build(deps): bump the npm_and_yarn group across 1 directory with 12 updates by dependabot[bot] · Pull Request #9 · composio-community/open-gumloop

dependabot · 2026-07-24T04:19:10Z

Bumps the npm_and_yarn group with 4 updates in the / directory: @langchain/community, @langchain/core, next and ws.

Updates @langchain/community from 0.3.42 to 1.1.29

Release notes

Sourced from @langchain/community's releases.

@langchain/community@1.1.29

Patch Changes

#63 bb52506 Thanks @hntrl! - The community package is being sunsetted. See #61 for details and guidance. Thank you to everyone who has contributed integrations, fixes, reviews, and maintenance over the years.

@langchain/community@1.1.28

Patch Changes

#44 f9a922e Thanks @dependabot! - chore(deps): bump fast-xml-parser from 5.5.9 to 5.7.0

#30 9cd006c Thanks @christian-bromann! - fix(pdf-loader): support both pdf-parse v1 and v2

#36 1e2e4bf Thanks @hntrl! - Fix Milvus collection loading before delete operations (#9749) and partition name handling in search/delete (#9748)

Added loadCollectionSync() call in the delete() method to ensure collection is loaded before delete operations

Added partition_names parameter to search() call in similaritySearchVectorWithScore()

Added partition_name parameter to both deleteEntities() and delete() calls

Updated error message in delete method from "before search" to "before deletion"

#41 5bd4246 Thanks @RaschidJFR! - Expose basePath option in VoyageEmbeddings class

#43 b835751 Thanks @jkennedyvz! - chore(deps): bump transitive dependencies to patch 6 security alerts

Updates pnpm overrides to resolve critical and high severity Dependabot alerts in transitive dependencies reached via optional peerDependencies and dev tooling:

protobufjs ^7.2.5 -> ^7.5.5 (CVE-2026-41242)

basic-ftp >=5.2.0 -> ^5.3.0 (CVE-2026-39983, GHSA-rp42-5vxx-qpwr, GHSA-6v7q-wjvx-w8wg)

vite new override ^7.3.2 (CVE-2026-39363, CVE-2026-39364, plus CVE-2026-39365 as a side effect)

No workspace package has these as direct dependencies; overrides affect the monorepo lockfile only and do not change published package contents.

#42 3657e90 Thanks @RaschidJFR! - surface Voyage AI API errors in VoyageEmbeddings

Commits

See full diff in compare view

Updates @langchain/core from 0.3.55 to 1.2.3

Release notes

Sourced from @langchain/core's releases.

@langchain/core@1.2.3

Patch Changes

#11200 08e5888 Thanks @hntrl! - fix(aws): normalize and safely replay Bedrock reasoning blocks

Emit standard reasoning blocks with preserved signatures, omit incomplete signature-only reasoning during replay, and retain compatibility with legacy and redacted Bedrock reasoning.

@langchain/core@1.2.2

Patch Changes

#11171 82bef01 Thanks @christian-bromann! - fix(core): coerce string v1 AIMessage content to text blocks

Prevent contentBlocks.push is not a function when constructing an AIMessage with response_metadata.output_version === "v1" and string content (common in serialized LangGraph stream payloads).

@langchain/core@1.2.1

Patch Changes

#10674 f017708 Thanks @christian-bromann! - fix: classify provider 429s before retrying

#11092 7918bbd Thanks @aolsenjazz! - fix(core): only treat arrays of content blocks as ToolMessage content

Fix tool outputs that are arrays of plain objects being forwarded as malformed message content. An array is now only treated as message content blocks when every element is an object with a type; otherwise it is JSON-stringified.

@langchain/core@1.2.0

Minor Changes

#10924 2e28115 Thanks @christian-bromann! - feat(core): add OpenAI-compatible stream event conversion

Patch Changes

#11047 ac0f71d Thanks @christian-bromann! - fix(core): preserve AIMessage content blocks

Keep existing v1 contentBlocks when constructing AIMessage instances so serialized messages do not lose block content during deserialization.

@langchain/core@1.1.48

Patch Changes

#10832 1b24369 Thanks @info-arnav! - fix(core, openrouter): make CJS default re-exports callable

#10666 2bb55b0 Thanks @hnustwjj! - feat(openrouter): surface reasoning content as v1 standard content blocks

convertOpenRouterResponseToBaseMessage and convertOpenRouterDeltaToBaseMessageChunk now copy OpenRouter's reasoning (flat string) and reasoning_details (structured array) fields onto additional_kwargs.reasoning_content / additional_kwargs.reasoning_details. A new ChatOpenRouterTranslator is registered in @langchain/core under the "openrouter" provider key so AIMessage.contentBlocks emits standard {type: "reasoning"} blocks alongside text and tool calls.

