chore(deps): update dependency langsmith to v0.8.18 [security]

[a-klos]

This PR contains the following updates:

Package	Change	Age	Confidence
langsmith	0.8.8 -> 0.8.18

GitHub Vulnerability Alerts

GHSA-f4xh-w4cj-qxq8

Summary

An attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary.

Impact

Confidentiality (High): arbitrary read of files accessible to the server process, exposed to anyone with workspace trace-read access.

Details

Two defects combine. A field supplied through a tracing-propagation header was merged into the run without validation, allowing injection of run attributes including attachments (CWE-346). A type check intended to gate filesystem access did not match the type of the decoded input, so the guard never engaged (CWE-843). As a result, an attacker-named file is opened by the server and uploaded as a trace attachment by the background tracing thread (CWE-22).

Who can exploit this

• Anyone reachable by HTTP can trigger the file read. Depending on how the distributed trace system is deployed, triggering may not require authentication.
• Retrieving the file contents requires read access to the destination LangSmith workspace. The upload uses the server's own configured API key and workspace, which the attacker cannot redirect, so a zero-access outsider cannot retrieve the result; a workspace member, or anyone who has compromised one, can.

Remediation

Upgrade the Python SDK to >= 0.8.18.

Workarounds

Until upgrading, do not expose TracingMiddleware to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.

Credits

First reported by @​Ryu7zz.

---

Release Notes

langchain-ai/langsmith-sdk (langsmith)

v0.8.18

Compare Source

What's Changed

• chore(deps-dev): bump vitest from 3.2.4 to 3.2.6 in /js by @​dependabot[bot] in #​3002
• chore(deps): bump pyjwt from 2.12.1 to 2.13.0 in /python by @​dependabot[bot] in #​3030
• chore(deps): bump python-multipart from 0.0.27 to 0.0.31 in /python by @​dependabot[bot] in #​3036
• chore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python by @​dependabot[bot] in #​3037
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python by @​dependabot[bot] in #​3038
• chore(deps): bump starlette from 1.0.1 to 1.3.1 in /python by @​dependabot[bot] in #​3039
• chore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python by @​dependabot[bot] in #​3044
• chore(deps): bump the npm_and_yarn group across 4 directories with 4 updates by @​dependabot[bot] in #​3046
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @​dependabot[bot] in #​3060
• test(python): fix integration assertions for updated attachment error message by @​QuentinBrosse in #​3061
• chore: reconcile bumpversion config and mandate release process for agents by @​QuentinBrosse in #​3062
• release(py): 0.8.18 by @​QuentinBrosse in #​3063

Full Changelog: langchain-ai/langsmith-sdk@v0.8.17...v0.8.18

v0.8.17

Compare Source

What's Changed

• feat: expose the resources from the generated openapi client in the langsmith client by @​sineha-mani in #​3018
• feat(js): port isTracingEnabled utility from Python by @​dqbd in #​3032
• Add sandbox mount support to JS SDK by @​DanielKneipp in #​3010
• release(js): bump to 0.7.9 by @​dqbd in #​3035
• Add sandbox mount support to Python SDK by @​DanielKneipp in #​3009
• docs: note that _openapi_client directories are auto-generated by @​KiewanVillatel in #​3034
• fix: update JS SDK type declarations with skipLibCheck disabled by @​sineha-mani in #​3043
• release(js): 0.7.10 by @​dqbd in #​3045
• feat: adding python async for online evals by @​sineha-mani in #​3048
• Add sandbox Git mount SDK helpers by @​DanielKneipp in #​3040
• fix: use insights tab in sdk report links [closes LSO-2936] by @​eric-langchain in #​3050
• feat(client): warn when backend version is below minimum required by @​KiewanVillatel in #​3041
• chore: bump _MIN_BACKEND_VERSION to 0.16.5rc1 by @​langtions-bot[bot] in #​3053
• fix(sandbox): use built-in gcp auth host matching by @​DanielKneipp in #​3055
• chore(python): py to 0.8.17 by @​sineha-mani in #​3056

