Skip to content

Bump the minor-and-patch group with 10 updates - #336

Merged
John Kennedy (jkennedyvz) merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-ec423c1b11
Oct 28, 2026
Merged

Bump the minor-and-patch group with 10 updates#336
John Kennedy (jkennedyvz) merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-ec423c1b11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 10 updates:

Package From To
@langchain/core 1.2.18 1.3.0
@langchain/langgraph 1.5.0 1.5.2
@langchain/langgraph-sdk 1.12.4 1.12.7
framer-motion 14.3.0 14.6.0
lucide-react 1.57.0 1.61.0
@types/lodash 4.17.26 4.17.27
dotenv 18.0.8 18.0.9
eslint 10.12.0 10.13.0
postcss 8.5.30 8.5.31
typescript-eslint 8.71.2 8.72.0

Updates @langchain/core from 1.2.18 to 1.3.0

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.3.0

Minor Changes

  • #11986 2caf64d Thanks @​richardscarrott! - feat: stream tool-call args as tool-call-delta slices

    Tool-call and server-tool-call args now stream as tool-call-delta events, which carry only the new slice of the args, instead of block-delta snapshots of the args so far. A large tool call now costs about the same bytes on the wire as the same length of text.

    • This covers the compat bridge (any model that only implements _streamResponseChunks), the OpenAI-compatible converter (OpenAI Completions, Groq, Mistral, IBM, OpenRouter, Perplexity, DeepSeek, Fireworks, Together AI and xAI Completions), OpenAI and xAI Responses, Anthropic (client and server tool calls) and Bedrock Converse. Google and Ollama still send one complete snapshot per call.
    • A tool call's id, name and index go on content-block-start, which carries no args. An id or name that arrives later reaches consumers on content-block-finish.
    • If you read raw events and their block-delta fields.args mid-stream, or write agent stream transformers that do, read tool-call-delta instead. await stream, .toolCalls and the assembled message are unchanged.
    • Upgrade your clients first. Older clients mishandle tool-call-delta. You need @langchain/langgraph-sdk 1.12.6 or later; @langchain/react, @langchain/vue, @langchain/svelte or @langchain/angular 1.2.6 or later; and langchain-core 1.6.13 or later for Python clients.
    • To hold back, pin @langchain/core below 1.3.0. That also keeps you on @langchain/openai, @langchain/anthropic, @langchain/aws and @langchain/xai versions that send snapshots.

@​langchain/core@​1.2.20

Patch Changes

  • #11922 d71c542 Thanks @​richardscarrott! - feat(core): add midConversationSystemMessages and midConversationTools to ModelProfile. They say whether a chat model sends a system message after the first turn in place, and whether it can add a tool through a message rather than the request's tool list. Either way the prompt prefix before it stays unchanged.

@​langchain/core@​1.2.19

Patch Changes

  • #11982 5af4684 Thanks @​richardscarrott! - feat(core): read tool-call-delta in ChatModelStream

    • ChatModelStream appends tool-call-delta slices to a tool call's args, and still replaces them on block-delta
    • It ignores delta types it doesn't recognize instead of throwing Unknown delta type
Commits
  • 38eb4d8 chore: version packages (#12018)
  • dae3b1f chore(core): fill in client versions in tool-call-delta changeset (#12019)
  • 2caf64d feat(core,openai,anthropic,aws,xai): stream tool-call args as `tool-call-delt...
  • 8a008ea test(core): accept either order of a chunk's stream events in chat model chai...
  • f65acc3 chore(deps): restore missing @modelcontextprotocol/core@2.3.0 lockfile entr...
  • 6a0ab38 chore: version packages (#12008)
  • 654c7c6 chore(deps-dev): bump @​modelcontextprotocol/server from 2.3.0 to 2.3.1 (#12005)
  • f096a32 fix(langchain): deliver final answers after todo updates (#11989)
  • c690992 fix: update Node.js to October 2026 security release (#12007)
  • 0c5e7bc fix(langchain): avoid full-state copies in parallel tool tasks (#11990)
  • Additional commits viewable in compare view

Updates @langchain/langgraph from 1.5.0 to 1.5.2

Release notes

Sourced from @​langchain/langgraph's releases.

@​langchain/langgraph-api@​1.5.2

Patch Changes

  • Updated dependencies []:
    • @​langchain/langgraph-ui@​1.5.2

@​langchain/langgraph-cli@​1.5.2

Patch Changes

@​langchain/langgraph-ui@​1.5.2

No changes in this release.

