langgraph-api 0.7.103__tar.gz → 0.8.1__tar.gz

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.7.103
+Version: 0.8.1
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE
@@ -15,7 +15,7 @@ Requires-Dist: httpx>=0.25.0
 Requires-Dist: jsonschema-rs<0.45,>=0.20.0
 Requires-Dist: langchain-core>=0.3.64
 Requires-Dist: langgraph-checkpoint<5,>=3.0.1
-Requires-Dist: langgraph-runtime-inmem<0.28.0,>=0.27.0
+Requires-Dist: langgraph-runtime-inmem<0.29.0,>=0.28.0
 Requires-Dist: langgraph-sdk>=0.3.5
 Requires-Dist: langgraph<2,>=0.4.10
 Requires-Dist: langsmith[otel]>=0.6.3

langgraph_api-0.8.1/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.1"

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/api/runs.py

@@ -1,7 +1,7 @@
 import asyncio
 from collections.abc import AsyncIterator, Awaitable, Callable
 from typing import Any, Literal, cast
-from uuid import UUID, uuid4
+from uuid import UUID
 
 import orjson
 import structlog
@@ -374,7 +374,7 @@ async def stream_run_stateless(
     payload["if_not_exists"] = "create"
     on_disconnect = payload.get("on_disconnect", "continue")
     run_id = uuid7()
-    thread_id = uuid4()
+    thread_id = uuid7()
 
     sub = await Runs.Stream.subscribe(run_id, thread_id)
     try:
@@ -468,7 +468,7 @@ async def wait_run_stateless(request: ApiRequest):
     payload["if_not_exists"] = "create"
     on_disconnect = payload.get("on_disconnect", "continue")
     run_id = uuid7()
-    thread_id = uuid4()
+    thread_id = uuid7()
 
     sub = await Runs.Stream.subscribe(run_id, thread_id)
     try:
@@ -533,7 +533,7 @@ async def list_runs(
 
     async with connect() as conn:
         thread, runs = await asyncio.gather(
-            Threads.get(conn, thread_id),
+            Threads.get(conn, thread_id, read_mask_paths=[]),
             Runs.search(
                 conn,
                 thread_id,
@@ -562,7 +562,7 @@ async def get_run(request: ApiRequest):
 
     async with connect() as conn:
         thread, run = await asyncio.gather(
-            Threads.get(conn, thread_id),
+            Threads.get(conn, thread_id, read_mask_paths=[]),
             Runs.get(
                 conn,
                 run_id,

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/api/threads.py

@@ -1,5 +1,4 @@
 from typing import get_args
-from uuid import uuid4
 
 from starlette.exceptions import HTTPException
 from starlette.responses import Response
@@ -26,6 +25,7 @@ from langgraph_api.state import state_snapshot_to_thread_state
 from langgraph_api.utils import (
     fetchone,
     get_pagination_headers,
+    uuid7,
     validate_select_columns,
     validate_stream_id,
     validate_uuid,
@@ -69,7 +69,7 @@ async def create_thread(
             ["metadata"],
         )
 
-    thread_id = thread_id or str(uuid4())
+    thread_id = thread_id or str(uuid7())
     supersteps = payload.get("supersteps")
 
     if IS_POSTGRES_OR_GRPC_BACKEND and not supersteps:

