Skip to content

[Snyk] Security upgrade langsmith from 0.1.147 to 0.7.31#29

Open
mandibles232 wants to merge 1 commit intomasterfrom
snyk-fix-e0e7d6320fe86fb75594f32dab75df8b
Open

[Snyk] Security upgrade langsmith from 0.1.147 to 0.7.31#29
mandibles232 wants to merge 1 commit intomasterfrom
snyk-fix-e0e7d6320fe86fb75594f32dab75df8b

Conversation

@mandibles232
Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

  • requirements.txt

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

The following vulnerabilities are fixed by pinning transitive dependencies:
- https://snyk.io/vuln/SNYK-PYTHON-LANGSMITH-16082038
@mandibles232
Copy link
Copy Markdown
Author

Merge Risk: High

This is a significant upgrade from a pre-1.0 version, spanning multiple minor versions that include several breaking changes. Manual review and code modifications are likely required.

Key Breaking Changes:

  • API Methods: Several methods on the Client object have been reorganized. For example, methods for interacting with runs, datasets, and examples have been moved to nested properties like client.runs, client.datasets, and client.examples.
  • RunTree and Tracing: The RunTree class and the @traceable decorator have undergone changes. Parameters and behavior for creating and managing traces may have been updated, requiring adjustments in how tracing is implemented.
  • Configuration: Environment variables for configuration may have been renamed or deprecated in favor of new ones. For instance, older authentication variables might be superseded.
  • Input/Output Models: The Pydantic models used for inputs and outputs may have stricter validation or different structures in newer versions.

Recommendation:
Due to the number of breaking changes between 0.1.147 and 0.7.31, a direct upgrade is not recommended without careful testing and code refactoring. Developers should consult the release notes for each minor version bump (0.2.x, 0.3.x, etc.) to identify all relevant changes and update their implementation accordingly.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@mandibles232 mandibles232 requested a review from a team as a code owner April 17, 2026 07:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants