langgraph-api 0.9.0.dev6__tar.gz → 0.9.1__tar.gz

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: build release lint format test test_watch start start-inmem start-inmem-license-oss start start-js-server build-go-server start-go-server stop-go-server check-version check-base-imports test-a2a-tck test-a2a-tck-mandatory start-test-a2a-tck start-test-a2a-tck-mandatory start-test-a2a-tck-watch test-mcp-conformance start-test-mcp-conformance list-mcp-scenarios test-auth-read-only-assistant
+.PHONY: build release lint format test test_watch start start-inmem start-inmem-license-oss start start-js-server build-go-server start-go-server stop-go-server check-version check-base-imports test-a2a-tck test-a2a-tck-mandatory start-test-a2a-tck start-test-a2a-tck-mandatory start-test-a2a-tck-watch test-mcp-conformance start-test-mcp-conformance list-mcp-scenarios
 
 # Environment variables
 LANGSERVE_GRAPHS_ALL = '{"agent": {"path": "./tests/graphs/agent.py:graph", "description": "agent"}, "assistant_id_runtime": "./tests/graphs/assistant_id_runtime.py:graph", "custom_lifespan": "./tests/graphs/my_router.py:graph", "single_node": "./tests/graphs/single_node.py:graph", "benchmark": "./tests/graphs/benchmark.py:graph", "config_graph": "./tests/graphs/config_graph.py:graph", "other": "./tests/graphs/other.py:make_graph", "weather": "./tests/graphs/weather.py:mk_weather_graph", "searchy": "./tests/graphs/searchy.py:graph", "agent_simple": "./tests/graphs/agent_simple.py:graph", "simple_runtime": "./tests/graphs/simple_runtime.py:graph", "agent_interrupt": "./tests/graphs/agent_interrupt.py:graph", "agent_parallel_interrupt": "./tests/graphs/agent_parallel_interrupt.py:graph", "message_type_test": "./tests/graphs/message_type_test.py:graph", "remote_subgraph_parent": "./tests/graphs/remote_subgraph_parent.py:graph", "simple_remote": "./tests/graphs/simple_remote.py:graph", "nested_subgraphs": "./tests/graphs/nested_subgraphs.py:graph", "functional_fibonacci": "./tests/graphs/functional_fibonacci.py:fibonacci", "state_graph_fibonacci": "./tests/graphs/state_graph_fibonacci.py:fibonacci", "max_concurrency_graph": "./tests/graphs/max_concurrency_graph.py:graph", "unserializable_subgraph": "./tests/graphs/unserializable_subgraph.py:graph", "agent_interrupt_text": "./tests/graphs/agent_interrupt_text.py:graph", "agent_echo_stream": "./tests/graphs/agent_echo_stream.py:graph", "agent_tool_stream": "./tests/graphs/agent_tool_stream.py:graph", "runtime_graph": "./tests/graphs/runtime_graph.py:graph", "tool_call_chunk_stream": "./tests/graphs/tool_call_chunk_stream.py:graph", "ui_tool_call_stream": "./tests/graphs/ui_tool_call_stream.py:graph", "agent_metrics_stream": "./tests/graphs/agent_metrics_stream.py:graph", "agent_multimodal_stream": "./tests/graphs/agent_multimodal_stream.py:graph", "agent_bedtime_story": "./tests/graphs/agent_bedtime_story.py:graph", "delta_channel": "./tests/graphs/delta_channel.py:graph", "delta_channel_freq": "./tests/graphs/delta_channel_freq.py:graph", "delta_channel_files": "./tests/graphs/delta_channel_files.py:graph", "delta_channel_files_freq": "./tests/graphs/delta_channel_files_freq.py:graph", "delta_channel_legacy": "./tests/graphs/delta_channel_migration.py:graph_legacy", "delta_channel_delta": "./tests/graphs/delta_channel_migration.py:graph_delta", "delta_channel_messages_freq": "./tests/graphs/delta_channel_messages.py:graph_freq", "delta_channel_messages": "./tests/graphs/delta_channel_messages.py:graph", "delta_channel_messages_legacy": "./tests/graphs/delta_channel_messages.py:graph_legacy", "delta_channel_messages_remove": "./tests/graphs/delta_channel_messages.py:graph_remove", "delta_channel_messages_update": "./tests/graphs/delta_channel_messages.py:graph_update", "delta_channel_messages_delta": "./tests/graphs/delta_channel_messages.py:graph_delta"}'
@@ -71,19 +71,6 @@ else
 	HTTP_CONFIG := $(LANGGRAPH_HTTP)
 endif
 
