Skip to content

langchain

vlangchain-core==1.4.0 scope: langchain-core Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents ai ai-agents anthropic chatgpt deepagents
+11 more
enterprise gemini generative-ai langchain langgraph llm multiagent openai pydantic python typescript

ReleasePort's take

Moderate signal
editorial:auto 13d

The BaseMemory module is removed from langchain-core and now lives in langchain-classic; dependent code must migrate.

Why it matters: Patch to langchain‑core 1.4.0 immediately if your application uses BaseMemory, then update imports to langchain‑classic before the next deployment cycle.

Summary

AI summary

Delete BaseMemory, move it to langchain-classic, requiring migration.

Changes in this release

Security Medium

Upgrades pygments to >=2.20.0 for CVE-2026-4539

Upgrades pygments to >=2.20.0 for CVE-2026-4539

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Hardens load() function against untrusted manifests

Hardens load() function against untrusted manifests

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Restricts jinja2 and mustache template functionality

Restricts jinja2 and mustache template functionality

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Validates paths in prompt.save and load_prompt methods

Validates paths in prompt.save and load_prompt methods

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Hardens anti-SSRF protections in core utilities

Hardens anti-SSRF protections in core utilities

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Restores cloud metadata IPs and link-local range in SSRF

Restores cloud metadata IPs and link-local range in SSRF

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Applies secrets_map to plain string values in load()

Applies secrets_map to plain string values in load()

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Hardens private SSRF utilities and policies

Hardens private SSRF utilities and policies

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Hardens check for txt files in deprecated prompt functions

Hardens check for txt files in deprecated prompt functions

Source: llm_adapter@2026-05-21

Confidence: high

Security Medium

Sanitizes URLs when counting tokens in images

Sanitizes URLs when counting tokens in images

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

Deletes BaseMemory module, moved to langchain-classic

Deletes BaseMemory module, moved to langchain-classic

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

Deletes pydantic_v1 module entirely from codebase

Deletes pydantic_v1 module entirely from codebase

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

Deletes get_relevant_documents function from API

Deletes get_relevant_documents function from API

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

Deletes function_calling.py utils marked for removal

Deletes function_calling.py utils marked for removal

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

Deletes schema items marked for removal in schemas.py

Deletes schema items marked for removal in schemas.py

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Adds content-block-centric streaming v2 implementation

Adds content-block-centric streaming v2 implementation

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Adds langchain-openrouter provider package

Adds langchain-openrouter provider package

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Adds multimodal support to count_tokens_approximately

Adds multimodal support to count_tokens_approximately

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Adds ContextOverflowError exception for Anthropic/OpenAI

Adds ContextOverflowError exception for Anthropic/OpenAI

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Adds ChatAnthropicBedrock wrapper for Bedrock models

Adds ChatAnthropicBedrock wrapper for Bedrock models

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Counts tokens from tool schemas in approximate counting

Counts tokens from tool schemas in approximate counting

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Uses uuid7 for run IDs instead of previous format

Uses uuid7 for run IDs instead of previous format

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Supports Python 3.14 compatibility with get_type_hints

Supports Python 3.14 compatibility with get_type_hints

Source: llm_adapter@2026-05-21

Confidence: high

Performance Medium

Reduces streaming metadata for performance improvement

Reduces streaming metadata for performance improvement

Source: llm_adapter@2026-05-21

Confidence: high

Deprecation Medium

Deprecates prompt.save and load_prompt methods

Deprecates prompt.save and load_prompt methods

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Uses reference counting for run trees to support GC

Uses reference counting for run trees to support GC

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Fixes Runnable parallel schema with TypedDict inputs

Fixes Runnable parallel schema with TypedDict inputs

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Fixes merge_lists incorrectly merging parallel tool calls

Fixes merge_lists incorrectly merging parallel tool calls

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Preserves structured inputs on tool runs in tracers

Preserves structured inputs on tool runs in tracers

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Handles content blocks without type in OpenAI responses

