build(deps): bump langgraph from 1.0.7 to 1.0.10rc1#218
build(deps): bump langgraph from 1.0.7 to 1.0.10rc1#218dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [langgraph](https://github.com/langchain-ai/langgraph) from 1.0.7 to 1.0.10rc1. - [Release notes](https://github.com/langchain-ai/langgraph/releases) - [Commits](langchain-ai/langgraph@1.0.7...1.0.10rc1) --- updated-dependencies: - dependency-name: langgraph dependency-version: 1.0.10rc1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
🛡️ Jit Security Scan Results
✅ No security findings were detected in this PR
Security scan by Jit
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
| sdist = { url = "https://files.pythonhosted.org/packages/59/33/34c8ab47938ac2ac6df1d2696e28b6000e98c2a783b89655fe2261b7f93b/langgraph-1.0.10rc1.tar.gz", hash = "sha256:4042dc1f33297ccbd593bddc5a4e77dc7e0f37c7ac19d48551c53a22287bacaa", size = 511667, upload-time = "2026-02-26T20:13:38.38Z" } | ||
| wheels = [ | ||
| { url = "https://files.pythonhosted.org/packages/7e/0e/fe80144e3e4048e5d19ccdb91ac547c1a7dc3da8dbd1443e210048194c14/langgraph-1.0.7-py3-none-any.whl", hash = "sha256:9d68e8f8dd8f3de2fec45f9a06de05766d9b075b78fb03171779893b7a52c4d2", size = 157353, upload-time = "2026-01-22T16:57:45.997Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/df/61/b6e7fd50c70116369874d681e3aa14bf32adbdde6c05014e5260c081452f/langgraph-1.0.10rc1-py3-none-any.whl", hash = "sha256:10750c035cc48b6809a4657ad0c9fd63fb6ee47dd2f1f2a57adb940381d096e5", size = 160950, upload-time = "2026-02-26T20:13:37.223Z" }, |
There was a problem hiding this comment.
Lock file pins pre-release RC version of langgraph
Medium Severity
The langgraph dependency is being pinned to 1.0.10rc1, a release candidate (pre-release) version. RC versions haven't completed full release testing and may contain regressions or breaking changes before the stable 1.0.10 release. While this appears to be a Dependabot security fix PR, pinning to an RC introduces potential instability. It would be safer to wait for the stable 1.0.10 release or stay on 1.0.9 if a stable version with the security fix is available.
Bumps langgraph from 1.0.7 to 1.0.10rc1.
Release notes
Sourced from langgraph's releases.
... (truncated)
Commits
a04ec5drelease: Candidate (#6947)50df7d4Merge commit from forkc4a4a46chore: add tests to confirm expected subgraph persistence behavior (#6943)f178eb8fix(langgraph): correct ParentCommand bubbling when checkpoint_ns includes nu...48167d7chore(deps): bump the all-dependencies group in /libs/cli with 2 updates (#6920)806878achore(deps): bump the all-dependencies group in /libs/checkpoint-postgres wit...8087e6adocs(sdk-py): update auth docstrings to default-deny pattern (#6933)8fbdb14release(sdk-py): 0.3.9 (#6932)5093802chore(deps): bump the all-dependencies group in /libs/checkpoint with 2 updat...b89ef60feat(sdk-py): add extract parameter to threads.search() (#6880)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Upgrades a core runtime dependency (
langgraph) to a release-candidate version, which may introduce behavior changes or instability compared to stable releases. Changes are limited to the lockfile but can affect production behavior at runtime.Overview
Bumps the pinned
langgraphdependency inuv.lockfrom1.0.7to1.0.10rc1(updating the recorded sdist/wheel artifacts accordingly) and updateslanggraph-prebuiltfrom1.0.7to1.0.8.Also removes the
greenletCP312manylinuxs390xwheel entry from the lockfile.Written by Cursor Bugbot for commit 0fddf19. This will update automatically on new commits. Configure here.