New Contributors

• @​sineha-mani made their first contribution in #​3018
• @​eric-langchain made their first contribution in #​3050

Full Changelog: langchain-ai/langsmith-sdk@v0.8.16...v0.8.17

v0.8.16

Compare Source

What's Changed

• feat(py): add sync/async conversion for Sandbox and SandboxClient [INF-0000] by @​ramon-langchain in #​3019
• fix(experiments): extract keys from wrapped evaluator function by @​shamikkarkhanis in #​3014
• chore: repoint support@langchain.dev mentions to the Support Portal by @​lutan-langchain in #​3024
• fix(python): derive create_child run id from start_time [LSDK-220] by @​harisaiharish in #​3027
• chore: sync langsmith_api by @​langtions-bot[bot] in #​3020
• chore: js to 0.7.8 and py to 0.8.16 by @​shamikkarkhanis in #​3029

New Contributors

• @​lutan-langchain made their first contribution in #​3024

Full Changelog: langchain-ai/langsmith-sdk@v0.8.15...v0.8.16

v0.8.15

Compare Source

What's Changed

• chore(js): exclude generated _openapi_client from linters and type-checker by @​KiewanVillatel in #​3015
• chore: sync langsmith_api by @​langtions-bot[bot] in #​3006
• chore: protect JS openapi client in workflow by @​KiewanVillatel in #​3017
• fix(js): deliver sandbox output callbacks across stream reconnects by @​langchain-infra in #​3022
• fix(python): deliver sandbox output callbacks across stream reconnects by @​langchain-infra in #​3023
• chore: bump JS to 0.7.7 and Python to 0.8.15 by @​langchain-infra in #​3025

Full Changelog: langchain-ai/langsmith-sdk@v0.8.14...v0.8.15

v0.8.14

Compare Source

What's Changed

• feat: add deepagent compatibility smoke tests to Python and JS CI [LSDK-214] by @​QuentinBrosse in #​2997
• chore(py): bump Python SDK to 0.8.14 by @​vishnu-ssuresh in #​3013

Full Changelog: langchain-ai/langsmith-sdk@v0.8.13...v0.8.14

v0.8.12

Compare Source

What's Changed

• ci: protect _openapi_client from unauthorized changes by @​KiewanVillatel in #​2999
• fix: gemini double counting of over 200k tokens by @​dqbd in #​3003
• feat(python): cross-process OAuth refresh filesystem lock by @​langchain-infra in #​2988
• feat(js): cross-process OAuth refresh filesystem lock by @​langchain-infra in #​2989
• fix: avoid duplicate /v1 in hub URLs when endpoint includes /api/v1 by @​langchain-infra in #​3008
• chore: bump JS to 0.7.6 and Python to 0.8.12 by @​langchain-infra in #​3011

Full Changelog: langchain-ai/langsmith-sdk@v0.8.11...v0.8.12

v0.8.11

Compare Source

What's Changed

• fix: match async feedback client to sync behavior [LSEN-206] by @​vishnu-ssuresh in #​3001