... (truncated)

Commits

82a6b8e chore: version packages (#11202)
08e5888 fix(aws): normalize Bedrock reasoning blocks (#11200)
21aaeb0 fix: patch 13 high/critical Dependabot alerts (#11199)
782c7f2 chore(dev): bump @types/node from 25.9.1 to 26.1.0 in the types group across ...
f51f338 chore: version packages (#11176)
09e7f6d fix(openai): drop tool_call content blocks from chat completions input (#11...
a9f123a fix(openai): filter out content blocks the chat completions api rejects as in...
cc39f56 chore: version packages (#11172)
82bef01 fix(core): coerce string v1 AIMessage content to text blocks (#11171)
8a7c5f8 chore: version packages (#11170)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @langchain/core since your current version.

Updates next from 15.3.2 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[15.5.x] Don't drop FormData entries (#94244)

Other

[15.5.x] Fix CI (#94281)

Credits

Huge thanks to @eps1lon for helping!

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

... (truncated)

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates uuid from 9.0.1 to 11.1.0

Release notes

Sourced from uuid's releases.

v11.1.0

11.1.0 (2025-02-19)

Features

update TS types to allowUint8Array subtypes for buffer option (#865) (a5231e7)

v11.0.5

11.0.5 (2025-01-09)

Bug Fixes

add TS unit test, pin to typescript@5.0.4 (#860) (24ac2fd)

v11.0.4

11.0.4 (2025-01-05)

Bug Fixes

docs: insure -> ensure (#843) (d2a61e1)

exclude tests from published package (#840) (f992ff4)

Test for invalid byte array sizes and ranges in v1(), v4(), and v7() (#845) (e0ee900)

v11.0.3

11.0.3 (2024-11-04)

Bug Fixes

apply stricter typing to the v* signatures (#831) (c2d3fed)

export internal uuid types (#833) (341edf4)

remove sourcemaps (#827) (b93ea10)

revert "simplify type for v3 and v5" (#835) (e2dee69)

v11.0.2

11.0.2 (2024-10-28)

Bug Fixes

remove wrapper.mjs (2a18871)

remove wrapper.mjs (#822) (6683ad3)

v11.0.1

11.0.1 (2024-10-27)

... (truncated)

Changelog

Sourced from uuid's changelog.

11.1.0 (2025-02-19)

Features

update TS types to allowUint8Array subtypes for buffer option (#865) (a5231e7)

11.0.5 (2025-01-09)

Bug Fixes

add TS unit test, pin to typescript@5.0.4 (#860) (24ac2fd)

11.0.4 (2025-01-05)

Bug Fixes

docs: insure -> ensure (#843) (d2a61e1)

exclude tests from published package (#840) (f992ff4)

Test for invalid byte array sizes and ranges in v1(), v4(), and v7() (#845) (e0ee900)

11.0.3 (2024-11-04)

Bug Fixes

apply stricter typing to the v* signatures (#831) (c2d3fed)

export internal uuid types (#833) (341edf4)

remove sourcemaps (#827) (b93ea10)

revert "simplify type for v3 and v5" (#835) (e2dee69)

11.0.2 (2024-10-28)

Bug Fixes

remove wrapper.mjs (#822) (6683ad3)

11.0.1 (2024-10-27)

Bug Fixes

restore package.json#browser field (#817) (ae8f386)

11.0.0 (2024-10-26)

⚠ BREAKING CHANGES

refactor v1 internal state and options logic (#780)

... (truncated)

Commits

3d1eba0 chore(main): release 11.1.0 (#866)
a5231e7 feat: update TS types to allowUint8Array subtypes for buffer option (#865)
aeabb60 docs: docs housecleaning (#864)
46ada3c chore(main): release 11.0.5 (#861)
24ac2fd fix: add TS unit test, pin to typescript@5.0.4 (#860)
e426aaa build: use npm pack tarball for local examples and testing instead of .loca...
050cd5b chore(main): release 11.0.4 (#842)
e0ee900 fix: Test for invalid byte array sizes and ranges in v1(), v4(), and `v7(...
6e83b3a chore: update deps (#848)
5f58b43 docs: Ensure link to getrandomvalues-not-supported is maintained (#844)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by broofa, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates axios from 1.9.0 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Commits

2d06f96 chore(release): prepare release 1.18.0 (#11003)
32fc489 fix: malformed http urls (#11000)
b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
fe964f9 docs: mark proxy config as Node.js only (#10995)
5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
fae9d4e docs: clarify package update PR policy (#10992)
28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
614f455 docs: publish v1.17.0 release notes (#10988)
6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates file-type from 16.5.4 to 21.3.2

Release notes

Sourced from file-type's releases.

v21.3.2

Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7

Fix bound recursive BOM and ID3 detection 370ed91

sindresorhus/file-type@v21.3.1...v21.3.2

v21.3.1

Fix infinite loop in ASF parser on malformed input (GHSA-5v7r-6r5c-r473) 319abf8

sindresorhus/file-type@v21.3.0...v21.3.1

v21.3.0

Add support for Mach-O Universal (aka "Fat") binaries and additional architectures (#779) d223491

sindresorhus/file-type@v21.2.0...v21.3.0

v21.2.0

Add support for SPSS data files (#787) 889f638

Add support for JMP (#784) 093dba0

sindresorhus/file-type@v21.1.1...v21.2.0

v21.1.1

Fix handling of partial Gunzip file (#783) 710e053

sindresorhus/file-type@v21.1.0...v21.1.1

v21.1.0

Add support for .tar.gz (gunzipped tarball file) (#763) eda03a7

Add support for Windows registry (.reg) files 0db61ec 7d2ddcf

Add support for Windows registry hive file (.dat) (#767) f8d62be

Fix: Handle partial unzip (#773) 7ad3a90

sindresorhus/file-type@v21.0.0...v21.1.0

v21.0.0

Breaking

... (truncated)