-# Dev/test default: opt in to loopback + http webhooks.
-# ``test_custom_route`` etc use relative URLs to dispatch to my_router.py;
-# ``test_join_*`` / ``test_webhook_payload_on_timeouts`` / ``test_cron_*``
-# and the shutdown suite use ``http://localhost:{port}/webhook`` to a
-# pytest httpserver fixture — all of these are blocked by the secure
-# ``disable_loopback`` default (GHSA-q3v5-r5ch-p57j), and
-# ``require_https`` defaults to true once any webhooks.url block is
-# present, so explicitly disable it for the http httpserver fixture.
-# Production deployers don't use these Makefiles. Override with
-# ``LANGGRAPH_WEBHOOKS=...`` on the command line to exercise the secure
-# default during local development.
-LANGGRAPH_WEBHOOKS ?= {"url": {"disable_loopback": false, "require_https": false}}
-
 LANGGRAPH_STORE ?= ""
 ifeq ($(LANGGRAPH_STORE),custom)
 	STORE_CONFIG := {"path": "./tests/graphs/custom_store.py:generate_store"}
@@ -106,10 +93,10 @@ REVISION ?= $(shell git rev-parse --short HEAD)
 LANGGRAPH_ENCRYPTION ?=
 
 test-license-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
 
 test-watch-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
 
 test: test-license-oss
 test-watch: test-watch-oss
@@ -172,7 +159,6 @@ LANGSMITH_TRACING ?= false
 
 start:
 	LANGGRAPH_DISABLE_FILE_PERSISTENCE=$(LANGGRAPH_DISABLE_FILE_PERSISTENCE) \
-	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \
@@ -200,7 +186,6 @@ start:
 start-license-oss: start
 
 start-encrypt:
-	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.9.0.dev6
+Version: 0.9.1
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE
@@ -16,7 +16,7 @@ Requires-Dist: jsonschema-rs<0.45,>=0.20.0
 Requires-Dist: langchain-core>=0.3.64
 Requires-Dist: langchain-protocol<0.1,>=0.0.15
 Requires-Dist: langgraph-checkpoint<5,>=3.0.1
-Requires-Dist: langgraph-runtime-inmem<0.29.0,>=0.28.0
+Requires-Dist: langgraph-runtime-inmem<0.30.0,>=0.29.0
 Requires-Dist: langgraph-sdk>=0.3.5
 Requires-Dist: langgraph<2,>=0.4.10
 Requires-Dist: langsmith[otel]>=0.6.3
@@ -50,7 +50,7 @@ For production use, see the various [deployment options](https://langchain-ai.gi
 Install the `langgraph-cli` package with the `inmem` extra. Your CLI version must be no lower than `0.1.55`.
 
 ```bash
-pip install -U "langgraph-cli[inmem]"
+pip install -U langgraph-cli[inmem]
 ```
 
 ## Quickstart

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/README.md

@@ -9,7 +9,7 @@ For production use, see the various [deployment options](https://langchain-ai.gi
 Install the `langgraph-cli` package with the `inmem` extra. Your CLI version must be no lower than `0.1.55`.
 
 ```bash
-pip install -U "langgraph-cli[inmem]"
+pip install -U langgraph-cli[inmem]
 ```
 
 ## Quickstart

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/benchmark/continuous/uv.lock

@@ -98,11 +98,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.15"
+version = "3.11"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
 ]
 
 [[package]]

langgraph_api-0.9.1/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.9.1"

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/api/runs.py

@@ -853,19 +853,6 @@ async def create_thread_cron(request: ApiRequest):
     return ApiResponse(cron_dict)
 