Full Changelog: langchain-ai/langsmith-sdk@v0.8.10...v0.8.11

v0.8.10

Compare Source

What's Changed

• feat(sandbox): size the dockerfile-build sandbox via vCpus/memBytes (js) by @​langchain-infra in #​2980
• feat(python): support trace_id and retry-on-NotFound in async create_… by @​baskaryan in #​2963
• feat(python): expose pairwise comparison URL on ComparativeExperimentResults [LSE-2270] by @​harisaiharish in #​2975
• feat(js): exposed pairwise comparison URL on ComparativeExperimentResults [LSE-2374] by @​harisaiharish in #​2981
• feat(python): expose LS_MESSAGE_VIEW_EXCLUDE constant [lso-2605] by @​ybathula707 in #​2982
• feat: support JS prompt commit tags by @​langchain-infra in #​2987
• fix(lint): exclude _openapi_client from ruff by @​KiewanVillatel in #​2993
• chore: sync langsmith_api by @​langtions-bot[bot] in #​2911
• fix(lint): exclude _openapi_client from mypy by @​KiewanVillatel in #​2995
• chore: sync langsmith_api by @​langtions-bot[bot] in #​2994
• Add AWS auth proxy helpers to Python SDK by @​DanielKneipp in #​2991
• Add AWS auth proxy helpers to JS SDK by @​DanielKneipp in #​2992
• feat(evaluation): adding examples and repetitions to create tracer sessions calls by @​shamikkarkhanis in #​2954
• chore(deps): bump astral-sh/setup-uv from 94527f2 to 37802ad by @​dependabot[bot] in #​2968
• chore(deps): bump pnpm/action-setup from ac6db6d to 0e279bb by @​dependabot[bot] in #​2970
• chore(deps-dev): bump types-psutil from 7.2.2.20260408 to 7.2.2.20260518 in /python by @​dependabot[bot] in #​2974
• chore(deps): bump starlette from 0.52.1 to 1.0.1 in /python by @​dependabot[bot] in #​2984
• chore(deps-dev): bump types-requests from 2.33.0.20260408 to 2.33.0.20260518 in /python by @​dependabot[bot] in #​2973
• chore(deps): bump the py-minor-and-patch group across 1 directory with 12 updates by @​dependabot[bot] in #​2998
• chore(deps): bump the py-major group across 1 directory with 4 updates by @​dependabot[bot] in #​2996
• chore(deps): bump gaurav-nelson/github-action-markdown-link-check from 499c1e7 to 5c5dfc0 by @​dependabot[bot] in #​2969
• chore(deps): bump aiohttp from 3.13.5 to 3.14.0 in /python by @​dependabot[bot] in #​2983
• chore(deps-dev): bump @​jest/globals from 29.7.0 to 30.4.1 in /js by @​dependabot[bot] in #​2807
• release(py): 0.8.10 by @​baskaryan in #​3000

New Contributors

• @​harisaiharish made their first contribution in #​2975
• @​ybathula707 made their first contribution in #​2982
• @​langtions-bot[bot] made their first contribution in #​2911
• @​shamikkarkhanis made their first contribution in #​2954

Full Changelog: langchain-ai/langsmith-sdk@v0.8.9...v0.8.10

v0.8.9

Compare Source

What's Changed

• feat(sandbox): add JS Dockerfile snapshots by @​langchain-infra in #​2951
• chore(deps-dev): bump the js-minor-and-patch group across 1 directory with 11 updates by @​dependabot[bot] in #​2931
• chore(deps): bump websockets from 15.0.1 to 16.0 in /python by @​dependabot[bot] in #​2811
• chore(deps): update myst-parser requirement from >=3 to >=4.0.1 in /python by @​dependabot[bot] in #​2841
• chore(deps): bump the py-minor-and-patch group across 1 directory with 19 updates by @​dependabot[bot] in #​2934
• chore(deps): bump typescript from 5.9.3 to 6.0.3 in /js by @​dependabot[bot] in #​2839
• chore(deps-dev): bump google-adk from 1.10.0 to 2.1.0 in /python by @​dependabot[bot] in #​2960
• chore(deps-dev): bump wrapt from 1.17.3 to 2.2.1 in /python by @​dependabot[bot] in #​2961
• chore(deps-dev): bump the py-minor-and-patch group in /python with 6 updates by @​dependabot[bot] in #​2958
• chore(deps-dev): bump types-tqdm from 4.67.3.20260408 to 4.67.3.20260518 in /python by @​dependabot[bot] in #​2959
• ci: add minimum workflow permissions by @​jkennedyvz in #​2967
• chore: update dependabot.yml to comply with posture checks by @​jkennedyvz in #​2966
• test(python): deflake test_tracing_queue_limit_drops_when_full by @​baskaryan in #​2964
• feat(sandbox): size the dockerfile-build sandbox via vcpus/mem_bytes (python) by @​langchain-infra in #​2979

Full Changelog: langchain-ai/langsmith-sdk@v0.8.8...v0.8.9

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.