Commits

e18028c 21.3.2
a155cd7 Fix ZIP bomb in known-size ZIP probing
6954817 Harden parser more
370ed91 Fix bound recursive BOM and ID3 detection
d2ecea1 Add a few more safeguards
41fcff5 Update readme
a8f6934 Fix CI
ad5857e 21.3.1
5d2fedf Harden parser
319abf8 Fix infinite loop in ASF parser on malformed input
Additional commits viewable in compare view

Updates follow-redirects from 1.15.9 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
21ef28a Release version 1.15.11 of the npm package.
7c88135 Roll back tree shaking.
6e389ba Release version 1.15.10 of the npm package.
5bc496e Shake me up before you go-go.
694d6b4 Bump minimist from 1.2.5 to 1.2.8
See full diff in compare view

Updates form-data from 4.0.0 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

... (truncated)

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
68ff7dd v4.0.5
5822467 [Dev Deps] update @ljharb/eslint-config, eslint
76d0dee [Fix] set Symbol.toStringTag in the proper place
16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
41996f5 v4.0.4
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.1.0 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released

…pdates Bumps the npm_and_yarn group with 4 updates in the / directory: [@langchain/community](https://github.com/langchain-ai/langchainjs-community), [@langchain/core](https://github.com/langchain-ai/langchainjs), [next](https://github.com/vercel/next.js) and [ws](https://github.com/websockets/ws). Updates `@langchain/community` from 0.3.42 to 1.1.29 - [Release notes](https://github.com/langchain-ai/langchainjs-community/releases) - [Commits](https://github.com/langchain-ai/langchainjs-community/commits/@langchain/community@1.1.29) Updates `@langchain/core` from 0.3.55 to 1.2.3 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core==0.3.55...@langchain/core@1.2.3) Updates `next` from 15.3.2 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.2...v15.5.21) Updates `uuid` from 9.0.1 to 11.1.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v11.1.0) Updates `axios` from 1.9.0 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.9.0...v1.18.0) Updates `file-type` from 16.5.4 to 21.3.2 - [Release notes](https://github.com/sindresorhus/file-type/releases) - [Commits](sindresorhus/file-type@v16.5.4...v21.3.2) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0) Updates `form-data` from 4.0.0 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.6) Updates `js-yaml` from 4.1.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.0) Updates `langsmith` from 0.3.27 to 0.8.6 - [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases) - [Commits](langchain-ai/langsmith-sdk@v0.3.27...v0.8.6) Updates `ws` from 8.18.2 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.2...8.21.1) Updates `yaml` from 2.7.1 to 2.9.0 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.7.1...v2.9.0) --- updated-dependencies: - dependency-name: "@langchain/community" dependency-version: 1.1.29 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@langchain/core" dependency-version: 1.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 11.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.18.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: file-type dependency-version: 21.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: langsmith dependency-version: 0.8.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.9.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates - #9

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#9
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-c62c02abb5

dependabot Bot commented on behalf of github Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026

@​langchain/community@​1.1.29

Patch Changes

@​langchain/community@​1.1.28

Patch Changes

@​langchain/core@​1.2.3

Patch Changes

@​langchain/core@​1.2.2

Patch Changes

@​langchain/core@​1.2.1

Patch Changes

@​langchain/core@​1.2.0

Minor Changes

Patch Changes

@​langchain/core@​1.1.48

Patch Changes

v15.5.21

v15.5.20

15.5.19

Core Changes

Other

Credits

v15.5.18

v11.1.0

11.1.0 (2025-02-19)

Features

v11.0.5

11.0.5 (2025-01-09)

Bug Fixes

v11.0.4

11.0.4 (2025-01-05)

Bug Fixes

v11.0.3

11.0.3 (2024-11-04)

Bug Fixes

v11.0.2

11.0.2 (2024-10-28)

Bug Fixes

v11.0.1

11.0.1 (2024-10-27)

11.1.0 (2025-02-19)

Features

11.0.5 (2025-01-09)

Bug Fixes

11.0.4 (2025-01-05)

Bug Fixes

11.0.3 (2024-11-04)

Bug Fixes

11.0.2 (2024-10-28)

Bug Fixes

11.0.1 (2024-10-27)

Bug Fixes

11.0.0 (2024-10-26)

⚠ BREAKING CHANGES

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v21.3.2

v21.3.1

v21.3.0

v21.2.0

v21.1.1

v21.1.0

`@langchain/community@1`.1.29

`@langchain/community@1`.1.28

`@langchain/core@1`.2.3

`@langchain/core@1`.2.2

`@langchain/core@1`.2.1

`@langchain/core@1`.2.0

`@langchain/core@1`.1.48