 
-@retry_db
-async def get_cron(request: ApiRequest) -> ApiResponse:
-    """Get a cron by ID."""
-    cron_id = request.path_params["cron_id"]
-    validate_uuid(cron_id, "Invalid cron ID: must be a UUID")
-    async with connect() as conn:
-        cron = await Crons.get(conn, cron_id)
-    cron_dict = await fetchone(cron)
-    if not IS_POSTGRES_OR_GRPC_BACKEND or using_aes_encryption():
-        cron_dict = await decrypt_response(cron_dict, "cron", CRON_ENCRYPTION_FIELDS)
-    return ApiResponse(cron_dict)
-
-
 @retry_db
 async def patch_cron(request: ApiRequest):
     """Update a cron by ID."""
@@ -1005,7 +992,6 @@ runs_routes = [
     ApiRoute("/threads/{thread_id}/runs", create_run, methods=["POST"]),
     ApiRoute("/threads/{thread_id}/runs/crons", create_thread_cron, methods=["POST"]),
     ApiRoute("/threads/{thread_id}/runs", list_runs, methods=["GET"]),
-    ApiRoute("/runs/crons/{cron_id}", get_cron, methods=["GET"]),
     ApiRoute("/runs/crons/{cron_id}", patch_cron, methods=["PATCH"]),
     ApiRoute("/runs/crons/{cron_id}", delete_cron, methods=["DELETE"]),
 ]