@​langchain/langgraph@​1.5.2

Patch Changes

  • #3022 a17f609 Thanks @​richardscarrott! - Depend on @langchain/protocol 0.0.20, the version @langchain/langgraph-sdk uses, so installs resolve a single copy and the protocol event types stay compatible.
  • Updated dependencies [6e84570, a17f609]:
    • @​langchain/langgraph-checkpoint@​1.2.1
    • @​langchain/langgraph-sdk@​1.12.6

@​langchain/langgraph-api@​1.5.2-dev.0

Patch Changes

  • Updated dependencies []:
    • @​langchain/langgraph-ui@​1.5.2-dev.0

@​langchain/langgraph-cli@​1.5.2-dev.0

Patch Changes

@​langchain/langgraph-ui@​1.5.2-dev.0

No changes in this release.

@​langchain/langgraph-api@​1.5.1

Patch Changes

  • #2883 545c7d1 Thanks @​casparb! - Fix langgraph dev --no-reload with the default TypeScript loader. Pass the tsx --clear-screen=false option only in watch mode so Node can start the server when reload is disabled.
  • Updated dependencies []:
    • @​langchain/langgraph-ui@​1.5.1

@​langchain/langgraph-cli@​1.5.1

Patch Changes

... (truncated)

Changelog

Sourced from @​langchain/langgraph's changelog.

1.5.2

Patch Changes

  • #3022 a17f609 Thanks @​richardscarrott! - Depend on @langchain/protocol 0.0.20, the version @langchain/langgraph-sdk uses, so installs resolve a single copy and the protocol event types stay compatible.
  • Updated dependencies [6e84570, a17f609]:
    • @​langchain/langgraph-checkpoint@​1.2.1
    • @​langchain/langgraph-sdk@​1.12.6

1.5.1

Patch Changes

  • #3017 61b0049 Thanks @​eliornl! - A field that changes from a DeltaChannel to a plain reducer, for example to MessagesAnnotation, keeps its value on threads written under the DeltaChannel: reads rebuild it from the stored writes instead of returning the empty default, and the next run adds to it instead of replacing it.

  • #3027 af7e421 Thanks @​eliornl! - With durability: "exit", resuming parallel interrupts one at a time no longer applies a finished task's output twice: the save at exit keeps only the writes made during that run, instead of storing the ones loaded with the checkpoint again under new indexes.

  • #2986 53cc627 Thanks @​byhow! - When one answer in a multi-answer resume fails its interrupt's responseSchema, the other tasks in the step now finish before the ZodError is thrown, instead of being aborted. A task aborted after its side effects kept its answer and ran again on the next resume. The error is unchanged, and the new isInvalidResume(error) tells it apart from other errors, as is_invalid_resume does in langgraph (Python).

  • #3038 bc01023 Thanks @​eliornl! - messagesStateReducer and messagesDeltaReducer store message chunks as their non-chunk class, as Python's add_messages does. A graph run with streamMode: "messages" or streamEvents now checkpoints the same AIMessage as invoke, without a duplicate tool_call_chunks copy of every tool call, and an in-place edit to tool_calls (for example a rejected call in humanInTheLoopMiddleware) is no longer undone when the thread is reloaded.

  • #3028 ec1854a Thanks @​eliornl! - Resuming after some parallel interrupts were answered no longer reruns the nodes and task() calls that already finished, in a subgraph or when the resume is sent with the id of the thread's latest checkpoint. Finished tasks now rerun only on time travel, or on a resume at a checkpoint the thread has moved past.

  • Updated dependencies [2e1fe5b, 0acf88d, 9cc54cc, 4690a5b]:

    • @​langchain/langgraph-sdk@​1.12.5
Commits
  • 0c12d5c chore: version packages (#3059)
  • a17f609 feat(sdk): read tool-call-delta and ignore unknown delta variants (#3022)
  • cc29753 chore: version packages (#3018)
  • 53cc627 fix(langgraph): let other tasks finish when a resume value is invalid (#2986)
  • ec1854a fix(langgraph): stop a subgraph from rerunning its finished tasks on resume (...
  • af7e421 fix(langgraph): save a resumed exit run's pending writes once (#3027)
  • bc01023 fix(langgraph): store message chunks as messages in the messages reducers (#3...
  • b762123 chore(langgraph): consolidate DeltaChannel regression suites (#3019)
  • 61b0049 fix(langgraph): keep a DeltaChannel's value when its field changes to a plain...
  • See full diff in compare view

Updates @langchain/langgraph-sdk from 1.12.4 to 1.12.7

Release notes

Sourced from @​langchain/langgraph-sdk's releases.

