Skip to content

Bump langchain-core from 0.3.51 to 1.2.11#19

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/langchain-core-1.2.11
Open

Bump langchain-core from 0.3.51 to 1.2.11#19
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/langchain-core-1.2.11

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Feb 11, 2026

Bumps langchain-core from 0.3.51 to 1.2.11.

Release notes

Sourced from langchain-core's releases.

langchain-core==1.2.11

Changes since langchain-core==1.2.10

release(core): 1.2.11 (#35144) fix(openai): sanitize urls when counting tokens in images (#35143) chore(core): clean up docstring mismatch and redundant logic in langchain-core (#35064) fix(core): replace bare except with Exception in tracer (#35138)

langchain-core==1.2.10

Changes since langchain-core==1.2.9

release(core): 1.2.10 (#35136) chore(deps): bump the langchain-deps group across 3 directories with 40 updates (#35129) chore(deps): bump the langchain-deps group across 3 directories with 11 updates (#35121) feat(core): add ContextOverflowError, raise in anthropic and openai (#35099) feat(model-profiles): add text_inputs and text_outputs (#35084) feat(core): count tokens from tool schemas in count_tokens_approximately (#35098) docs(core): add missing name docstring for RunnableSerializable (#35088)

langchain-core==1.2.9

Changes since langchain-core==1.2.8

release(core): 1.2.9 (#35025) fix(core): adjust cap when scaling approximate token counts (#35017) revert: precompile hex color regex pattern at module level (#35016) chore: add make type target (#35015) revert: "chore: add typing target in Makefile" (#35013) chore: add typing target in Makefile (#35012) fix(core): apply cap when scaling approximate token counts (#35005) feat(core): allow scaling by reported usage when counting tokens approximately (#34996) test(core): increase delta_time for flaky test (#34982) chore: enrich pyproject.toml files (#34980)

langchain-core==1.2.8

Changes since langchain-core==1.2.7

release(core): 1.2.8 (#34975) docs(core): add examples for pretty_repr, pretty_print (#34968) docs(core): use proper admonition for get_buffer_string (#34967) docs: add usage examples to core classes (#34841) chore(core): fix docstring format (#34966) chore(deps): bump the uv group across 20 directories with 3 updates (#34941) docs: add example to create_message function docstring (#34851) docs(core): clarify @​tool decorator argument and return type requirements (#34860) fix(core): fix nested mustache variable extraction and update docs (#34872) fix(core): allow base model annotations for empty model (#34932) chore: upgrade urllib3 to 2.6.3 (#34940) fix(core): prevent crash in ParrotFakeChatModel when messages list is empty (#34943) fix(core): google docstring parsing with no arguments/reserved arguments (#34861) test(core): add tests for approximate token counting with multimodal messages (#34898)

... (truncated)

Commits
  • 524e1da release(core): 1.2.11 (#35144)
  • 2b4b1dc fix(openai): sanitize urls when counting tokens in images (#35143)
  • 0493b27 fix(anthropic): support effort="max" and remove beta headers (#35141)
  • a5f22e7 chore(core): clean up docstring mismatch and redundant logic in langchain-cor...
  • 97ee14c fix(core): replace bare except with Exception in tracer (#35138)
  • 990e807 release(standard-tests): release 1.1.5 (#35139)
  • 74dffca release(langchain): 1.2.10 (#35137)
  • f41e049 release(core): 1.2.10 (#35136)
  • de05838 chore(deps): bump the langchain-deps group across 3 directories with 40 updat...
  • d6e86aa chore(deps): bump the other-deps group across 3 directories with 12 updates (...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [langchain-core](https://github.com/langchain-ai/langchain) from 0.3.51 to 1.2.11.
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==0.3.51...langchain-core==1.2.11)

---
updated-dependencies:
- dependency-name: langchain-core
  dependency-version: 1.2.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Feb 11, 2026
@dbmi-svc-checkmarx
Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Details3edf42a3-1bff-48ab-84cf-399e6ceed1bb

New Issues (20)

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2024-58340 Python-langchain-0.3.23
detailsRecommended version: 1.2.4
Description: LangChain contains a Regular Expression Denial-of-Service (ReDoS) vulnerability in the "MRKLOutputParser.parse()" method ("libs/langchain/langchain...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2025-53000 Python-nbconvert-7.16.6
detailsRecommended version: 7.17.0
Description: The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. All versions of nbconvert on Window...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2025-66418 Python-urllib3-2.3.0
detailsRecommended version: 2.6.3
Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression ch...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2025-66471 Python-urllib3-2.3.0
detailsRecommended version: 2.6.3
Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2025-67221 Python-orjson-3.10.16
detailsRecommended version: 3.11.7
Description: The "orjson.dumps" function in orjson does not limit recursion for deeply nested JSON documents.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2025-67725 Python-tornado-6.4.2
detailsRecommended version: 6.5.3
Description: Tornado is a Python web framework and asynchronous networking library. In versions through 6.5.2, a single maliciously crafted HTTP request can blo...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 HIGH CVE-2025-67726 Python-tornado-6.4.2
detailsRecommended version: 6.5.3
Description: Tornado is a Python web framework and asynchronous networking library. Versions through 6.5.2 use an inefficient algorithm when parsing parameters ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2025-69223 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 allow a zip bomb to be used to execute a Do...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-21441 Python-urllib3-2.3.0
detailsRecommended version: 2.6.3
Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 MEDIUM CVE-2025-67724 Python-tornado-6.4.2
detailsRecommended version: 6.5.3
Description: Tornado is a Python web framework and asynchronous networking library. In versions through 6.5.2 , the supplied reason phrase is used unescaped in ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
11 MEDIUM CVE-2025-68146 Python-filelock-3.18.0
detailsRecommended version: 3.20.3
Description: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows lo...
Attack Vector: LOCAL
Attack Complexity: HIGH
Vulnerable Package
12 MEDIUM CVE-2025-68480 Python-marshmallow-3.26.1
detailsRecommended version: 3.26.2
Description: Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 prior to 3.26.2 ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 MEDIUM CVE-2025-69224 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 of the Python HTTP ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 MEDIUM CVE-2025-69226 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1, enable an attacker...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
15 MEDIUM CVE-2025-69227 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 allow for an infini...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
16 MEDIUM CVE-2025-69228 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 allow a request to ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 MEDIUM CVE-2025-69229 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions through 3.13.2 and 4.x through 4.0.0a1, handling of chu...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 MEDIUM CVE-2026-22701 Python-filelock-3.18.0
detailsRecommended version: 3.20.3
Description: filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the "SoftFileLock...
Attack Vector: LOCAL
Attack Complexity: HIGH
Vulnerable Package
19 LOW CVE-2025-69225 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 contain parser logi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
20 LOW CVE-2025-69230 Python-aiohttp-3.11.14
detailsRecommended version: 3.13.3
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions through 3.13.2, reading multiple invalid cookies can le...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant