langgraph-api 0.9.0.dev3__tar.gz → 0.9.0.dev5__tar.gz

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: build release lint format test test_watch start start-inmem start-inmem-license-oss start start-js-server build-go-server start-go-server stop-go-server check-version check-base-imports test-a2a-tck test-a2a-tck-mandatory start-test-a2a-tck start-test-a2a-tck-mandatory start-test-a2a-tck-watch test-mcp-conformance start-test-mcp-conformance list-mcp-scenarios
+.PHONY: build release lint format test test_watch start start-inmem start-inmem-license-oss start start-js-server build-go-server start-go-server stop-go-server check-version check-base-imports test-a2a-tck test-a2a-tck-mandatory start-test-a2a-tck start-test-a2a-tck-mandatory start-test-a2a-tck-watch test-mcp-conformance start-test-mcp-conformance list-mcp-scenarios test-auth-read-only-assistant
 
 # Environment variables
 LANGSERVE_GRAPHS_ALL = '{"agent": {"path": "./tests/graphs/agent.py:graph", "description": "agent"}, "assistant_id_runtime": "./tests/graphs/assistant_id_runtime.py:graph", "custom_lifespan": "./tests/graphs/my_router.py:graph", "single_node": "./tests/graphs/single_node.py:graph", "benchmark": "./tests/graphs/benchmark.py:graph", "config_graph": "./tests/graphs/config_graph.py:graph", "other": "./tests/graphs/other.py:make_graph", "weather": "./tests/graphs/weather.py:mk_weather_graph", "searchy": "./tests/graphs/searchy.py:graph", "agent_simple": "./tests/graphs/agent_simple.py:graph", "simple_runtime": "./tests/graphs/simple_runtime.py:graph", "agent_interrupt": "./tests/graphs/agent_interrupt.py:graph", "agent_parallel_interrupt": "./tests/graphs/agent_parallel_interrupt.py:graph", "message_type_test": "./tests/graphs/message_type_test.py:graph", "remote_subgraph_parent": "./tests/graphs/remote_subgraph_parent.py:graph", "simple_remote": "./tests/graphs/simple_remote.py:graph", "nested_subgraphs": "./tests/graphs/nested_subgraphs.py:graph", "functional_fibonacci": "./tests/graphs/functional_fibonacci.py:fibonacci", "state_graph_fibonacci": "./tests/graphs/state_graph_fibonacci.py:fibonacci", "max_concurrency_graph": "./tests/graphs/max_concurrency_graph.py:graph", "unserializable_subgraph": "./tests/graphs/unserializable_subgraph.py:graph", "agent_interrupt_text": "./tests/graphs/agent_interrupt_text.py:graph", "agent_echo_stream": "./tests/graphs/agent_echo_stream.py:graph", "agent_tool_stream": "./tests/graphs/agent_tool_stream.py:graph", "runtime_graph": "./tests/graphs/runtime_graph.py:graph", "tool_call_chunk_stream": "./tests/graphs/tool_call_chunk_stream.py:graph", "ui_tool_call_stream": "./tests/graphs/ui_tool_call_stream.py:graph", "agent_metrics_stream": "./tests/graphs/agent_metrics_stream.py:graph", "agent_multimodal_stream": "./tests/graphs/agent_multimodal_stream.py:graph", "agent_bedtime_story": "./tests/graphs/agent_bedtime_story.py:graph", "delta_channel": "./tests/graphs/delta_channel.py:graph", "delta_channel_freq": "./tests/graphs/delta_channel_freq.py:graph", "delta_channel_files": "./tests/graphs/delta_channel_files.py:graph", "delta_channel_files_freq": "./tests/graphs/delta_channel_files_freq.py:graph", "delta_channel_legacy": "./tests/graphs/delta_channel_migration.py:graph_legacy", "delta_channel_delta": "./tests/graphs/delta_channel_migration.py:graph_delta", "delta_channel_messages_freq": "./tests/graphs/delta_channel_messages.py:graph_freq", "delta_channel_messages": "./tests/graphs/delta_channel_messages.py:graph", "delta_channel_messages_legacy": "./tests/graphs/delta_channel_messages.py:graph_legacy", "delta_channel_messages_remove": "./tests/graphs/delta_channel_messages.py:graph_remove", "delta_channel_messages_update": "./tests/graphs/delta_channel_messages.py:graph_update", "delta_channel_messages_delta": "./tests/graphs/delta_channel_messages.py:graph_delta"}'
@@ -71,6 +71,19 @@ else
 	HTTP_CONFIG := $(LANGGRAPH_HTTP)
 endif
 
