agent-tracegraph 0.6.0__tar.gz → 0.6.1__tar.gz

{agent_tracegraph-0.6.0 → agent_tracegraph-0.6.1}/CHANGELOG.md

@@ -6,6 +6,17 @@ The **artifact** schema version and the **report**/**review-candidate** JSON sch
 separate contracts from this version number; changes to any of them are called out
 explicitly.
 
+## 0.6.1 - 2026-10-20
+
+### Dependencies
+
+- `langgraph-checkpoint-sqlite` now requires `>=3.1.1` (was `>=2`), the first release with the
+  fix for GHSA-47pj-3jcm-6whg, where store namespace prefixes could match across segment
+  boundaries. Tracegraph reads checkpoints through `SqliteSaver` and never uses the store; the
+  floor keeps an install from resolving a flagged version. The source, commands and JSON
+  contracts are the same as 0.6.0, but the install range is narrower: an environment that pins
+  `langgraph-checkpoint-sqlite==3.1.0` resolves with 0.6.0 and not with 0.6.1.
+
 ## 0.6.0 - 2026-10-20
 
 ### Added

{agent_tracegraph-0.6.0 → agent_tracegraph-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agent-tracegraph
-Version: 0.6.0
+Version: 0.6.1
 Summary: Time-travel debugging and causal RCA for LangGraph agent traces, on a causal graph.
 Project-URL: Homepage, https://github.com/memtomem/tracegraph
 Project-URL: Repository, https://github.com/memtomem/tracegraph
@@ -19,7 +19,7 @@ Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Software Development :: Debuggers
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: langgraph-checkpoint-sqlite>=2
+Requires-Dist: langgraph-checkpoint-sqlite>=3.1.1
 Requires-Dist: langgraph-checkpoint>=4.1
 Requires-Dist: pydantic<3,>=2
 Requires-Dist: rich>=13

{agent_tracegraph-0.6.0 → agent_tracegraph-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@
 # the schema `kind` constants and the TRACEGRAPH_* environment variables — those are package
 # identity, not distribution identity, and renaming them would break published contracts.
 name = "agent-tracegraph"
-version = "0.6.0"
+version = "0.6.1"
 description = "Time-travel debugging and causal RCA for LangGraph agent traces, on a causal graph."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -30,7 +30,10 @@ classifiers = [
 
 dependencies = [
     "pydantic>=2,<3",
-    "langgraph-checkpoint-sqlite>=2",
+    # 3.1.1 fixes GHSA-47pj-3jcm-6whg (store namespace prefixes crossing segment boundaries).
+    # Tracegraph reads only SqliteSaver, never the store; the floor keeps installs off the
+    # flagged versions.
+    "langgraph-checkpoint-sqlite>=3.1.1",
     # Declared directly, not left transitive, because `ingest` now calls its serializer API:
     # `JsonPlusSerializer(allowed_msgpack_modules=...)` is what stops a checkpoint payload
     # invoking arbitrary callables, and it does not exist before 4.1 (4.0.0 raises TypeError,