Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 6 updates#698

Merged
pdettori merged 1 commit into
mainfrom
dependabot/uv/a2a/weather_service/minor-and-patch-89625e22de
Jul 15, 2026
Merged

chore(deps): Bump the minor-and-patch group across 1 directory with 6 updates#698
pdettori merged 1 commit into
mainfrom
dependabot/uv/a2a/weather_service/minor-and-patch-89625e22de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the /a2a/weather_service directory:

Package From To
langgraph 1.2.7 1.2.9
langchain-core 1.4.8 1.4.9
langchain-openai 1.3.3 1.3.5
pyasn1 0.6.3 0.6.4
gitpython 3.1.50 3.1.51
langsmith 0.9.5 0.10.3

Updates langgraph from 1.2.7 to 1.2.9

Release notes

Sourced from langgraph's releases.

langgraph==1.2.9

Changes since 1.2.8

  • release(langgraph): 1.2.9 (#8316)
  • fix: updateState metadata/counters for delta channel (#8315)

langgraph==1.2.8

Changes since 1.2.7

  • release(langgraph): 1.2.8 (#8292)
  • fix: delta channel bug with updateState on fresh thread will force snapshot instead of stub checkpoint (#8290)
  • chore(deps): bump the minor-and-patch group in /libs/langgraph with 8 updates (#8255)
  • chore(deps): bump websockets from 15.0.1 to 16.0 in /libs/langgraph in the major group (#8256)
  • chore(deps): bump the minor-and-patch group in /libs/sdk-py with 9 updates (#8252)
Commits
  • 95af6a0 release(langgraph): 1.2.9 (#8316)
  • 7d0b33c fix: updateState metadata/counters for delta channel (#8315)
  • 23652c5 release(langgraph): 1.2.8 (#8292)
  • b45d96b fix: delta channel bug with updateState on fresh thread will force snapshot i...
  • be999ad chore(deps): bump the minor-and-patch group in /libs/cli with 5 updates (#8251)
  • 4df294f chore(deps): bump the minor-and-patch group in /libs/langgraph with 8 updates...
  • 84e065a chore(deps): bump websockets from 15.0.1 to 16.0 in /libs/langgraph in the ma...
  • 64a3e68 chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 6 u...
  • 7989e59 chore(deps): bump the minor-and-patch group in /libs/sdk-py with 9 updates (#...
  • 2390d6f chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 in the minor-and-p...
  • Additional commits viewable in compare view

Updates langchain-core from 1.4.8 to 1.4.9

Release notes

Sourced from langchain-core's releases.

langchain-core==1.4.9

Changes since langchain-core==1.4.8

release(core): 1.4.9 (#38728) fix(core): improve langsmith loader error messages (#35648) fix(core): output parser bugs in xml.py and pydantic.py (#35641) style(core): fix some ruff preview rules (#38656) fix(core): avoid dict shadowing in language models (#38480) fix(core): _parse_google_docstring mishandling continuation lines with colons (#35680) fix(core): add messages to bare raise ValueError calls (#38158) fix(core): use asyncio.get_running_loop() in async contexts (#38157) chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (#38319) chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (#38326) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (#38327)

Commits
  • 1c3a418 release(core): 1.4.9 (#38728)
  • 1619f3d chore(standard-tests): fix some typings detected by ty (#38707)
  • a6f0369 chore(qdrant): bump fastembed to latest (#38726)
  • fca0a97 fix(langchain): propagate interrupts through ToolRetryMiddleware (#38722)
  • 874bada chore(model-profiles): refresh model profile data (#38712)
  • 6e51a7e chore(model-profiles): refresh model profile data (#38699)
  • 2d8100c fix(langchain-classic): fix Chain.save() regression from dict-to-`model_dum...
  • b08c391 test(openai): skip Codex VCR tests before cassette setup (#38690)
  • 83386b5 chore(model-profiles): refresh model profile data (#38689)
  • 701cc0e test(deps): Include Python 3.14 in integration test matrix (#34993)
  • Additional commits viewable in compare view

Updates langchain-openai from 1.3.3 to 1.3.5

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.3.5

Changes since langchain-openai==1.3.4

release(openai): 1.3.5 (#38785) feat(openai): support explicit prompt caching (#38762) chore(model-profiles): refresh model profile data (#38774)

langchain-openai==1.3.4

Changes since langchain-openai==1.3.3

release(openai): 1.3.4 (#38731) fix(openai): suppress Pydantic serializer warning on structured output parsed field (#37727) test(openai): skip Codex VCR tests before cassette setup (#38690) chore: bump the minor-and-patch group across 3 directories with 11 updates (#38587) chore: bump langgraph-checkpoint from 4.1.0 to 4.1.1 in /libs/partners/openai (#38476) fix(core): use asyncio.get_running_loop() in async contexts (#38157) test(openai): clarify async API key sync failure trace (#38379)

Commits

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
  • Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
  • Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)
Commits

Updates gitpython from 3.1.50 to 3.1.51

Release notes

Sourced from gitpython's releases.

