation for deprecation of OpenAI functions by @​isahers1 in https://github.com/langchain-ai/langchain/pull/18164
• Assign message id in ChatOpenAI by @​nfcampos in https://github.com/langchain-ai/langchain/pull/17837
• community[feat]: Adds LLMLingua as a document compressor by @​thehapyone in https://github.com/langchain-ai/langchain/pull/17711
• airbyte[patch]: init pkg by @​efriis in https://github.com/langchain-ai/langchain/pull/18236
• airbyte[patch]: core version 0.1.5 by @​efriis in https://github.com/langchain-ai/langchain/pull/18244
• docs: add documentation for Google Cloud database integrations by @​averikitsch in https://github.com/langchain-ai/langchain/pull/18225
• IBM[patch]: release 0.1.0 Add possibility to pass ModelInference or Model object to WatsonxLLM class by @​MateuszOssGit in https://github.com/langchain-ai/langchain/pull/18189
• infra: api docs folder move by @​efriis in https://github.com/langchain-ai/langchain/pull/18223
• docs: update documentation for Google Cloud database integrations by @​jackwotherspoon in https://github.com/langchain-ai/langchain/pull/18265
• fix: BigQueryVectorSearch JSON type unsupported for metadatas by @​ashleyxuu in https://github.com/langchain-ai/langchain/pull/18234
• docs: airbyte github cookbook by @​efriis in https://github.com/langchain-ai/langchain/pull/18275
• langchain_nvidia_ai_endpoints[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18271
• Remove check preventing passing non-declared config keys by @​nfcampos in https://github.com/langchain-ai/langchain/pull/18276
• Add PNG drawer for Runnable.get_graph() by @​nfcampos in https://github.com/langchain-ai/langchain/pull/18239
• community[patch]: added latin-1 decoder to gmail search tool by @​Sanjaypranav in https://github.com/langchain-ai/langchain/pull/18116
• community[minor]: add hugging_face_model document loader by @​ruanwz in https://github.com/langchain-ai/langchain/pull/17323
• langchain_anthropic[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18274
• community[minor]: Add SQLDatabaseLoader document loader by @​eyurtsev in https://github.com/langchain-ai/langchain/pull/18281
• langchain[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18282
• ci: Update issue template required checks by @​bracesproul in https://github.com/langchain-ai/langchain/pull/18283
• community[patch]: Invoke callback prior to yielding token for volcengine_maas by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18288
• ollama[patch]: delete suffix slash to avoid redirect by @​mackong in https://github.com/langchain-ai/langchain/pull/18260
• docs: remove duplicate word in lcel/streaming by @​zhangkai803 in https://github.com/langchain-ai/langchain/pull/18249
• partner: Astra DB clients identify themselves as coming through LangChain package by @​hemidactylus in https://github.com/langchain-ai/langchain/pull/18131
• community: Fix deprecation version of AstraDB VectorStore by @​cbornet in https://github.com/langchain-ai/langchain/pull/17991
• update extraction use-case docs by @​ccurme in https://github.com/langchain-ai/langchain/pull/17979
• docs: update to the list of partner packages in the list of providers by @​sepiatone in https://github.com/langchain-ai/langchain/pull/18252
• langchain_groq[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18272
• langchain_openai[patch]: Invoke callback prior to yielding token by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18269
• docs: google provider page fixes by @​leo-gan in https://github.com/langchain-ai/langchain/pull/18290
• docs: update Google documentation by @​averikitsch in https://github.com/langchain-ai/langchain/pull/18297
• [Evaluation] Config Fix by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18231
• experimental[patch]: Release 0.0.53 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18330
• docs: update func calling doc by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18300
• skip airbyte api docs by @​efriis in https://github.com/langchain-ai/langchain/pull/18334
• infra: skip ibm api docs by @​efriis in https://github.com/langchain-ai/langchain/pull/18335
• docs providers update by @​leo-gan in https://github.com/langchain-ai/langchain/pull/18336
• community: Add PolygonFinancials Tool by @​virattt in https://github.com/langchain-ai/langchain/pull/18324
• Add links to relevant DataCamp code alongs by @​filipsch in https://github.com/langchain-ai/langchain/pull/18332
