[dependabot]

Bumps langgraph from 1.2.11 to 1.2.14.

Release notes

Sourced from langgraph's releases.

langgraph==1.2.14

Changes since 1.2.13

• release(langgraph): 1.2.14 (#9215)

langgraph==1.2.13

Changes since 1.2.12

• fix(langgraph): fork before replaying an update checkpoint the thread moved past (#9170)
• fix(langgraph): keep an update_state on an older checkpoint out of its other branches (#9165)
• fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
• release(langgraph): 1.2.13 (#9205)
• fix(langgraph): don't walk history for a DeltaChannel that was never written (#9141)
• fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8548)
• chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph (#9168)
• fix(langgraph): hydrate subgraph delta channels with the caller-resolved saver (#8538)
• fix(langgraph): stop reporting answered interrupts in get_state (#9103)
• chore(deps-dev): bump the minor-and-patch group across 1 directory with 5 updates (#9155)
• chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 2 updates (#9145)
• chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5 updates (#9149)
• chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/langgraph (#9160)
• chore(deps-dev): bump types-requests from 2.33.0.20260712 to 2.33.0.20260906 in /libs/langgraph (#9156)
• chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph (#9140)
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph (#9138)
• chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph (#9139)
• chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph (#9126)

langgraph==1.2.12

Changes since 1.2.11

• release(langgraph): 1.2.12 (#8987)
• chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (#8958)
• feat(langgraph): add response_schema to interrupt() (#8886)
• fix(langgraph): type undeclared v3 stream projections (#8596)
• chore(langgraph): bump mistune to 3.3.4 (#8804)
• chore(deps): bump the minor-and-patch group across 1 directory with 7 updates (#8779)
• chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (#8782)
• chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (#8792)
• chore(deps): bump the major group in /libs/langgraph with 2 updates (#8783)
• fix(langgraph): detect subgraphs from bytecode instead of source (#8569)

Commits

• 70dd640 release(langgraph): 1.2.14 (#9215)
• 55b0e36 release(sdk-py): 0.4.6 (#9214)
• d89c7e1 fix(sdk-py): percent-encode thread_id and assistant_id in thread stream reque...
• 2d94208 fix(langgraph): fork before replaying an update checkpoint the thread moved p...
• 456e2b1 fix(langgraph): keep an update_state on an older checkpoint out of its other ...
• 1b84cb0 fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
• 8e15e0d release(langgraph): 1.2.13 (#9205)
• 524b320 fix(langgraph): don't walk history for a DeltaChannel that was never written ...
• 9a0394d fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8...
• 7dc9195 chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph (#9168)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Updates langgraph from 1.2.11 to 1.2.14 and langgraph-sdk from 0.4.4 to 0.4.10 in uv.lock. The release includes fixes for checkpoint replay and DeltaChannel handling, and adds a response_schema option to interrupt().

^{Written for commit 7f8d958. Summary will update on new commits.}

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[glebedel]

s2d2 verdict: SAFE. lock-only langgraph patch, CI green, not imported.

• CI on 7f8d958: green
• Breaking changes reaching our code: none
• Call sites: not imported (transitive of langchain)
• Security: open Dependabot alert(s), max severity medium

uv.lock only (8/8): langgraph 1.2.11 to 1.2.14 (and siblings). Fixes CVE-2026-118667. examples use langchain.agents.create_agent only. ci 3.11/3.12/3.13, conformance, ci-ok pass.

Requested by guillaume@stackone.com, Security Autopilot run sa-2026-11-05-ae4daeb6. s2d2 never approves PRs.