langchain 0.2.18 → 0.2.20

package/dist/chains/openai_functions/openapi.cjs

@@ -133,7 +133,9 @@ function convertOpenAPISchemaToJSONSchema(schema, spec) {
             }
             // eslint-disable-next-line no-param-reassign
             jsonSchema.properties[propertyName] = convertOpenAPISchemaToJSONSchema(openAPIProperty, spec);
-            if (openAPIProperty.required && jsonSchema.required !== undefined) {
+            if ((openAPIProperty.required ||
+                schema.required?.includes(propertyName)) &&
+                jsonSchema.required !== undefined) {
                 jsonSchema.required.push(propertyName);
             }
             return jsonSchema;

package/dist/chains/openai_functions/openapi.js

@@ -130,7 +130,9 @@ export function convertOpenAPISchemaToJSONSchema(schema, spec) {
             }
             // eslint-disable-next-line no-param-reassign
             jsonSchema.properties[propertyName] = convertOpenAPISchemaToJSONSchema(openAPIProperty, spec);
-            if (openAPIProperty.required && jsonSchema.required !== undefined) {
+            if ((openAPIProperty.required ||
+                schema.required?.includes(propertyName)) &&
+                jsonSchema.required !== undefined) {
                 jsonSchema.required.push(propertyName);
             }
             return jsonSchema;

package/dist/experimental/plan_and_execute/agent_executor.cjs

@@ -102,7 +102,7 @@ class PlanAndExecuteAgentExecutor extends base_js_1.BaseChain {
      */
     static getDefaultStepExecutor({ llm, tools, humanMessageTemplate = prompt_js_1.DEFAULT_STEP_EXECUTOR_HUMAN_CHAT_MESSAGE_TEMPLATE, }) {
         let agent;
-        if (isDynamicStructuredTool(tools[0])) {
+        if (tools.length > 0 && isDynamicStructuredTool(tools[0])) {
             agent = index_js_2.StructuredChatAgent.fromLLMAndTools(llm, tools, {
                 humanMessageTemplate,
                 inputVariables: ["previous_steps", "current_step", "agent_scratchpad"],

package/dist/experimental/plan_and_execute/agent_executor.js

@@ -98,7 +98,7 @@ export class PlanAndExecuteAgentExecutor extends BaseChain {
      */
     static getDefaultStepExecutor({ llm, tools, humanMessageTemplate = DEFAULT_STEP_EXECUTOR_HUMAN_CHAT_MESSAGE_TEMPLATE, }) {
         let agent;
-        if (isDynamicStructuredTool(tools[0])) {
+        if (tools.length > 0 && isDynamicStructuredTool(tools[0])) {
             agent = StructuredChatAgent.fromLLMAndTools(llm, tools, {
                 humanMessageTemplate,
                 inputVariables: ["previous_steps", "current_step", "agent_scratchpad"],

package/dist/storage/file_system.cjs

@@ -51,6 +51,11 @@ const stores_1 = require("@langchain/core/stores");
  *   await store.mdelete([key]);
  * }
  * ```
+ *
+ * @security **Security Notice** This file store
+ * can alter any text file in the provided directory and any subfolders.
+ * Make sure that the path you specify when initializing the store is free
+ * of other files.
  */
 class LocalFileStore extends stores_1.BaseStore {
     constructor(fields) {
@@ -75,6 +80,10 @@ class LocalFileStore extends stores_1.BaseStore {
      * @returns Promise that resolves to the parsed file content.
      */
     async getParsedFile(key) {
+        // Validate the key to prevent path traversal
+        if (!/^[a-zA-Z0-9_\-:.]+$/.test(key)) {
+            throw new Error("Invalid key. Only alphanumeric characters, underscores, hyphens, colons, and periods are allowed.");
+        }
         try {
             const fileContent = await fs.readFile(this.getFullPath(key));
             if (!fileContent) {
@@ -111,11 +120,20 @@ class LocalFileStore extends stores_1.BaseStore {
     getFullPath(key) {
         try {
             const keyAsTxtFile = `${key}.txt`;
-            const fullPath = path.join(this.rootPath, keyAsTxtFile);
+            // Validate the key to prevent path traversal
+            if (!/^[a-zA-Z0-9_.\-/]+$/.test(key)) {
+                throw new Error(`Invalid characters in key: ${key}`);
+            }
+            const fullPath = path.resolve(this.rootPath, keyAsTxtFile);
+            const commonPath = path.resolve(this.rootPath);
+            if (!fullPath.startsWith(commonPath)) {
+                throw new Error(`Invalid key: ${key}. Key should be relative to the root path. ` +
+                    `Root path: ${this.rootPath}, Full path: ${fullPath}`);
+            }
             return fullPath;
         }
         catch (e) {
-            throw new Error(`Error getting full path for key: ${key}.\nError: ${JSON.stringify(e)}`);
+            throw new Error(`Error getting full path for key: ${key}.\nError: ${String(e)}`);
         }
     }
     /**

package/dist/storage/file_system.d.ts

@@ -23,6 +23,11 @@ import { BaseStore } from "@langchain/core/stores";
  *   await store.mdelete([key]);
  * }
  * ```
+ *
+ * @security **Security Notice** This file store
+ * can alter any text file in the provided directory and any subfolders.
+ * Make sure that the path you specify when initializing the store is free
+ * of other files.
  */
 export declare class LocalFileStore extends BaseStore<string, Uint8Array> {
     lc_namespace: string[];