Handles content blocks without type in OpenAI responses

Source: llm_adapter@2026-05-21

Confidence: high

Full changelog

Changes since langchain-core==0.3.86

chore(infra): merge v1.4 into master (#37350)
chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/core (#37329)
fix(core): avoid eager pydantic.v1 import in @deprecated (#37308)
chore: bump mistune from 3.1.4 to 3.2.1 in /libs/core (#37237)
chore: bump jupyter-server from 2.17.0 to 2.18.0 in /libs/core (#37204)
release(core): 1.3.3 (#37198)
fix(core): set deprecation since to 1.3.3 to match release (#37200)
fix(core, langchain): harden load() against untrusted manifests (#37197)
chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (#37109)
chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (#37129)
fix(core): preserve structured inputs on tool runs in tracers (#37108)
release(perplexity): 1.2.0 (#37091)
chore(docs): update x handle references (#37081)
fix(core): make removal optional in warn_deprecated (#37056)
fix(core): validate batch_size in _batch and _abatch to prevent infinite loop (#36663)
chore(core): mark stream_v2/astream_v2 as beta (#36992)
release(core): 1.3.2 (#36990)
feat(core): add content-block-centric streaming (v2) (#36834)
release(core): 1.3.1 (#36972)
feat(core): allow _format_output to pass through list of ToolOutputMixin instances (#36963)
chore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (#36923)
feat(core): Update inheritance behavior for tracer metadata for special keys (#36900)
chore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (#36813)
release(core): release 1.3.0 (#36851)
release(core): 1.3.0a3 (#36829)
chore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (#36828)
feat(core): Add chat model and LLM invocation params to traceable metadata (#36771)
fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#36816)
chore(deps): bump pytest to 9.0.3 (#36801)
chore(core): harden private SSRF utilities (#36768)
fix(openai): handle content blocks without type key in responses api conversion (#36725)
chore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (#36719)
release(core): 1.3.0.a2 (#36698)
fix(core): Use reference counting for storing inherited run trees to support garbage collection (#36660)
docs(core): nit (#36685)
release(core): 1.3.0a1 (#36656)
chore(core): reduce streaming metadata / perf (#36588)
release(core): release 1.2.28 (#36614)
fix(core): add more sanitization to templates (#36612)
release(core): 1.2.27 (#36586)
fix(core): handle symlinks in deprecated prompt save path (#36585)
chore: add comment explaining pygments>=2.20.0 (#36570)
release(core): 1.2.26 (#36511)
fix(core): add init validator and serialization mappings for Bedrock models (#34510)
feat(core): add ChatBaseten to serializable mapping (#36510)
chore(core): drop gpt-3.5-turbo from docstrings (#36497)
fix(core): correct parameter names in filter_messages docstring example (#36462)
release(core): 1.2.25 (#36473)
fix(core): harden check for txt files in deprecated prompt loading functions (#36471)
fix(core): fixed typos in the documentation (#36459)
release(core): 1.2.24 (#36434)
feat(core): impute placeholder filenames for OpenAI file inputs (#36433)
chore: pygments>=2.20.0 across all packages (CVE-2026-4539) (#36385)
fix(core): add "computer" to _WellKnownOpenAITools (#36261)
release(core): 1.2.23 (#36323)
revert: Revert "fix(core): trace invocation params in metadata" (#36322)
chore: bump requests from 2.32.5 to 2.33.0 in /libs/core (#36243)
release(core): 1.2.22 (#36201)
fix(core): validate paths in prompt.save and load_prompt, deprecate methods (#36200)
release(core): 1.2.21 (#36179)
fix(core,model-profiles): add missing ModelProfile fields, warn on schema drift (#36129)
chore(core): remove stale blockbuster allowlist for deleted context module (#36168)
ci: suppress pytest streaming output in CI (#36092)
release(core): 1.2.20 (#36085)
fix(core): trace invocation params in metadata (#36080)
feat: Add LangSmith integration metadata to create_agent and init_chat_model (#35810)
feat(core): harden anti-ssrf (#35960)
ci: avoid unnecessary dep installs in lint targets (#36046)
docs(core): document base_url in mermaid api (#35961)
chore: bump orjson from 3.11.5 to 3.11.6 in /libs/core (#35805)
chore: housekeeping (#35850)
release(core): 1.2.19 (#35832)
chore(core): move BaseCrossEncoder to langchain-core (#35809)
chore: bump tornado from 6.5.2 to 6.5.5 in /libs/core (#35775)
release(core): 1.2.18 (#35704)
fix(core): fix double backticks in deprecation docstring for alternative_import (#35658)
fix(core): preserve default_factory when generating tool call schema (#35550)
feat(openai): support tool search (#35582)
chore: bump the minor-and-patch group across 3 directories with 7 updates (#35605)
release(core): 1.2.17 (#35527)
fix(core): extract usage metadata from serialized tracer message outputs (#35526)
chore: bump the langchain-deps group across 3 directories with 7 updates (#35513)
chore: bump the langchain-deps group across 3 directories with 14 updates (#35441)
release(core): 1.2.16 (#35439)
fix(core): treat empty tool chunk ids as missing in merge (#35414)
fix(core): improve error message for non-JSON-serializable tool schemas (#34376)
fix(core): improve typing/docs for on_chat_model_start to clarify required positional args (#35324)
perf(core): defer specific langsmith imports to reduce import time (#35298)
revert: add ChatAnthropicBedrockWrapper (#35371)
release(core): 1.2.15 (#35367)
fix(anthropic): replace retired model IDs in tests and docstrings (#35365)
feat(anthropic): add ChatAnthropicBedrock wrapper (#35091)
style: fix some ruff noqa (#35321)
release(core): 1.2.14 (#35328)
chore(core): remove langserve from sys info util, add deepagents (#35325)
fix(core): fix merge_lists incorrectly merging parallel tool calls (#35281)
fix(core): accept int temperature in _get_ls_params for LangSmith tracing (#35302)
revert: accept integer temperature values in _get_ls_params (#35319)
fix(core): accept integer temperature values in _get_ls_params (#35317)
docs(core): update load note to be precise (#35309)
fix(core): prevent recursion error when args_schema is dict (#35260)
fix(core): preserve index and timestamp fields when merging (#34731)
docs(core): add security warnings and best practices for deserialization (#35282)
docs: fix docstring inaccuracies and update outdated LangSmith URLs (#35283)
fix(core): correct misleading jinja2 sandboxing comment (#35183)
chore: bump the langchain-deps group across 3 directories with 8 updates (#35257)
release(core): 1.2.13 (#35230)
docs(core): expanded get_lc_namespace docstring (#35229)
feat(openrouter): add langchain-openrouter provider package (#35211)
style: bump ruff version to 0.15 (#35042)
release(core): 1.2.12 (#35192)
fix(core): fix setting ChatGeneration.text (#35191)
release(core): 1.2.11 (#35144)
fix(openai): sanitize urls when counting tokens in images (#35143)
chore(core): clean up docstring mismatch and redundant logic in langchain-core (#35064)
fix(core): replace bare except with Exception in tracer (#35138)
release(core): 1.2.10 (#35136)
chore(deps): bump the langchain-deps group across 3 directories with 40 updates (#35129)
chore(deps): bump the langchain-deps group across 3 directories with 11 updates (#35121)
feat(core): add ContextOverflowError, raise in anthropic and openai (#35099)
feat(model-profiles): add text_inputs and text_outputs (#35084)
feat(core): count tokens from tool schemas in count_tokens_approximately (#35098)
docs(core): add missing name docstring for RunnableSerializable (#35088)
release(core): 1.2.9 (#35025)
fix(core): adjust cap when scaling approximate token counts (#35017)
revert: precompile hex color regex pattern at module level (#35016)
chore: add make type target (#35015)
revert: "chore: add typing target in Makefile" (#35013)
chore: add typing target in Makefile (#35012)
fix(core): apply cap when scaling approximate token counts (#35005)
feat(core): allow scaling by reported usage when counting tokens approximately (#34996)
test(core): increase delta_time for flaky test (#34982)
chore: enrich pyproject.toml files (#34980)
release(core): 1.2.8 (#34975)
docs(core): add examples for pretty_repr, pretty_print (#34968)
docs(core): use proper admonition for get_buffer_string (#34967)
docs: add usage examples to core classes (#34841)
chore(core): fix docstring format (#34966)
chore(deps): bump the uv group across 20 directories with 3 updates (#34941)
docs: add example to create_message function docstring (#34851)
docs(core): clarify @tool decorator argument and return type requirements (#34860)
fix(core): fix nested mustache variable extraction and update docs (#34872)
fix(core): allow base model annotations for empty model (#34932)
chore: upgrade urllib3 to 2.6.3 (#34940)
fix(core): prevent crash in ParrotFakeChatModel when messages list is empty (#34943)
fix(core): google docstring parsing with no arguments/reserved arguments (#34861)
test(core): add tests for approximate token counting with multimodal messages (#34898)
fix(core): replace Iterable with Iterator for block iteration (#34934)