langgraph_api-0.9.1/langgraph_api/asgi_transport.py

@@ -0,0 +1,173 @@
+"""ASGI transport that lets you schedule to the main loop.
+
+Adapted from: https://github.com/encode/httpx/blob/6c7af967734bafd011164f2a1653abc87905a62b/httpx/_transports/asgi.py#L1
+"""
+
+from __future__ import annotations
+
+import asyncio
+import typing
+
+from httpx import ASGITransport as ASGITransportBase
+from httpx import AsyncByteStream, Request, Response
+
+if typing.TYPE_CHECKING:  # pragma: no cover
+    import trio  # type: ignore[unresolved-import]
+
+    Event = asyncio.Event | trio.Event
+
+__all__ = ["ASGITransport"]
+
+
+def is_running_trio() -> bool:
+    try:
+        # sniffio is a dependency of trio.
+
+        # See https://github.com/python-trio/trio/issues/2802
+        import sniffio  # type: ignore[unresolved-import]  # noqa: PLC0415
+
+        if sniffio.current_async_library() == "trio":
+            return True
+    except ImportError:  # pragma: nocover
+        pass
+
+    return False
+
+
+def create_event() -> Event:
+    if is_running_trio():
+        import trio  # type: ignore[unresolved-import]  # noqa: PLC0415
+
+        return trio.Event()
+
+    return asyncio.Event()
+
+
+class ASGIResponseStream(AsyncByteStream):
+    def __init__(self, body: list[bytes]) -> None:
+        self._body = body
+
+    async def __aiter__(self) -> typing.AsyncIterator[bytes]:
+        yield b"".join(self._body)
+
+
+class ASGITransport(ASGITransportBase):
+    """
+    A custom AsyncTransport that handles sending requests directly to an ASGI app.
+
+    ```python
+    transport = httpx.ASGITransport(
+        app=app,
+        root_path="/submount",
+        client=("1.2.3.4", 123)
+    )
+    client = httpx.AsyncClient(transport=transport)
+    ```
+
+    Arguments:
+
+    * `app` - The ASGI application.
+    * `raise_app_exceptions` - Boolean indicating if exceptions in the application
+       should be raised. Default to `True`. Can be set to `False` for use cases
+       such as testing the content of a client 500 response.
+    * `root_path` - The root path on which the ASGI application should be mounted.
+    * `client` - A two-tuple indicating the client IP and port of incoming requests.
+    ```
+    """
+
+    async def handle_async_request(
+        self,
+        request: Request,
+    ) -> Response:
+        from langgraph_api.asyncio import call_soon_in_main_loop  # noqa: PLC0415
+
+        if not isinstance(request.stream, AsyncByteStream):
+            raise ValueError("Request stream must be an AsyncByteStream")
+
+        # ASGI scope.
+        scope = {
+            "type": "http",
+            "asgi": {"version": "3.0"},
+            "http_version": "1.1",
+            "method": request.method,
+            "headers": [(k.lower(), v) for (k, v) in request.headers.raw],
+            "scheme": request.url.scheme,
+            "path": request.url.path,
+            "raw_path": request.url.raw_path.split(b"?")[0],
+            "query_string": request.url.query,
+            "server": (request.url.host, request.url.port),
+            "client": self.client,
+            "root_path": self.root_path,
+        }
+
+        # Request.
+        request_body_chunks = request.stream.__aiter__()
+        request_complete = False
+
+        # Response.
+        status_code = None
+        response_headers = None
+        body_parts = []
+        response_started = False
+        response_complete = create_event()
+
+        # ASGI callables.
+
+        async def receive() -> dict[str, typing.Any]:
+            nonlocal request_complete
+
+            if request_complete:
+                await response_complete.wait()
+                return {"type": "http.disconnect"}
+
+            try:
+                body = await request_body_chunks.__anext__()
+            except StopAsyncIteration:
+                request_complete = True
+                return {"type": "http.request", "body": b"", "more_body": False}
+            return {"type": "http.request", "body": body, "more_body": True}
+
+        async def send(message: typing.MutableMapping[str, typing.Any]) -> None:
+            nonlocal status_code, response_headers, response_started
+
+            if message["type"] == "http.response.start":
+                if response_started:
+                    raise RuntimeError("Response already started")
+                status_code = message["status"]
+                response_headers = message.get("headers", [])
+                response_started = True
+
+            elif message["type"] == "http.response.body":
+                if response_complete.is_set():
+                    raise RuntimeError("Response already complete")
+                body = message.get("body", b"")
+                more_body = message.get("more_body", False)
+
+                if body and request.method != "HEAD":
+                    body_parts.append(body)
+
+                if not more_body:
+                    response_complete.set()
+
+        try:
+            await call_soon_in_main_loop(self.app(scope, receive, send))
+        except Exception:
+            if self.raise_app_exceptions:
+                raise
+
+            response_complete.set()
+            if status_code is None:
+                status_code = 500
+            if response_headers is None:
+                response_headers = {}
+
+        if not response_complete.is_set():
+            raise RuntimeError("Response not complete")
+        if status_code is None:
+            raise RuntimeError("Status code not set")
+        if response_headers is None:
+            raise RuntimeError("Response headers not set")
+
+        stream = ASGIResponseStream(body_parts)
+
+        return Response(status_code, headers=response_headers, stream=stream)

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/config/schemas.py

@@ -386,26 +386,7 @@ class WebhookUrlPolicy(TypedDict, total=False):
     max_url_length: int
     """Maximum permitted URL length in characters; longer inputs are rejected early."""
     disable_loopback: bool
-    """Disallow loopback-flavored webhook targets when true. Defaults to true.
-
-    Covers all of:
-    - Relative URLs (e.g. ``/internal/hook``) that would dispatch via the
-      in-process ASGI loopback transport at ``root_path="/noauth"``. These
-      bypass authentication and were the auth-bypass primitive behind
-      GHSA-q3v5-r5ch-p57j.
-    - Absolute URLs whose hostname is ``localhost`` / ``localhost.localdomain``
-      / ``host.docker.internal``.
-    - Absolute URLs that DNS-resolve into the IPv4 loopback range
-      (``127.0.0.0/8``) or IPv6 loopback (``::1/128``) — including
-      DNS-rebinding-style attacks where an arbitrary hostname resolves to
-      a loopback IP.
-
-    Operators who intentionally route webhooks to in-process routes
-    (e.g. for local development with ``langgraph dev``, or single-host
-    docker-compose setups dispatching to ``host.docker.internal``) can
-    set this to ``false`` to restore the pre-GHSA behavior. Only do this
-    when you control all routes that loopback webhooks can reach.
-    """
+    """Disallow relative URLs (internal loopback calls) and localhost hostnames when true."""
     disable_private_ips: bool
     """Block RFC 1918 / CGN private IP ranges as webhook targets when true.
 
@@ -445,12 +426,7 @@ def _validate_url_policy(
     if "max_url_length" not in policy:
         policy["max_url_length"] = 2048
     if "disable_loopback" not in policy:
-        # Secure default — covers GHSA-q3v5-r5ch-p57j (relative-URL ASGI
-        # loopback auth bypass) and the broader SSRF surface that the same
-        # flag governs via SSRFPolicy.block_localhost. Mirrored at the
-        # webhook.py read site so deployments without any webhooks block
-        # also get the safe default.
-        policy["disable_loopback"] = True
+        policy["disable_loopback"] = False
     if "disable_private_ips" not in policy:
         policy["disable_private_ips"] = False
     return policy

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/cron_scheduler.py

@@ -54,7 +54,7 @@ async def cron_scheduler():
     logger.info("Starting cron scheduler")
     while True:
         try:
-            async with connect() as conn:
+            async with connect(supports_core_api=False) as conn:
                 async for item in Crons.next(conn):
                     # gRPC path yields (cron, enc_ctx) tuples;
                     # non-gRPC path yields plain Cron dicts.

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/event_streaming/service.py

@@ -749,23 +749,14 @@ class ThreadRunManager:
         async def get_thread_state() -> dict[str, Any] | None:
             from langgraph_runtime.database import connect  # noqa: PLC0415
 
-            # ``supports_core_api=False`` so the postgres backend yields a
-            # real connection. ``State.get`` uses the local checkpointer
-            # and needs a usable ``conn`` — the default flag yields None.
             try:
-                async with connect(supports_core_api=False) as conn:
+                async with connect() as conn:
                     return await self._threads.State.get(
                         conn,
                         {"configurable": {"thread_id": thread_id}},
                         subgraphs=True,
                     )
-            except Exception as exc:
-                logger.warning(
-                    "terminal_thread_state_fetch_failed",
-                    thread_id=thread_id,
-                    error=str(exc),
-                    error_type=type(exc).__name__,
-                )
+            except Exception:
                 return None
 
         return get_thread_state
@@ -864,25 +855,14 @@ class ThreadRunManager:
         """
         from langgraph_runtime.database import connect  # noqa: PLC0415
 
-        # ``supports_core_api=False`` so the postgres backend yields a
-        # real connection. The default (``True``) yields ``None`` because
-        # data ops normally go through the gRPC server — but ``State.get``
-        # uses the local checkpointer and needs a usable ``conn``.
         try:
-            async with connect(supports_core_api=False) as conn:
+            async with connect() as conn:
                 state = await self._threads.State.get(
                     conn,
                     {"configurable": {"thread_id": self._thread_id}},
                     subgraphs=True,
                 )
-        except Exception as exc:
-            logger.warning(
-                "interrupt_lookup_failed",
-                thread_id=self._thread_id,
-                interrupt_id=interrupt_id,
-                error=str(exc),
-                error_type=type(exc).__name__,
-            )
+        except Exception:
             return None
 
         tasks = (
@@ -923,7 +903,7 @@ class ThreadRunManager:
         from langgraph_runtime.database import connect  # noqa: PLC0415
 
         try:
-            async with connect(supports_core_api=False) as conn:
+            async with connect() as conn:
                 state = await self._threads.State.get(
                     conn,
                     {"configurable": {"thread_id": self._thread_id}},
@@ -949,13 +929,7 @@ class ThreadRunManager:
                 if isinstance(interrupts, (list, tuple)) and len(interrupts) > 0:
                     return True
             return False
-        except Exception as exc:
-            logger.warning(
-                "has_pending_interrupts_failed",
-                thread_id=self._thread_id,
