●Change8

langchain-core==1.4.0

📦 langchainView on GitHub →
✨ 14 features🐛 34 fixes⚡ 1 deprecations🔧 28 symbols

Summary

This release focuses heavily on infrastructure updates, dependency bumps, and significant hardening across security (SSRF) and tracing mechanisms. New features include content-block-centric streaming (v2) and enhanced metadata tracing for LLM invocations.

Migration Steps

  1. If you rely on prompt saving/loading functionality that uses paths, review usage of `prompt.save` and `load_prompt` as they are now deprecated due to path validation hardening.

✨ New Features

  • Added content-block-centric streaming (v2) to core.
  • Allowed `_format_output` to pass through list of ToolOutputMixin instances in core.
  • Updated inheritance behavior for tracer metadata for special keys in core.
  • Added chat model and LLM invocation params to traceable metadata in core.
  • Added LangSmith integration metadata to `create_agent` and `init_chat_model`.
  • Hardened anti-ssrf measures.
  • Moved `BaseCrossEncoder` to `langchain-core`.
  • Added support for tool search in `openai`.
  • Added `ChatAnthropicBedrock` wrapper for Anthropic.
  • Added `langchain-openrouter` provider package.
  • Added `ContextOverflowError` and raised it in Anthropic and OpenAI integrations.
  • Added `text_inputs` and `text_outputs` to `model-profiles`.
  • Added token counting from tool schemas in `count_tokens_approximately` in core.
  • Allowed scaling by reported usage when calculating approximate token counts.

🐛 Bug Fixes

  • Avoided eager `pydantic.v1` import in `@deprecated` decorator.
  • Set deprecation `since` version to 1.3.3 to match release.
  • Hardened `load()` against untrusted manifests in core and langchain.
  • Preserved structured `inputs` on tool runs in tracers.
  • Made `removal` optional in `warn_deprecated` in core.
  • Validated `batch_size` in `_batch` and `_abatch` to prevent infinite loop.
  • Restored cloud metadata IPs and link-local range in SSRF policy.
  • Handled content blocks without `type` key in OpenAI responses API conversion.
  • Used reference counting for storing inherited run trees to support garbage collection.
  • Added more sanitization to templates.
  • Handled symlinks in deprecated prompt save path.
  • Added init validator and serialization mappings for Bedrock models.
  • Imputed placeholder filenames for OpenAI file inputs.
  • Added "computer" to `_WellKnownOpenAITools`.
  • Traced invocation params in metadata (reverted and then fixed again).
  • Fixed double backticks in deprecation docstring for `alternative_import`.
  • Preserved `default_factory` when generating tool call schema.
  • Extracted usage metadata from serialized tracer message outputs.
  • Treated empty tool chunk ids as missing in merge.
  • Improved error message for non-JSON-serializable tool schemas.
  • Improved typing/docs for `on_chat_model_start` to clarify required positional args.
  • Fixed merge_lists incorrectly merging parallel tool calls.
  • Accepted integer temperature values in `_get_ls_params` for LangSmith tracing.
  • Prevented recursion error when `args_schema` is a dict.
  • Preserved index and timestamp fields when merging.
  • Corrected misleading jinja2 sandboxing comment.
  • Fixed setting `ChatGeneration.text`.
  • Sanitized urls when counting tokens in images.
  • Replaced bare except with `Exception` in tracer.
  • Adjusted cap when scaling approximate token counts.
  • Applied cap when scaling approximate token counts.
  • Fixed typos in the documentation.
  • Corrected parameter names in `filter_messages` docstring example.
  • Harden check for txt files in deprecated prompt loading functions.

Affected Symbols

`pydantic.v1``load()``warn_deprecated``_batch``_abatch``stream_v2``astream_v2``_format_output``ToolOutputMixin`tracer metadata`ChatBaseten`SSRF utilitiesOpenAI responses API conversion`prompt.save``load_prompt``ModelProfile``_WellKnownOpenAITools``create_agent``init_chat_model``BaseCrossEncoder``on_chat_model_start``_get_ls_params``ChatGeneration.text``count_tokens_approximately``ChatAnthropicBedrockWrapper``langserve``deepagents``args_schema`

⚡ Deprecations

  • Validation of paths in `prompt.save` and `load_prompt` functions has been added, and the methods themselves are now deprecated (related to fix: validate paths in `prompt.save` and `load_prompt`, deprecate methods, #36200).