3.1.51 - Security

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.50...3.1.51

Commits
  • 7b0764d bump to v3.1.51
  • af027be Merge pull request #2163 from gitpython-developers/fix-unguarded-blame
  • 701ce32 fix: Guard unsafe git command options (GHSA-956x-8gvw-wg5v)
  • 65a7283 Merge pull request #2168 from gitpython-developers/advisory-fix-1
  • 3e59876 Merge pull request #2169 from gitpython-developers/fix-config-assert
  • f033017 chore: avoid duplicate runs of CI in PRs
  • 1551238 fix: allow relative config paths with includes (#2103)
  • 5680608 fix: reject joined unsafe short options
  • 181e8ed Address review feedback about unsafe option abbreviations
  • 40f1424 Add Commit.is_shallow property; document stats() limitation at shallow bounda...
  • Additional commits viewable in compare view

Updates langsmith from 0.9.5 to 0.10.3

Release notes

Sourced from langsmith's releases.

v0.10.3

What's Changed

Full Changelog: langchain-ai/langsmith-sdk@v0.10.2...v0.10.3

v0.10.2

What's Changed

New Contributors

Full Changelog: langchain-ai/langsmith-sdk@v0.10.1...v0.10.2

v0.10.1

What's Changed

New Contributors

Full Changelog: langchain-ai/langsmith-sdk@v0.10.0...v0.10.1

v0.10.0

What's Changed

... (truncated)

Commits
  • 22971e5 release(python): bump py version to 0.10.3 (#3203)
  • c7d1e49 chore: sync langsmith_api (#3165)
  • e23e3cb chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /python (#3200)
  • 789b177 chore(deps): bump nltk from 3.9.4 to 3.10.0 in /python (#3186)
  • ef5a507 chore(deps): bump esbuild from 0.17.19 to 0.28.1 in /js/internal/environment_...
  • ef88e9c feat(voice): capture Pipecat TTS/realtime model costs (#3192)
  • be3ff20 feat(voice): capture LiveKit realtime model costs (#3191)
  • 0bb71a9 chore: bump _MIN_BACKEND_VERSION to 0.16.13rc1 (#3182)
  • f2c7ec8 fix: Auto-Batch Processing Drops Workspace Override Leading to Cross-Tenant D...
  • 687fc8d release(python): bump py version to 0.10.2 (#3189)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates

Bumps the minor-and-patch group with 6 updates in the /a2a/weather_service directory:

| Package | From | To |
| --- | --- | --- |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.7` | `1.2.9` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.4.8` | `1.4.9` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.3.3` | `1.3.5` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.3` | `0.6.4` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.50` | `3.1.51` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.9.5` | `0.10.3` |



Updates `langgraph` from 1.2.7 to 1.2.9
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@1.2.7...1.2.9)

Updates `langchain-core` from 1.4.8 to 1.4.9
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.4.8...langchain-core==1.4.9)

Updates `langchain-openai` from 1.3.3 to 1.3.5
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-openai==1.3.3...langchain-openai==1.3.5)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

Updates `gitpython` from 3.1.50 to 3.1.51
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.50...3.1.51)

Updates `langsmith` from 0.9.5 to 0.10.3
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](langchain-ai/langsmith-sdk@v0.9.5...v0.10.3)

---
updated-dependencies:
- dependency-name: langgraph
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-core
  dependency-version: 1.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langchain-openai
  dependency-version: 1.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: gitpython
  dependency-version: 3.1.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: langsmith
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 14, 2026

@pdettori pdettori left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low-risk grouped Dependabot update (5 patch bumps + langsmith 0.x minor). All 11 CI checks green including test and test-startup.

@pdettori pdettori merged commit b37269f into main Jul 15, 2026
11 checks passed
@github-project-automation github-project-automation Bot moved this from New/ToDo to Done in Kagenti Issue Prioritization Jul 15, 2026
@pdettori pdettori deleted the dependabot/uv/a2a/weather_service/minor-and-patch-89625e22de branch July 15, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants