The Wire · Showcase
LANGCHAIN SHIPS THREE CRITICAL RELEASES IN 12 HOURS, CLOSES SETUPTOOLS VULNERABILITY
By RepoJournal · Filed · About AI Agents
LangChain pushed langchain-core 1.5.4, langchain 1.3.15, and langchain-anthropic 1.5.5 overnight while patching a setuptools supply-chain risk that gated the Hugging Face integration.
Three production releases landed across the core stack [2][3][4]. Langchain-anthropic 1.5.5 adds reasoning token reporting to usage metadata and fixes a KeyError in Claude file-tool middleware [2]. Langchain-core 1.5.4 brings Pydantic 2.14 compatibility, closes a StructuredPrompt mutation bug that corrupted caller kwargs, and fixes internal event loop leaks in streaming tracers [4]. Langchain 1.3.15 exposes trace_policy on AgentMiddleware and patches history preservation in SummarizationMiddleware [3]. Separately, a critical setuptools bump from 81.0.0 to 84.0.0 resolved CVE-2026-59890 in the Hugging Face lockfile [1], keeping that integration shipping. In the agent space, OpenHands enforced typed TypeScript client calls across the agent-server API to eliminate auth bypass risks [5], Cline fixed a dashboard bug where recoverable agent errors were incorrectly terminating turns mid-run [6], and llama_index corrected CitationQueryEngine to assign unique IDs to citation chunks instead of reusing source node identifiers [7]. This 24-hour window saw 28 commits, 26 PRs, and 5 releases across the stack with zero critical security gaps remaining.
One email a day. Unsubscribe in one click.
Keep up with AI Agents in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Upgrade langchain and langchain-core to 1.3.15 and 1.5.4 before next agent deploy to fix streaming and tracing bugs langchain-ai/langchain [plan]
- → Update langchain-anthropic to 1.5.5 if using Claude models; reasoning token usage is now properly reported langchain-ai/langchain [plan]
- → If running OpenHands or Cline, upgrade to latest main to get typed API enforcement and dashboard error handling fixes OpenHands/OpenHands [monitor]
- → For llama_index users relying on citations, upgrade to the latest commit to get per-citation unique IDs run-llama/llama_index [plan]
References
- [1] chore: bump setuptools in Hugging Face lockfile (#39603) langchain-ai/langchain
- [2] langchain-anthropic==1.5.5 ↗ langchain-ai/langchain
- [3] langchain==1.3.15 ↗ langchain-ai/langchain
- [4] langchain-core==1.5.4 ↗ langchain-ai/langchain
- [5] chore: enforce typed @openhands/typescript-client for agent-server API calls (no ad-hoc fetch) ↗ OpenHands/OpenHands
- [6] fix(hub): recoverable agent errors must not end the turn in the dashboard (#12962) cline/cline
- [7] fix(core): give each CitationQueryEngine citation node its own id and offsets ↗ run-llama/llama_index