Skip to content

fix(langgraph): validate Zod state updates from nodes#2520

Merged
Christian Bromann (christian-bromann) merged 2 commits into
mainfrom
cb/fix-zod-state-update-validation
Jun 10, 2026
Merged

fix(langgraph): validate Zod state updates from nodes#2520
Christian Bromann (christian-bromann) merged 2 commits into
mainfrom
cb/fix-zod-state-update-validation

Conversation

@christian-bromann

Copy link
Copy Markdown
Member

Summary

  • Validates StateGraph node return values and Command updates against Zod state schema constraints before applying writes.
  • Preserves Overwrite behavior by validating reducer overwrites against stored value schemas.
  • Adds regression coverage for invalid Zod node returns and Command updates.

Fixes #2519

Validate node return values before applying them to graph state so
Zod constraints are enforced consistently for direct updates and Commands.
@changeset-bot

changeset-bot Bot commented Jun 10, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: de2b41f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages
Name Type
@langchain/langgraph Patch
@example/ai-elements Patch
@examples/assistant-ui-claude Patch
@examples/ui-angular Patch
@examples/ui-multimodal Patch
@examples/ui-react Patch
langgraph Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Jun 10, 2026

Copy link
Copy Markdown

Open in StackBlitz

@langchain/langgraph-checkpoint

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint@2520

@langchain/langgraph-checkpoint-mongodb

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint-mongodb@2520

@langchain/langgraph-checkpoint-postgres

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint-postgres@2520

@langchain/langgraph-checkpoint-redis

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint-redis@2520

@langchain/langgraph-checkpoint-sqlite

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint-sqlite@2520

@langchain/langgraph-checkpoint-validation

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-checkpoint-validation@2520

create-langgraph

npm i https://pkg.pr.new/langchain-ai/langgraphjs/create-langgraph@2520

@langchain/langgraph-api

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-api@2520

@langchain/langgraph-cli

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-cli@2520

@langchain/langgraph

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph@2520

@langchain/langgraph-cua

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-cua@2520

@langchain/langgraph-supervisor

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-supervisor@2520

@langchain/langgraph-swarm

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-swarm@2520

@langchain/langgraph-ui

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-ui@2520

@langchain/langgraph-sdk

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/langgraph-sdk@2520

@langchain/angular

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/angular@2520

@langchain/react

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/react@2520

@langchain/svelte

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/svelte@2520

@langchain/vue

npm i https://pkg.pr.new/langchain-ai/langgraphjs/@langchain/vue@2520

commit: de2b41f

@open-swe open-swe Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Open SWE Review found 1 potential issue.

Open in WebView Open SWE trace

Comment thread libs/langgraph-core/src/graph/state.ts Outdated
@christian-bromann Christian Bromann (christian-bromann) changed the title fix(state): validate Zod state updates from nodes fix(langgraph): validate Zod state updates from nodes Jun 10, 2026
@christian-bromann Christian Bromann (christian-bromann) merged commit 2da5c33 into main Jun 10, 2026
30 checks passed
@christian-bromann Christian Bromann (christian-bromann) deleted the cb/fix-zod-state-update-validation branch June 10, 2026 22:56
Christian Bromann (christian-bromann) pushed a commit that referenced this pull request Jun 11, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @langchain/langgraph-supervisor@1.1.0

### Minor Changes

- [#2521](#2521)
[`56682a6`](56682a6)
Thanks [@open-swe](https://github.com/apps/open-swe)! -
feat(langgraph-supervisor): Add `addHandoffMessages` to
`createSupervisor` and `createHandoffTool`, allowing supervisor-to-agent
handoff bookkeeping messages to be omitted from the expert agent's
message history. When `addHandoffBackMessages` is not provided, it now
defaults to the same value as `addHandoffMessages`, matching the Python
package behavior.

`createHandoffTool` now also accepts `description` as the preferred
option name while continuing to support the existing `agentDescription`
option as deprecated for backwards compatibility.

### Patch Changes

- [#2407](#2407)
[`59d4765`](59d4765)
Thanks [@pragnyanramtha](https://github.com/pragnyanramtha)! - Normalize
all whitespace in supervisor handoff tool names.