-                error=str(exc),
-                error_type=type(exc).__name__,
-            )
+        except Exception:
             return False
 
     # ------------------------------------------------------------------

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/grpc/ops/crons.py

@@ -230,14 +230,10 @@ class Crons(Authenticated):
 
         assistant_filters: list[Any] = []
         if payload["assistant_id"] not in SYSTEM_ASSISTANT_IDS:
-            # Do not populate `metadata` on the AssistantsRead request value:
-            # client-supplied cron metadata must not influence the auth
-            # decision (defense vs. forged payloads), mirroring Runs.put.
-            # The handler is expected to return a filter that is matched
-            # against the persisted assistant metadata server-side.
             assistant_request_data = Auth.types.AssistantsRead(
                 assistant_id=str(payload["assistant_id"])
             )
+            assistant_request_data["metadata"] = metadata
             assistant_filters = await Assistants.handle_event(
                 ctx, "read", assistant_request_data
             )
@@ -278,32 +274,6 @@ class Crons(Authenticated):
 
         return generate_result()
 
-    @staticmethod
-    async def get(
-        conn,  # Not used in gRPC implementation
-        cron_id: UUID | str,
-        ctx: Any = None,
-    ) -> AsyncIterator[Cron]:
-        """Get cron by ID via gRPC."""
-        auth_filters = await Crons.handle_event(
-            ctx, "read", Auth.types.CronsRead(cron_id=cron_id)
-        )
-
-        request = pb.GetCronRequest(
-            cron_id=pb.UUID(value=str(cron_id)),
-            filters=auth_filters,
-        )
-
-        client = await get_shared_client()
-        response = await client.crons.Get(request)
-
-        cron = proto_to_cron(response)
-
-        async def generate_result():
-            yield cron
-
-        return generate_result()
-
     @staticmethod
     async def search(
         conn,  # Not used in gRPC implementation

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/grpc/ops/runs.py

@@ -610,19 +610,18 @@ class Runs(Authenticated):
             create_run_value,
         )
         # Automatically enforce assistant ownership for non-system assistants
-        # by calling the user's assistant read auth handler.
+        # by calling the user's assistant search auth handler.
         assistant_auth_filters: list[pb.AuthFilter] = []
         if str(assistant_id) not in SYSTEM_ASSISTANT_IDS:
             ctx_ = ctx or get_auth_ctx()
             if ctx_ is not None:
                 auth_ctx = Auth.types.AuthContext(
                     resource="assistants",
-                    action="read",
+                    action="search",
                     user=ctx_.user,
                     permissions=ctx_.permissions,
                 )
-                read_value = Auth.types.AssistantsRead(assistant_id=str(assistant_id))
-                raw = await auth_handle_event(auth_ctx, read_value)
+                raw = await auth_handle_event(auth_ctx, {"metadata": {}})
                 if raw:
                     assistant_auth_filters = _filters_to_proto(raw)
 

{langgraph_api-0.9.0.dev6 → langgraph_api-0.9.1}/langgraph_api/webhook.py

@@ -79,14 +79,7 @@ def _get_webhook_config() -> _WebhookConfig:
     exact_allowed = frozenset(exact_hosts)
 
     disable_private_ips = bool(policy_cfg.get("disable_private_ips", False))
-    # Loopback webhooks are denied by default (covers relative URLs that
-    # would dispatch through the in-process ASGI client at root_path=/noauth,
-    # plus localhost / 127.x / ::1 / host.docker.internal absolute URLs,
-    # plus any hostname that DNS-resolves into the loopback range). This is
-    # the fix for GHSA-q3v5-r5ch-p57j: relative-URL webhooks were the auth
-    # bypass primitive, and the localhost/loopback IP variants are the
-    # broader SSRF surface that the same flag governs via SSRFPolicy.
-    disable_loopback = bool(policy_cfg.get("disable_loopback", True))
+    disable_loopback = bool(policy_cfg.get("disable_loopback", False))
 
     return _WebhookConfig(
         allowed_domains=allowed_domains,
@@ -118,26 +111,11 @@ async def validate_webhook_url_or_raise(url: str) -> None:
     if len(url) > wh.max_url_length:
         raise HTTPException(status_code=422, detail="Webhook URL too long")
 
-    # Relative loopback URL (internal route) — dispatched via an in-process
-    # ASGI client that mounts under root_path="/noauth", which the auth
-    # middleware treats as an auth-bypass marker. Denied by default so a
-    # user-supplied webhook URL cannot be turned into an unauthenticated
-    # call against the server's own routes (GHSA-q3v5-r5ch-p57j). Operators
-    # who intentionally route webhooks to in-process routes can opt back in
-    # by setting webhooks.url.disable_loopback to false.
+    # Relative loopback URL (internal route) — not subject to SSRF checks
     if url.startswith("/"):
         if wh.disable_loopback:
             raise HTTPException(
-                status_code=422,
-                detail=(
-                    "Loopback webhooks (relative URLs and localhost) are "
-                    "disabled by default. They bypass authentication via the "
-                    "in-process ASGI transport and can be abused to invoke "
-                    "internal routes as an unauthenticated caller. Set "
-                    "webhooks.url.disable_loopback to false (in langgraph.json "
-                    "or via LANGGRAPH_WEBHOOKS) to opt back in — only do so "
-                    "when you control the mounted routes."
-                ),
+                status_code=422, detail="Loopback webhooks are disabled"
             )
         return