package/dist/storage/file_system.js

@@ -25,6 +25,11 @@ import { BaseStore } from "@langchain/core/stores";
  *   await store.mdelete([key]);
  * }
  * ```
+ *
+ * @security **Security Notice** This file store
+ * can alter any text file in the provided directory and any subfolders.
+ * Make sure that the path you specify when initializing the store is free
+ * of other files.
  */
 export class LocalFileStore extends BaseStore {
     constructor(fields) {
@@ -49,6 +54,10 @@ export class LocalFileStore extends BaseStore {
      * @returns Promise that resolves to the parsed file content.
      */
     async getParsedFile(key) {
+        // Validate the key to prevent path traversal
+        if (!/^[a-zA-Z0-9_\-:.]+$/.test(key)) {
+            throw new Error("Invalid key. Only alphanumeric characters, underscores, hyphens, colons, and periods are allowed.");
+        }
         try {
             const fileContent = await fs.readFile(this.getFullPath(key));
             if (!fileContent) {
@@ -85,11 +94,20 @@ export class LocalFileStore extends BaseStore {
     getFullPath(key) {
         try {
             const keyAsTxtFile = `${key}.txt`;
-            const fullPath = path.join(this.rootPath, keyAsTxtFile);
+            // Validate the key to prevent path traversal
+            if (!/^[a-zA-Z0-9_.\-/]+$/.test(key)) {
+                throw new Error(`Invalid characters in key: ${key}`);
+            }
+            const fullPath = path.resolve(this.rootPath, keyAsTxtFile);
+            const commonPath = path.resolve(this.rootPath);
+            if (!fullPath.startsWith(commonPath)) {
+                throw new Error(`Invalid key: ${key}. Key should be relative to the root path. ` +
+                    `Root path: ${this.rootPath}, Full path: ${fullPath}`);
+            }
             return fullPath;
         }
         catch (e) {
-            throw new Error(`Error getting full path for key: ${key}.\nError: ${JSON.stringify(e)}`);
+            throw new Error(`Error getting full path for key: ${key}.\nError: ${String(e)}`);
         }
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "langchain",
-  "version": "0.2.18",
+  "version": "0.2.20",
   "description": "Typescript bindings for langchain",
   "type": "module",
   "engines": {
@@ -600,7 +600,7 @@
     "@aws-sdk/types": "^3.357.0",
     "@azure/storage-blob": "^12.15.0",
     "@browserbasehq/sdk": "^1.1.5",
-    "@cloudflare/workers-types": "^4.20230922.0",
+    "@cloudflare/workers-types": "^4.20240909.0",
     "@faker-js/faker": "^7.6.0",
     "@gomomento/sdk": "^1.51.1",
     "@gomomento/sdk-core": "^1.51.1",
@@ -699,7 +699,6 @@
     "@langchain/anthropic": "*",
     "@langchain/aws": "*",
     "@langchain/cohere": "*",
-    "@langchain/community": "*",
     "@langchain/google-genai": "*",
     "@langchain/google-vertexai": "*",
     "@langchain/groq": "*",
@@ -783,9 +782,6 @@
     "@langchain/cohere": {
       "optional": true
     },
-    "@langchain/community": {
-      "optional": true
-    },
     "@langchain/google-genai": {
       "optional": true
     },
@@ -933,7 +929,7 @@
     "js-tiktoken": "^1.0.12",
     "js-yaml": "^4.1.0",
     "jsonpointer": "^5.0.1",
-    "langsmith": "~0.1.40",
+    "langsmith": "^0.1.56-rc.1",
     "openapi-types": "^12.1.3",
     "p-retry": "4",
     "uuid": "^10.0.0",