+# Dev/test default: opt in to loopback + http webhooks.
+# ``test_custom_route`` etc use relative URLs to dispatch to my_router.py;
+# ``test_join_*`` / ``test_webhook_payload_on_timeouts`` / ``test_cron_*``
+# and the shutdown suite use ``http://localhost:{port}/webhook`` to a
+# pytest httpserver fixture — all of these are blocked by the secure
+# ``disable_loopback`` default (GHSA-q3v5-r5ch-p57j), and
+# ``require_https`` defaults to true once any webhooks.url block is
+# present, so explicitly disable it for the http httpserver fixture.
+# Production deployers don't use these Makefiles. Override with
+# ``LANGGRAPH_WEBHOOKS=...`` on the command line to exercise the secure
+# default during local development.
+LANGGRAPH_WEBHOOKS ?= {"url": {"disable_loopback": false, "require_https": false}}
+
 LANGGRAPH_STORE ?= ""
 ifeq ($(LANGGRAPH_STORE),custom)
 	STORE_CONFIG := {"path": "./tests/graphs/custom_store.py:generate_store"}
@@ -93,10 +106,10 @@ REVISION ?= $(shell git rev-parse --short HEAD)
 LANGGRAPH_ENCRYPTION ?=
 
 test-license-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
 
 test-watch-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
 
 test: test-license-oss
 test-watch: test-watch-oss
@@ -159,6 +172,7 @@ LANGSMITH_TRACING ?= false
 
 start:
 	LANGGRAPH_DISABLE_FILE_PERSISTENCE=$(LANGGRAPH_DISABLE_FILE_PERSISTENCE) \
+	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \
@@ -186,6 +200,7 @@ start:
 start-license-oss: start
 
 start-encrypt:
+	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.9.0.dev3
+Version: 0.9.0.dev5
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/benchmark/continuous/uv.lock

@@ -98,11 +98,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]

langgraph_api-0.9.0.dev5/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.9.0.dev5"

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/langgraph_api/config/schemas.py

@@ -386,7 +386,26 @@ class WebhookUrlPolicy(TypedDict, total=False):
     max_url_length: int
     """Maximum permitted URL length in characters; longer inputs are rejected early."""
     disable_loopback: bool
-    """Disallow relative URLs (internal loopback calls) and localhost hostnames when true."""
+    """Disallow loopback-flavored webhook targets when true. Defaults to true.
+
+    Covers all of:
+    - Relative URLs (e.g. ``/internal/hook``) that would dispatch via the
+      in-process ASGI loopback transport at ``root_path="/noauth"``. These
+      bypass authentication and were the auth-bypass primitive behind
+      GHSA-q3v5-r5ch-p57j.
+    - Absolute URLs whose hostname is ``localhost`` / ``localhost.localdomain``
+      / ``host.docker.internal``.
+    - Absolute URLs that DNS-resolve into the IPv4 loopback range
+      (``127.0.0.0/8``) or IPv6 loopback (``::1/128``) — including
+      DNS-rebinding-style attacks where an arbitrary hostname resolves to
+      a loopback IP.
+
+    Operators who intentionally route webhooks to in-process routes
+    (e.g. for local development with ``langgraph dev``, or single-host
+    docker-compose setups dispatching to ``host.docker.internal``) can
+    set this to ``false`` to restore the pre-GHSA behavior. Only do this
+    when you control all routes that loopback webhooks can reach.
+    """
     disable_private_ips: bool
     """Block RFC 1918 / CGN private IP ranges as webhook targets when true.
 
@@ -426,7 +445,12 @@ def _validate_url_policy(
     if "max_url_length" not in policy:
         policy["max_url_length"] = 2048
     if "disable_loopback" not in policy:
-        policy["disable_loopback"] = False
+        # Secure default — covers GHSA-q3v5-r5ch-p57j (relative-URL ASGI
+        # loopback auth bypass) and the broader SSRF surface that the same
+        # flag governs via SSRFPolicy.block_localhost. Mirrored at the
+        # webhook.py read site so deployments without any webhooks block
+        # also get the safe default.
+        policy["disable_loopback"] = True
     if "disable_private_ips" not in policy:
         policy["disable_private_ips"] = False
     return policy