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/config/__init__.py

@@ -45,6 +45,17 @@ DATABASE_URI = env("DATABASE_URI", cast=str, default=getenv("POSTGRES_URI", unde
 # Not in public docs: infrastructure, set by platform
 MIGRATIONS_PATH = env("MIGRATIONS_PATH", cast=str, default="/storage/migrations")
 POSTGRES_POOL_MAX_SIZE = env("LANGGRAPH_POSTGRES_POOL_MAX_SIZE", cast=int, default=150)
+
+# Checkpoint ingestion batch controls
+# Go defaults (core/config/config.go): CHECKPOINT_MAX_BATCH_SIZE=1000, CHECKPOINT_BATCH_DELAY=0.005 (5ms)
+# CHECKPOINT_BATCH_DELAY uses float seconds to match Go's time.Duration env parsing convention.
+# storage_postgres/Makefile sets these to the Go defaults for CI/local dev.
+# TODO(braa): flip these to match Go defaults once validated in production (LSD-1404)
+CHECKPOINT_MAX_BATCH_SIZE: int | None = env(
+    "CHECKPOINT_MAX_BATCH_SIZE", cast=int, default=None
+)
+CHECKPOINT_BATCH_DELAY: float = env("CHECKPOINT_BATCH_DELAY", cast=float, default=0.0)
+
 RESUMABLE_STREAM_TTL_SECONDS = env(
     "RESUMABLE_STREAM_TTL_SECONDS",
     cast=int,
@@ -351,7 +362,8 @@ FF_CRONS_ENABLED = env("FF_CRONS_ENABLED", cast=bool, default=True)
 FF_LOG_DROPPED_EVENTS = env("FF_LOG_DROPPED_EVENTS", cast=bool, default=False)
 FF_LOG_QUERY_AND_PARAMS = env("FF_LOG_QUERY_AND_PARAMS", cast=bool, default=False)
 # Not in public docs: internal feature flag
-FF_USE_REDIS_QUEUE = env("FF_USE_REDIS_QUEUE", cast=bool, default=False)
+FF_USE_REDIS_QUEUE = env("FF_USE_REDIS_QUEUE", cast=bool, default=True)
+
 
 # Internal flag intended for testing only
 CRON_SCHEDULER_SLEEP_TIME = env("CRON_SCHEDULER_SLEEP_TIME", cast=int, default=5)
@@ -578,6 +590,8 @@ __all__ = [
     "BG_JOB_SHUTDOWN_GRACE_PERIOD_SECS",
     "BG_JOB_TIMEOUT_SECS",
     "CHECKPOINTER_CONFIG",
+    "CHECKPOINT_BATCH_DELAY",
+    "CHECKPOINT_MAX_BATCH_SIZE",
     "CORS_ALLOW_ORIGINS",
     "CORS_CONFIG",
     "CRON_SCHEDULER_SLEEP_TIME",

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/config/schemas.py

@@ -386,7 +386,13 @@ class WebhookUrlPolicy(TypedDict, total=False):
     max_url_length: int
     """Maximum permitted URL length in characters; longer inputs are rejected early."""
     disable_loopback: bool
-    """Disallow relative URLs (internal loopback calls) when true."""
+    """Disallow relative URLs (internal loopback calls) and localhost hostnames when true."""
+    disable_private_ips: bool
+    """Block RFC 1918 / CGN private IP ranges as webhook targets when true.
+
+    Defaults to false (private IPs allowed). Set to true to block private
+    IP ranges for stricter SSRF protection.
+    """
 
 
 # Matches things like "${{ env.LG_WEBHOOK_FOO_BAR }}"
@@ -421,6 +427,8 @@ def _validate_url_policy(
         policy["max_url_length"] = 2048
     if "disable_loopback" not in policy:
         policy["disable_loopback"] = False
+    if "disable_private_ips" not in policy:
+        policy["disable_private_ips"] = False
     return policy
 
 

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/grpc/ops/threads.py

@@ -64,6 +64,12 @@ if TYPE_CHECKING:
 logger = structlog.stdlib.get_logger(__name__)
 
 
+# Read-mask preset for Threads.get callers that need metadata/config but not
+# the large "values" column. Used by state get/update/bulk/history which
+# only need graph_id (from metadata) and the thread config.
+THREAD_METADATA_READ_MASK_PATHS: list[str] = ["metadata", "config"]
+
+
 THREAD_STATUS_TO_PB = {
     "idle": enum_thread_status.idle,
     "busy": enum_thread_status.busy,
@@ -471,6 +477,7 @@ class Threads(Authenticated):
         ctx: Auth.types.BaseAuthContext | None = None,
         filters: Auth.types.FilterType | list[pb.AuthFilter] | None = None,
         include_ttl: bool = False,
+        read_mask_paths: list[str] | None = None,
     ) -> AsyncIterator[Thread]:
         """Get a thread by ID.
 