@​langchain/langgraph-sdk@​1.12.7

Patch Changes

  • #3060 2b982b6 Thanks @​hntrl! - fix(sdk): stop resolved interrupts from coming back after a reload

    After a reload, the first submit or respond on the Agent Server brought back every interrupt the thread had already resolved, and accepting them failed with no_such_interrupt. Its HTTP commands report applied_through_seq: 0, so the SDK treated the whole replayed history as new. When a command reports 0, the SDK now finds where the command's run starts on the thread stream and treats everything before it as history.

@​langchain/langgraph-sdk@​1.12.6

Patch Changes

  • #3022 a17f609 Thanks @​richardscarrott! - Tool-call args streamed as tool-call-delta slices are appended to the tool call, so useStream, scoped useMessages, thread.messages, subgraph.messages and subagent.messages show live args whether the server sends slices or the older block-delta snapshots. block-delta still replaces the args.

    Delta variants the SDK doesn't recognise are now ignored. Before, one froze a scoped useMessages view until the run ended, left the in-flight thread.messages message unsettled, and crashed Node with an unhandled rejection from subgraph.messages or subagent.messages. MessageAssembler.consume returns undefined for such events.

    Upgrade the SDK and its bindings before your server emits tool-call-delta.

@​langchain/langgraph-sdk@​1.12.5

Patch Changes

  • #2962 2e1fe5b Thanks @​hntrl! - fix(sdk): a reply cut off mid-stream, for example by stop(), no longer lingers in useStream messages after its run ends: it is dropped as soon as the run ends, stays gone after a page refresh, and is dropped in other tabs watching the thread too. A reply that finished streaming before the run paused for input stays visible while paused and is replaced, not duplicated, when the run resumes. Streaming message handles for a cut-off message now settle with an aborted error instead of never resolving.

  • #3024 0acf88d Thanks @​eliornl! - Opening a thread with recent activity no longer replays it in useStream. Every new stream subscription receives the thread's recent events again, and the controller applied them on top of the state it had just loaded, so messages, values and toolCalls rewound to earlier turns and rebuilt themselves while old tool calls flashed through running and finished. The controller now skips events produced before the checkpoint it loaded. Scoped views, such as useMessages on a subagent, still receive the full history.

    A submit() sent right after opening a thread also no longer ends early. A replayed completion from an earlier run used to settle it, clear isLoading and fire onCompleted while the new run was still going.

  • #3023 9cc54cc Thanks @​eliornl! - messagesProjection([]), the root-namespace messages projection acquired through StreamController.registry, now fills from the root event stream. It threw a ReferenceError on every event and stayed empty. The framework hooks were not affected: useMessages returns stream.messages for the root.

  • #3031 4690a5b Thanks @​eliornl! - Stop the protocol WebSocket transport from reconnecting when the server closes the socket with 4000 plus a 4xx status (4403, 4404, 4422 and the like; 4408 and 4429 still reconnect): the event stream now ends at once with an error that carries the status. Other 4xxx closes still reconnect, with the status on the onReconnect cause. A WebSocket thread stream that fails for good now reaches ThreadStream.onError, so useStream sets error and clears isLoading, as it already did for SSE. A command whose send fails no longer leaves a response promise behind to be rejected later as an unhandled rejection.

Changelog

Sourced from @​langchain/langgraph-sdk's changelog.

1.12.7

Patch Changes

  • #3060 2b982b6 Thanks @​hntrl! - fix(sdk): stop resolved interrupts from coming back after a reload

    After a reload, the first submit or respond on the Agent Server brought back every interrupt the thread had already resolved, and accepting them failed with no_such_interrupt. Its HTTP commands report applied_through_seq: 0, so the SDK treated the whole replayed history as new. When a command reports 0, the SDK now finds where the command's run starts on the thread stream and treats everything before it as history.

1.12.6

Patch Changes

  • #3022 a17f609 Thanks @​richardscarrott! - Tool-call args streamed as tool-call-delta slices are appended to the tool call, so useStream, scoped useMessages, thread.messages, subgraph.messages and subagent.messages show live args whether the server sends slices or the older block-delta snapshots. block-delta still replaces the args.

    Delta variants the SDK doesn't recognise are now ignored. Before, one froze a scoped useMessages view until the run ended, left the in-flight thread.messages message unsettled, and crashed Node with an unhandled rejection from subgraph.messages or subagent.messages. MessageAssembler.consume returns undefined for such events.

    Upgrade the SDK and its bindings before your server emits tool-call-delta.