fix(core): yield_blobs returns Iterator (#34935)
docs: Fix typo in Runnable description of async variants (#34905)
fix(core): raise outputparserexception for unknown tools (#34923)
docs(core): nit (#34914)
chore(core): nits (#34897)
feat(core): add multimodal support to count_tokens_approximately (#34883)
fix(core): fix typo 'use a a' -> 'use as a' in check_version.py (#34878)
style(core): lint (#34862)
feat(core): add XML format option for get_buffer_string (#34802)
chore(core): relax packaging constraints (#34832)
chore(deps-dev): bump setuptools from 67.8.0 to 78.1.1 in /libs/core in the uv group across 1 directory (#34825)
chore(core, langchain): add version consistency check pre-commit hooks (#34782)
docs(core): enhance docstring for RunnableConfig for clarity on total=False (#34756)
docs(core): clean up callbacks param descriptions (#34738)
fix(core): correctly guard against non-text-block types (#34729)
chore: update twitter URLs (#34736)
refactor(core): generalize comma_list utility to support any Iterable (#34714)
fix(core): add explicit tags parameter to sync LLMManagerMixin methods (#34722)
docs(core): enhance docstrings for ToolCall and ToolCallChunk (#34719)
fix(core): add tool_call_id to on_tool_error event data (#33731)
fix(core): improve error message for missing title in JSON schema functions (#34683)
fix(core): make yield_keys prefix keyword-only to match BaseStore (#34659)
chore(core): bump lock (#34695)
chore(core): improve types for RunnableLambda (#34539)
chore(core): improve types for StreamingRunnable (#34540)
style(core): fix some noqa escapes (#34675)
style: bump ruff version to 0.14.11 (#34674)
fix: remove relative imports (#34680)
release: langchain-core 1.2.7 (#34678)
fix: don't trace injected args only found in signature (#34670)
feat(core): add more file extensions to ignore in HTML link extraction (#34552)
refactor(core): improve docstrings for HTML link extraction utilities (#34550)
test(core): add edge case for empty examples in LengthBasedExampleSelector (#34641)
fix(core): fix strict schema generation for functions with optional args (#34599)
feat(core): support custom message separator in get_buffer_string() (#34569)
refactor(core): add warning for fallback GPT-2 tokenizer usage (#34621)
fix(core,langchain): use get_buffer_string for message summarization (#34607)
test(core): add tests for formatting utils and merge functions (#34511)
fix(core): strip message IDs from cache keys using model_copy (#33915)
fix(core): exclude injected args from tool schema (#34582)
refactor(core): select chunk_id via ranking and remove extra allocation (#34588)
release(core): 1.2.6 (#34586)
chore(core): Update LangChainTracer to use Pydantic v2 methods (#34541)
docs(core): add docstrings to internal helper functions (#34525)
docs(core): refresh content.py docstrings (#34546)
chore(deps): bump mypy to v1.19 and ruff to v1.14 (#34521)
refactor(core): fix some missing generic types (#31658)
style(core): add ruff RUF012 rule (#34492)
fix(core): support (message class, template) tuples in ChatPromptTemplate.from_messages (#33989)
test(core): add regression test for list-index $ref resolution (#34097)
fix(core): fix callback manager merge mixing handlers (#32028) (#33617)
style: add ruff ISC001 rule (#34493)
style(core): fix mypy no-any-return violations (#34204)
docs(core): image url docstring enhancement (#34488)
test(core): URL-encode bgColor parameter in mermaid.ink API calls (#34466)
style(core): fix some noqa: ARG rules (#34437)
fix(core): URL-encode bgColor in mermaid API calls (#34461)
perf(core): move origin type map to module level in function_calling.py (#34481)
style(core): add ruff rules TC (#34476)
perf(core): precompile hex color regex pattern at module level (#34480)
docs(core): update to indicate betas (#34457)
release(core): 1.2.5 (#34456)
fix(core): serialization patch (#34455)
fix(core): RunnablePick method return types (#34208)
fix(core): preserve Field(description=...) in @tool decorator (#34354)
fix(core): populate default args from tool's args_schema (#34399)
fix(core): use tool_calls instead of deprecated function_call in get_buffer_string (#34355)
feat(core): add PEP 702 __deprecated__ attribute support to @deprecated (#34257)
fix(core): ensure tool_call_count is never null (#34431)
feat(core): automatically count and store meta for tool call count (#33756)
feat(core): add 'approximate' alias in place of count_tokens_approximately (#33045)
chore(core): fix some ruff preview rules (#34425)
release(core): 1.2.4 (#34429)