@@ -482,6 +489,11 @@ class Threads(Authenticated):
                      Accepts either raw dict filters (FilterType) or pre-processed
                      proto filters (list[pb.AuthFilter]).
             include_ttl: When True, include TTL information in the response.
+            read_mask_paths: Optional list of field names to fetch from the DB.
+                None (default) fetches all columns. When set, only those columns
+                (plus always-included identity/status columns) are queried.
+                Use ["metadata", "config"] to skip the large "values" column, or
+                [] for an auth/existence check that discards the thread body.
         """
         auth_filters = await Threads.handle_event(
             ctx, "read", {"thread_id": str(thread_id)}
@@ -496,10 +508,16 @@ class Threads(Authenticated):
                 # Raw dict format, convert to proto
                 auth_filters = (auth_filters or []) + _filters_to_proto(filters)
 
+        read_mask = (
+            field_mask_pb2.FieldMask(paths=read_mask_paths)
+            if read_mask_paths is not None
+            else None
+        )
         request = pb.GetThreadRequest(
             thread_id=pb.UUID(value=_normalize_uuid(thread_id)),
             filters=auth_filters,
             include_ttl=include_ttl if include_ttl else None,
+            read_mask=read_mask,
         )
         client = await get_shared_client()
         response = await client.threads.Get(request)
@@ -974,7 +992,12 @@ class Threads(Authenticated):
 
             async with conn.pipeline():
                 thread, checkpoint_iter, graph_id = await asyncio.gather(
-                    Threads.get(conn, thread_id, ctx=ctx),
+                    Threads.get(
+                        conn,
+                        thread_id,
+                        ctx=ctx,
+                        read_mask_paths=THREAD_METADATA_READ_MASK_PATHS,
+                    ),
                     checkpointer.aget_iter(config),
                     Threads.get_graph_id(thread_id),
                 )
@@ -1037,7 +1060,13 @@ class Threads(Authenticated):
 
             async with conn.pipeline():
                 thread, checkpoint_iter, graph_id, run_count = await asyncio.gather(
-                    Threads.get(conn, thread_id, ctx=ctx, filters=filters),
+                    Threads.get(
+                        conn,
+                        thread_id,
+                        ctx=ctx,
+                        filters=filters,
+                        read_mask_paths=THREAD_METADATA_READ_MASK_PATHS,
+                    ),
                     checkpointer.aget_iter(config),
                     Threads.get_graph_id(thread_id),
                     Runs.count(thread_id=thread_id, statuses=["pending", "running"]),
@@ -1130,7 +1159,13 @@ class Threads(Authenticated):
 
             async with conn.pipeline():
                 thread, graph_id = await asyncio.gather(
-                    Threads.get(conn, thread_id, ctx=ctx, filters=filters),
+                    Threads.get(
+                        conn,
+                        thread_id,
+                        ctx=ctx,
+                        filters=filters,
+                        read_mask_paths=THREAD_METADATA_READ_MASK_PATHS,
+                    ),
                     Threads.get_graph_id(config["configurable"]["thread_id"]),
                 )
             thread = await fetchone(thread)
@@ -1218,7 +1253,12 @@ class Threads(Authenticated):
             """Get the history of a thread."""
             async with conn.pipeline():
                 thread, graph_id = await asyncio.gather(
-                    Threads.get(conn, config["configurable"]["thread_id"], ctx=ctx),
+                    Threads.get(
+                        conn,
+                        config["configurable"]["thread_id"],
+                        ctx=ctx,
+                        read_mask_paths=THREAD_METADATA_READ_MASK_PATHS,
+                    ),
                     Threads.get_graph_id(config["configurable"]["thread_id"]),
                 )
             thread = await fetchone(thread)

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/http.py

@@ -123,6 +123,37 @@ def get_loopback_client() -> JsonHttpClient:
     return _loopback_client
 
 
+_webhook_http_client: JsonHttpClient | None = None
+
+
+async def ensure_webhook_http_client() -> JsonHttpClient:
+    """Return (or create) an SSRF-safe HTTP client for webhook dispatch."""
+    global _webhook_http_client
+    if _webhook_http_client is not None:
+        return _webhook_http_client
+
+    from langgraph_api.lc_security import ssrf_safe_async_client  # noqa: PLC0415
+    from langgraph_api.webhook import _get_webhook_config  # noqa: PLC0415
+
+    inner = ssrf_safe_async_client(
+        policy=_get_webhook_config().base_ssrf_policy,
+        retries=2,
+        limits=httpx.Limits(max_keepalive_connections=10, keepalive_expiry=60.0),
+        follow_redirects=True,
+        max_redirects=5,
+    )
+    _webhook_http_client = JsonHttpClient(client=inner)
+    return _webhook_http_client
+
+
+async def stop_webhook_http_client() -> None:
+    global _webhook_http_client
+    if _webhook_http_client is None:
+        return
+    await _webhook_http_client.client.aclose()
+    _webhook_http_client = None
+
+
 def is_retriable_error(exception: BaseException) -> bool:
     # httpx error hierarchy: https://www.python-httpx.org/exceptions/
     # Retry all timeout related errors