1.12.5

Patch Changes

  • #2962 2e1fe5b Thanks @​hntrl! - fix(sdk): a reply cut off mid-stream, for example by stop(), no longer lingers in useStream messages after its run ends: it is dropped as soon as the run ends, stays gone after a page refresh, and is dropped in other tabs watching the thread too. A reply that finished streaming before the run paused for input stays visible while paused and is replaced, not duplicated, when the run resumes. Streaming message handles for a cut-off message now settle with an aborted error instead of never resolving.

  • #3024 0acf88d Thanks @​eliornl! - Opening a thread with recent activity no longer replays it in useStream. Every new stream subscription receives the thread's recent events again, and the controller applied them on top of the state it had just loaded, so messages, values and toolCalls rewound to earlier turns and rebuilt themselves while old tool calls flashed through running and finished. The controller now skips events produced before the checkpoint it loaded. Scoped views, such as useMessages on a subagent, still receive the full history.

    A submit() sent right after opening a thread also no longer ends early. A replayed completion from an earlier run used to settle it, clear isLoading and fire onCompleted while the new run was still going.

  • #3023 9cc54cc Thanks @​eliornl! - messagesProjection([]), the root-namespace messages projection acquired through StreamController.registry, now fills from the root event stream. It threw a ReferenceError on every event and stayed empty. The framework hooks were not affected: useMessages returns stream.messages for the root.

  • #3031 4690a5b Thanks @​eliornl! - Stop the protocol WebSocket transport from reconnecting when the server closes the socket with 4000 plus a 4xx status (4403, 4404, 4422 and the like; 4408 and 4429 still reconnect): the event stream now ends at once with an error that carries the status. Other 4xxx closes still reconnect, with the status on the onReconnect cause. A WebSocket thread stream that fails for good now reaches ThreadStream.onError, so useStream sets error and clears isLoading, as it already did for SSE. A command whose send fails no longer leaves a response promise behind to be rejected later as an unhandled rejection.

Commits
  • c6675bf chore: version packages (#3092)
  • 2b982b6 fix(sdk): stop resolved interrupts from coming back after a reload (#3060)
  • 10e72bc chore(deps): bump vite, vitest, and launch-editor security fixes (#3091)
  • 0c12d5c chore: version packages (#3059)
  • a17f609 feat(sdk): read tool-call-delta and ignore unknown delta variants (#3022)
  • cc29753 chore: version packages (#3018)
  • 4690a5b fix(sdk): stop reconnecting the protocol WebSocket on a 4xx close and report ...
  • 2e1fe5b fix(sdk): drop pending messages on stop events (#2962)
  • 9cc54cc fix(sdk): fill the root-namespace messages projection (#3023)
  • 0acf88d fix(sdk): stop replayed history from rewinding a freshly opened thread (#3024)
  • See full diff in compare view

Updates framer-motion from 14.3.0 to 14.6.0

Changelog

Sourced from framer-motion's changelog.

[14.6.0] 2026-10-20

Added

  • Reorder: Grab-and-move keyboard reordering.
  • processFrame: Manually process the frameloop at t.
  • stepFrames: For tests, synchronously advance frameloop time by duration.

Fixed

  • Improved tree-shaking.
  • motion: Fix layoutId elements jumping in some situations.
  • Reorder: Make auto-scroll speed independent of refresh rate.
  • drag: Fix animations when disabling drag from within onDrag.
  • Fix shared layout animations applying an element's own scale/x/y twice.
  • Fix replaying mount animation when an element takes over a layoutId.
  • motion: Fix updating SVG styles.
  • useTransform: Improving value resolution.

Changed

  • MotionGlobalConfig.useManualTiming:

[14.5.0] 2026-10-20

Added

  • scopeMotion/useScopeMotion: Scope animations and gestures to set default transitions, specify root elements, match media, and easy cleanup.
  • Reorder: Pass moved to onReorder as second argument.

Fixed

  • drag: With direction lock, apply the move that sets the lock. Before, a fast drag released in that frame didn't move.
  • press: Improve cleanup of keyboard accessibility events.
  • Reorder: Stop double-counting window scroll during drag.
  • motion: Ensure we animate from the latest props when parent Activity is made visible.
  • useInView: Observe ref if contents change after mount.

[14.4.0] 2026-10-18

Added

  • drag: Drag gesture added to JavaScript API.

[14.3.1] 2026-10-18

Fixed

  • AnimatePresence: Fire onExitComplete after exiting children unmount.
  • AnimatePresence: popLayout children that don't accept ref are now popped when root component is <motion> element.