feat(core): add usage_metadata to metadata in LangChainTracer (#34414)
fix(core): defer persisting traces for iterator inputs (#34416)
chore(core): fix some docstrings (#34426)
release(core): 1.2.3 (#34421)
fix(core): allow unknown blocks in convert_to_openai_messages (#34420)
feat(infra): add CI check for out of date lockfiles (#34397)
chore(core): bump lockfile (#34392)
release(core): 1.2.2 (#34391)
fix(core): use get_type_hints for Python 3.14 TypedDict compatibility (#34390)
release(core): 1.2.1 (#34370)
fix(core): handle None arguments in parse_tool_call (#34242)
chore(core): fix some types related to ToolCallChunk (#34283)
release(core): 1.2 (#34319)
style(core): docs nit (#34312)
fix(core): widen openai tool/function conversion input type to Mapping (#34304)
chore(core): add admonitions around use of load (#34285)
feat(core,anthropic): extras on BaseTool (#34120)
release: langchain-core 1.1.3 (#34266)
fix(core): undo jinja2 restrictions (#34072)
fix: remove partial usage for retriever func + afunc (#34265)
release(core): 1.1.2 (#34253)
fix(core): pass tool_call_id to on_tool_start callback (#34235)
chore(core): improve typing of messages utils functions (#34225)
fix(core): prevent async task garbage collection (RUF006) (#34238)
chore(core): use anext and deprecate py_anext (#34211)
feat(core): support google maps grounding in genai block translator (#34244)
docs(core,groq,openai): nits for ref docs (#34243)
docs(core): improve style for refs (#34227)
docs(core): update StrOutputParser docstring (#34213)
release: langchain-core 1.1.1 (#34212)
feat: Use uuid7 for run ids (#34172)
fix: tool call id bug introduced w/ runtime injection (#34185)
chore: update test to be compatible with mem-optimized runtree (#34176)
docs(core): update docstrings in RunnableConfig, dereference_refs (#34131)
docs(anthropic,core,langchain): updates (#34106)
style(core,langchain,qdrant): fix some docstrings for refs (#34105)
fix(core): handle missing StructuredPrompt schema (#34096)
fix(core): ensure_ascii=False in PydanticOutputParser exception formatting (#34006)
fix(infra,core): nits (#34079)
style(core,langchain-classic,openai): fix griffe warnings (#34074)
chore(docs): fix a few refs syntax errors (#34044)
release(core): 1.1.0 (#34063)
feat(model-profiles): distribute data across packages (#34024)
release(core): 1.0.7 (#34036)
fix(core): fix validation for input variables in f-string templates, restrict functionality supported by jinja2, mustache templates (#34035)
release: langchain-core 1.0.6 (#34018)
chore: Support tool runtime injection when custom args schema is prov… (#33999)
feat(core): add proxy support for mermaid png rendering (#32400)
release(core): 1.0.5 (#33973)
fix(core): don't mask exceptions (#33959)
docs(core): add clarity to base token counting methods (#33958)
chore(core,infra): nits (#33954)
chore(core): fix some ruff TC rules (#33929)
chore: update README.md files (#33919)
test(core): add comprehensive tests for groq block translator (#33906)
revert(core): "applied secrets_map in load to plain string values" (#33913)
fix(core): applied secrets_map in load to plain string values (#33678)
release(core): 1.0.4 (#33886)
feat(core): support draw subgraph using pygraphviz (#32966)
fix(core): Fix tool name check in name_dict for PydanticToolsParser (#33479)
fix(core): Filter empty content blocks from formatted prompts (#32519)
fix(core): context preservation in shielded async callbacks (#32163)
fix(core): RunnablePick may not return a dict if keys is a string (#31321)
fix(core): fix Runnable parallel schema being empty when children runnable input schemas use TypedDict (#28196)
docs: fix typos in libs/core/langchain_core/utils/function_calling.py (#33873)
docs: fix typos in libs/core/tests/unit_tests/utils/test_strings.py (#33875)
docs: fix typos in libs/core/tests/unit_tests/indexing/test_hashed_document.py (#33874)
docs: fix typos in libs/core/tests/unit_tests/test_tools.py (#33876)
docs: fix typos in some files (#33867)
style: some cleanup (#33857)
chore: attribute package change versions (#33854)
fix(core): handle missing dependency version information (#33844)
chore: correct langchain-community references (#33827)
chore(core): add ruff rule PLR2004 (#33706)
chore(core): clean pyproject formatting (#33821)
docs(model-profiles): fix typo (#33820)
style: refs pass (#33813)
fix(core): add no colors check (#33780)
release(core): 1.0.3 (#33768)
style: misc refs work (#33771)
docs(core): improve tools module docstrings (#33755)