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/js/package.json

@@ -19,7 +19,7 @@
     "dedent": "^1.7.2",
     "esbuild": "^0.27.4",
     "exit-hook": "^5.1.0",
-    "hono": "^4.12.12",
+    "hono": "^4.12.14",
     "p-queue": "^9.0.1",
     "p-retry": "^7.1.1",
     "tsx": "^4.21.0",

{langgraph_api-0.7.103 → langgraph_api-0.8.1}/langgraph_api/js/yarn.lock

@@ -1316,10 +1316,10 @@ graceful-fs@^4.2.4:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.11.tgz#4183e4e8bf08bb6e05bbb2f7d2e0c8f712ca40e3"
   integrity sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==
 
-hono@^4.12.12, hono@^4.5.4:
-  version "4.12.12"
-  resolved "https://registry.yarnpkg.com/hono/-/hono-4.12.12.tgz#1f14b0ffb47c386ff50d457d66e706d9c9a7f09c"
-  integrity sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==
+hono@^4.12.14, hono@^4.5.4:
+  version "4.12.14"
+  resolved "https://registry.yarnpkg.com/hono/-/hono-4.12.14.tgz#4777c9512b7c84138e4f09e61e3d2fa305eb1414"
+  integrity sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==
 
 icss-utils@^5.0.0, icss-utils@^5.1.0:
   version "5.1.0"
@@ -1393,9 +1393,9 @@ kuler@^2.0.0:
   integrity sha512-Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==
 
 "langsmith@>=0.3.33 <1.0.0", langsmith@>=0.4.6, "langsmith@>=0.5.0 <1.0.0":
-  version "0.5.18"
-  resolved "https://registry.yarnpkg.com/langsmith/-/langsmith-0.5.18.tgz#c691ad23614f0b46eaf07d982e0ac988e1f43880"
-  integrity sha512-3zuZUWffTHQ+73EAwnodADtf534VNEZUpXr9jC12qyG8/IQuJET7PRsCpTb9wX2lmBspakwLUpqpj3tNm/0bVA==
+  version "0.5.20"
+  resolved "https://registry.yarnpkg.com/langsmith/-/langsmith-0.5.20.tgz#4021847d2ccd5a86c5eb96060f9bb5f19f80eca5"
+  integrity sha512-ULhLM8RswvQDXufLtNtvclHrWCBx8Cb5UPI6lAZC+8Dq59iHsVPz/3Ac9khWNm1VIvChRsuykixD/WrmzuuA3Q==
   dependencies:
     p-queue "6.6.2"
     uuid "10.0.0"

langgraph_api-0.8.1/langgraph_api/lc_security/__init__.py

@@ -0,0 +1,29 @@
+"""lc_security — SSRF protection and security utilities.
+
+Vendored from langchainplus/lc_security. When lc-security is published
+to PyPI, delete this package and add the pip dependency instead.
+"""
+
+from langgraph_api.lc_security.exceptions import SSRFBlockedError
+from langgraph_api.lc_security.policy import (
+    SSRFPolicy,
+    validate_hostname,
+    validate_resolved_ip,
+    validate_url,
+    validate_url_sync,
+)
+from langgraph_api.lc_security.transport import (
+    SSRFSafeTransport,
+    ssrf_safe_async_client,
+)
+
+__all__ = [
+    "SSRFBlockedError",
+    "SSRFPolicy",
+    "SSRFSafeTransport",
+    "ssrf_safe_async_client",
+    "validate_hostname",
+    "validate_resolved_ip",
+    "validate_url",
+    "validate_url_sync",
+]

langgraph_api-0.8.1/langgraph_api/lc_security/exceptions.py

@@ -0,0 +1,9 @@
+"""SSRF protection exceptions."""
+
+
+class SSRFBlockedError(Exception):
+    """Raised when a request is blocked by SSRF protection policy."""
+
+    def __init__(self, reason: str) -> None:
+        self.reason = reason
+        super().__init__(f"SSRF blocked: {reason}")