## @langchain/langgraph@1.4.1

### Patch Changes

- [#2520](#2520)
[`2da5c33`](2da5c33)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(state): validate Zod state updates from nodes

Validate node return values and Command updates against Zod state schema
    constraints before applying them to graph state.

Fixes [#2519](#2519)

- [#2511](#2511)
[`ef04db3`](ef04db3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(ToolNode): forward graph state to tools via `runtime.state`

`ToolNode` now forwards its input to each tool through the second
argument as `runtime.state`. When using `ToolNode` as a node in a
LangGraph graph, this gives tools access to the current graph state for
workflows that need tool-call support in LangGraph proper. Tools can
type the second parameter as `ToolRuntime<StateType>` from
`@langchain/core/tools` and read `runtime.state` directly. This works in
every runtime, including web browsers, and removes the need for
`getCurrentTaskInput()` (which relies on
`node:async_hooks`/`AsyncLocalStorage`). `getCurrentTaskInput(config)`
continues to work for backwards compatibility.

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/langgraph-sdk@1.9.21

### Patch Changes

- [#2522](#2522)
[`3855985`](3855985)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- [#2523](#2523)
[`7c3e9e9`](7c3e9e9)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): stop re-streaming seeded messages on idle-thread submit

An idle (finished) thread defers its root SSE pump, so the first
`submit()` brings it up and the transport replays the finished run from
`seq=0`. The replayed `messages` channel carries no step (unlike
`values`, guarded by `maxStep`), so it rebuilt each already-complete
message from an empty `message-start` and re-streamed the whole turn
token-by-token — a visible "messages replay" of the existing
conversation. Seal the message ids seeded from the idle `getState()`
snapshot so replayed deltas can't downgrade the complete tail; the seal
lifts once a newer checkpoint advances the timeline or on thread rebind,
and ids from the next run are never sealed.

- [#2462](#2462)
[`17c44a3`](17c44a3)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
fix(sdk): reconnect v2 SSE and WebSocket thread streams after disconnect

Add automatic reconnect with resume (`since` for SSE) for protocol
transports,
wire `AsyncCaller` through `client.threads.stream`, and expose optional
reconnect tuning on `ThreadStreamOptions`. Includes integration tests
against
    an in-process mock langgraph-api server.

## @langchain/angular@1.0.22

### Patch Changes

- [#2522](#2522)
[`3855985`](3855985)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/react@1.0.22

### Patch Changes

- [#2522](#2522)
[`3855985`](3855985)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/svelte@1.0.22

### Patch Changes

- [#2522](#2522)
[`3855985`](3855985)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @langchain/vue@1.0.22

### Patch Changes

- [#2522](#2522)
[`3855985`](3855985)
Thanks [@christian-bromann](https://github.com/christian-bromann)! -
feat(stream): add per-event side-effect selector

Add `useChannelEffect` (React/Svelte/Vue) / `injectChannelEffect`
(Angular), a side-effect counterpart to `useChannel` that invokes an
`onEvent` callback once per raw protocol event without re-rendering.
This is the idiomatic v1 replacement for the old `onLangChainEvent` /
`onCustomEvent` callbacks for analytics and logging. Backed by a new
framework-agnostic `acquireChannelEffect` helper in
`@langchain/langgraph-sdk/stream` that shares a ref-counted subscription
with matching `useChannel` consumers.

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21

## @example/ai-elements@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](3855985),
[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/assistant-ui-claude@0.1.37

### Patch Changes

- Updated dependencies
\[[`3855985`](3855985),
[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-angular@0.0.47

### Patch Changes

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/angular@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-multimodal@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](3855985),
[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3)]:
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## @examples/ui-react@0.0.23

### Patch Changes

- Updated dependencies
\[[`3855985`](3855985),
[`7c3e9e9`](7c3e9e9),
[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3),
[`17c44a3`](17c44a3)]:
    -   @langchain/langgraph-sdk@1.9.21
    -   @langchain/react@1.0.22
    -   @langchain/langgraph@1.4.1

## langgraph@1.0.41

### Patch Changes

- Updated dependencies
\[[`2da5c33`](2da5c33),
[`ef04db3`](ef04db3)]:
    -   @langchain/langgraph@1.4.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

StateGraph doesn't validate Node return values against StateSchema constraints

2 participants