feat(core): mint langchain-model-profiles and add profile property to BaseChatModel (#33728)
chore: use model IDs, latest anthropic models (#33747)
release: core 1.0.2 and langchain 1.0.3 (#33736)
fix: filter out injected args from tracing (#33729)
style: more refs fixes (#33730)
fix(core): improve JSON get_format_instructions using Opik Agent Optimizer (#33718)
style(core): more cleanup all around (#33711)
style: more refs work (#33707)
fix(core): translate Google GenAI text blocks to v1 (#33699)
feat(langchain): export UsageMetadata (#33692)
fix: links (#33691)
fix(core): fix PydanticOutputParser's get_format_instructions for v1 models (#32479)
refactor(core): Minor refactor for code readability (#33674)
fix(infra): add emacs backup files to gitignore (#33675)
fix: update some links (#33686)
style(core): more refs work (#33664)
fix(core): make handling of schemas more defensive (#33660)
release(core): 1.0.1 (#33639)
feat(core): automatic set required to include all properties in strict mode (#32930)
docs(core): Updated docs for mustache_template_vars (#33481)
style: even more refs work (#33619)
style: more refs work (#33616)
style: more refs polishing (#33601)
ci(infra): test CodSpeed with Python 3.13 (#33599)
style(anthropic): use aliases for model names (#33590)
chore: update pyproject.toml url entries (#33587)
release(core): 1.0.0 (#33562)
fix(core): support for Python 3.14 (#33461)
docs: more fixes for refs (#33554)
release: joint rcs for core + langchain (#33549)
chore(langchain): allow injection of ToolRuntime and generic ToolRuntime[ContextT, StateT] (#33546)
chore: more sweeping (#33533)
release(core): 1.0.0rc2 (#33530)
docs(anthropic): update extended thinking docs and fix urls (#33525)
feat(core): support vertexai standard content (#33521)
style: more sweeping refs work (#33513)
style: more work for refs (#33508)
feat(core): include original block type in server tool results for google-genai (#33502)
release(core): 1.0.0rc1 (#33497)
chore(core): delete BaseMemory, move to langchain-classic (#33373)
docs: update package READMEs (#33488)
fix(core): propagate extras when aggregating tool calls in v1 content (#33494)
chore(core): delete items marked for removal in schemas.py (#33375)
fix(docs): Fix several typos and grammar (#33487)
chore(core): delete function_calling.py utils marked for removal (#33376)
chore(core): delete pydantic_v1/ (#33374)
feat(groq): support built-in tools in message content (#33459)
chore(core): delete get_relevant_documents (#33378)
style: llm -> model (#33423)
chore(langchain): remove arg types from docstrings (#33413)
style: fix tables, capitalization (#33417)
fix(core): handle parent/child mustache vars (#33345)
style: remove Defaults to None (#33404)
style: .. code-block:: admonition translations (#33400)
style: address Sphinx double-backtick snippet syntax (#33389)
chore(core): remove arg types from docstrings (#33388)
chore: update Sphinx links to markdown (#33386)
fix(core): override streaming callback if streaming attribute is set (#33351)
refactor(core): clean up sys_info.py (#33372)
style: remove more Optional syntax (#33371)
chore: drop UP045 (#33362)
refactor(core): remove keep-runtime-typing from pyproject.toml following dropping 3.9 (#33360)
style: monorepo pass for refs (#33359)
fix(core): don't print package if no version found (#33347)
chore: enrich pyproject.toml files with links to new references, others (#33343)
release(core): 1.0.0a8 (#33341)
fix(core): add back add_user_message and add_ai_message (#33340)
release(core): 1.0.0a7 (#33309)
fix(core,openai,anthropic): delegate to core implementation on invoke when streaming=True (#33308)
fix(core): fix string content when streaming output_version="v1" (#33261)
chore(infra): pdm -> hatchling (#33289)
style(core): drop python 39 linting target for 3.10 (#33286)
chore(core): docstring nits (#33285)
chore(core,langchain,langchain_v1)!: remove globals from langchain-v1, update globals in langchain-classic, langchain-core (#33251)
feat(core): add optional include_id param to convert_to_openai_messages function (#33242)
chore: delete deprecated items (#33192)
docs: v1 docs updates (#33173)
release: v1.0.0 (#32567)

Breaking Changes

  • Removed `BaseMemory` class from langchain-core; moved to langchain-classic.

Security Fixes

  • CVE-2026-4539

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track langchain

Get notified when new releases ship.

Sign up free

About langchain

The agent engineering platform

All releases →

Related context

Related CVEs

Featured in

Beta — feedback welcome: [email protected]