... (truncated)

Commits
  • 3397236 v14.6.0
  • 9c418ac Updating changelog
  • b6c08e2 Updating changelog
  • ab673fa updating changelog
  • dae190c Merge pull request #3957 from motiondivision/claude/project-thread-6xvf1o-iss...
  • 2393112 Merge branch 'main' into claude/project-thread-6xvf1o-issue-2658
  • 27e22d2 Merge pull request #3964 from motiondivision/claude/project-thread-f58pn3
  • 286e7ee Merge pull request #3967 from motiondivision/claude/project-thread-lo4wo4-iss...
  • d555095 Clarify that a callback scheduling itself behaves as before
  • 0f0b22f Merge pull request #3974 from motiondivision/claude/project-thread-f58pn3-siz...
  • Additional commits viewable in compare view

Updates lucide-react from 1.57.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

... (truncated)

Commits
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • See full diff in compare view

Updates @types/lodash from 4.17.26 to 4.17.27

Commits

Updates dotenv from 18.0.8 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)
Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Changelog

Sourced from postcss's changelog.

8.5.31

Commits

Updates typescript-eslint from 8.71.2 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group with 10 updates
67fd711 
Bumps the minor-and-patch group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.18` | `1.3.0` |
| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.5.0` | `1.5.2` |
| [@langchain/langgraph-sdk](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/sdk) | `1.12.4` | `1.12.7` |
| [framer-motion](https://github.com/motiondivision/motion) | `14.3.0` | `14.6.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.57.0` | `1.61.0` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.26` | `4.17.27` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.8` | `18.0.9` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.30` | `8.5.31` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.0` |


Updates `@langchain/core` from 1.2.18 to 1.3.0
- [Release notes](https://github.com/langchain-ai/langchainjs/releases)
- [Commits](https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.18...@langchain/core@1.3.0)

Updates `@langchain/langgraph` from 1.5.0 to 1.5.2
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.5.2/libs/langgraph-core)

Updates `@langchain/langgraph-sdk` from 1.12.4 to 1.12.7
- [Release notes](https://github.com/langchain-ai/langgraphjs/releases)
- [Changelog](https://github.com/langchain-ai/langgraphjs/blob/main/libs/sdk/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph-sdk@1.12.7/libs/sdk)

Updates `framer-motion` from 14.3.0 to 14.6.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.3.0...v14.6.0)

Updates `lucide-react` from 1.57.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `@types/lodash` from 4.17.26 to 4.17.27
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `dotenv` from 18.0.8 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.8...v18.0.9)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `postcss` from 8.5.30 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.30...8.5.31)

Updates `typescript-eslint` from 8.71.2 to 8.72.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@langchain/core"
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@langchain/langgraph"
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@langchain/langgraph-sdk"
  dependency-version: 1.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 14.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/lodash"
  dependency-version: 4.17.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
langgraph-chat Ready Ready Preview Oct 26, 2026 12:58am UTC

Request Review

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 26, 2026
@socket-security

socket-security Bot commented Oct 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​langchain/​langgraph-sdk@​1.12.4 ⏵ 1.12.773 +1100100 +197 +1100
Updatedtypescript-eslint@​8.71.2 ⏵ 8.72.01001007498100
Updated@​types/​lodash@​4.17.26 ⏵ 4.17.2710010080 +191 +4100
Updatedlucide-react@​1.57.0 ⏵ 1.61.0100 +110098 +19680
Updatedpostcss@​8.5.30 ⏵ 8.5.31100 +110082 +195100
Updated@​langchain/​langgraph@​1.5.0 ⏵ 1.5.299 +110092 +197 +1100
Updatedeslint@​10.12.0 ⏵ 10.13.097 +110010095100
Updateddotenv@​18.0.8 ⏵ 18.0.99910010095 -1100
Updated@​langchain/​core@​1.2.18 ⏵ 1.3.0100 +1100100 +197 +2100
Updatedframer-motion@​14.3.0 ⏵ 14.6.09910010098 +1100

View full report

jkennedyvz
John Kennedy (jkennedyvz) approved these changes Oct 28, 2026
View reviewed changes

@jkennedyvz John Kennedy (jkennedyvz) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved dependency update; checks passing and merge requirements satisfied.

@jkennedyvz
John Kennedy (jkennedyvz) merged commit 2624b82 into main Oct 28, 2026
9 checks passed
@jkennedyvz
John Kennedy (jkennedyvz) deleted the dependabot/npm_and_yarn/minor-and-patch-ec423c1b11 branch October 28, 2026 17:26

This branch was successfully deployed

1 active deployment
Preview — 67fd7111 Deployed Oct 26, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkennedyvz John Kennedy (jkennedyvz) jkennedyvz approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jkennedyvz