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/langgraph_api/grpc/ops/crons.py

@@ -230,10 +230,14 @@ class Crons(Authenticated):
 
         assistant_filters: list[Any] = []
         if payload["assistant_id"] not in SYSTEM_ASSISTANT_IDS:
+            # Do not populate `metadata` on the AssistantsRead request value:
+            # client-supplied cron metadata must not influence the auth
+            # decision (defense vs. forged payloads), mirroring Runs.put.
+            # The handler is expected to return a filter that is matched
+            # against the persisted assistant metadata server-side.
             assistant_request_data = Auth.types.AssistantsRead(
                 assistant_id=str(payload["assistant_id"])
             )
-            assistant_request_data["metadata"] = metadata
             assistant_filters = await Assistants.handle_event(
                 ctx, "read", assistant_request_data
             )

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/langgraph_api/grpc/ops/runs.py

@@ -610,18 +610,19 @@ class Runs(Authenticated):
             create_run_value,
         )
         # Automatically enforce assistant ownership for non-system assistants
-        # by calling the user's assistant search auth handler.
+        # by calling the user's assistant read auth handler.
         assistant_auth_filters: list[pb.AuthFilter] = []
         if str(assistant_id) not in SYSTEM_ASSISTANT_IDS:
             ctx_ = ctx or get_auth_ctx()
             if ctx_ is not None:
                 auth_ctx = Auth.types.AuthContext(
                     resource="assistants",
-                    action="search",
+                    action="read",
                     user=ctx_.user,
                     permissions=ctx_.permissions,
                 )
-                raw = await auth_handle_event(auth_ctx, {"metadata": {}})
+                read_value = Auth.types.AssistantsRead(assistant_id=str(assistant_id))
+                raw = await auth_handle_event(auth_ctx, read_value)
                 if raw:
                     assistant_auth_filters = _filters_to_proto(raw)
 

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev5}/langgraph_api/webhook.py

@@ -79,7 +79,14 @@ def _get_webhook_config() -> _WebhookConfig:
     exact_allowed = frozenset(exact_hosts)
 
     disable_private_ips = bool(policy_cfg.get("disable_private_ips", False))
-    disable_loopback = bool(policy_cfg.get("disable_loopback", False))
+    # Loopback webhooks are denied by default (covers relative URLs that
+    # would dispatch through the in-process ASGI client at root_path=/noauth,
+    # plus localhost / 127.x / ::1 / host.docker.internal absolute URLs,
+    # plus any hostname that DNS-resolves into the loopback range). This is
+    # the fix for GHSA-q3v5-r5ch-p57j: relative-URL webhooks were the auth
+    # bypass primitive, and the localhost/loopback IP variants are the
+    # broader SSRF surface that the same flag governs via SSRFPolicy.
+    disable_loopback = bool(policy_cfg.get("disable_loopback", True))
 
     return _WebhookConfig(
         allowed_domains=allowed_domains,
@@ -111,11 +118,26 @@ async def validate_webhook_url_or_raise(url: str) -> None:
     if len(url) > wh.max_url_length:
         raise HTTPException(status_code=422, detail="Webhook URL too long")
 
-    # Relative loopback URL (internal route) — not subject to SSRF checks
+    # Relative loopback URL (internal route) — dispatched via an in-process
+    # ASGI client that mounts under root_path="/noauth", which the auth
+    # middleware treats as an auth-bypass marker. Denied by default so a
+    # user-supplied webhook URL cannot be turned into an unauthenticated
+    # call against the server's own routes (GHSA-q3v5-r5ch-p57j). Operators
+    # who intentionally route webhooks to in-process routes can opt back in
+    # by setting webhooks.url.disable_loopback to false.
     if url.startswith("/"):
         if wh.disable_loopback:
             raise HTTPException(
-                status_code=422, detail="Loopback webhooks are disabled"
+                status_code=422,
+                detail=(
+                    "Loopback webhooks (relative URLs and localhost) are "
+                    "disabled by default. They bypass authentication via the "
+                    "in-process ASGI transport and can be abused to invoke "
+                    "internal routes as an unauthenticated caller. Set "
+                    "webhooks.url.disable_loopback to false (in langgraph.json "
+                    "or via LANGGRAPH_WEBHOOKS) to opt back in — only do so "
+                    "when you control the mounted routes."
+                ),
             )
         return
 

langgraph_api-0.9.0.dev3/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.9.0.dev3"