• docs: remove duplicate quote in AzureOpenAIEmbeddings doc by @​zhangkai803 in https://github.com/langchain-ai/langchain/pull/18315
• docs: query analysis use case by @​baskaryan in https://github.com/langchain-ai/langchain/pull/17766
• Add optional output_parser param in create_react_agent by @​hasansustcse13 in https://github.com/langchain-ai/langchain/pull/18320
• Add support for parameters in neo4j retrieval query by @​tomasonjo in https://github.com/langchain-ai/langchain/pull/18310
• core[patch]: Release 0.1.28 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18341
• ci dirs in wrong order by @​efriis in https://github.com/langchain-ai/langchain/pull/18340
• Updated partners/ibm README by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18268
• community[patch]: remove llmlingua extended tests by @​efriis in https://github.com/langchain-ai/langchain/pull/18344
• community[patch]: Fixing embedchain document mapping by @​kellerkind84 in https://github.com/langchain-ai/langchain/pull/18255
• Updated partners/fireworks README by @​williamdevena in https://github.com/langchain-ai/langchain/pull/18267
• partners: MongoDB Partner Package -- Porting MongoDBAtlasVectorSearch by @​Jibola in https://github.com/langchain-ai/langchain/pull/17652
• infra: mongodb env vars by @​efriis in https://github.com/langchain-ai/langchain/pull/18347
• mongodb[patch]: core 0.1.5 dep by @​efriis in https://github.com/langchain-ai/langchain/pull/18348
• docs: airbyte deps note by @​efriis in https://github.com/langchain-ai/langchain/pull/18243
• deprecation docstring with lib by @​efriis in https://github.com/langchain-ai/langchain/pull/18350
• multiple[patch]: fix deprecation versions by @​efriis in https://github.com/langchain-ai/langchain/pull/18349
• Fix fireworks bind tools by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18352
• infra: tolerate partner package move in ci by @​efriis in https://github.com/langchain-ai/langchain/pull/18355
• [Core] Patch: rm dumpd of outputs from runnables/base by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18295
• Fix missing labels by @​nfcampos in https://github.com/langchain-ai/langchain/pull/18356
• text-splitters[minor], langchain[minor], community[patch], templates, docs: langchain-text-splitters 0.0.1 by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18346
• community[patch]: BaseLoader load method should just delegate to lazy_load by @​eyurtsev in https://github.com/langchain-ai/langchain/pull/18289
• langchain[patch]: langchain-text-splitters dep by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18357
• docs: text splitters readme by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18359
• templates: use langchain-text-splitters by @​efriis in https://github.com/langchain-ai/langchain/pull/18360
• infra: update create_api_rst by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18361
• docs: update api ref nav by @​baskaryan in https://github.com/langchain-ai/langchain/pull/18362
• fireworks[patch]: remove custom async and stream implementations by @​efriis in https://github.com/langchain-ai/langchain/pull/18363
• docs[patch]: Add Neo4j GraphAcademy to tutorials section by @​jacoblee93 in https://github.com/langchain-ai/langchain/pull/18353
• chore(deps): FastEmbed to latest by @​Anush008 in https://github.com/langchain-ai/langchain/pull/18040
• Add dataset version info by @​hinthornw in https://github.com/langchain-ai/langchain/pull/18299
• partner: Fix fireworks async stream by @​benjibc in https://github.com/langchain-ai/langchain/pull/18372
• community: Change github endpoint in GithubLoader by @​RadhikaBansal97 in https://github.com/langchain-ai/langchain/pull/17622
• docs: nvidia: provider page update by @​leo-gan in https://github.com/langchain-ai/langchain/pull/18054
• runnable module description by @​leo-gan in https://github.com/langchain-ai/langchain/pull/17966
• Add openvino backend support by @​OpenVINO-dev-contest in https://github.com/langchain-ai/langchain/pull/11591
• community: add BigDL-LLM integrations by @​shane-huang in https://github.com/langchain-ai/langchain/pull/17953
• community: Voyage AI updates default model and batch size by @​thomas0809 in [https://github.com/community: Voyage AI updates default model and batch size langchain-ai/langchain#17655](https:/

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.