AI Coding Live News

LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.

Zoom

On Oct 13 ScaleDown launched Constrained Decoding Models (CDMs): each model is trained for a single task and only returns answers that task allows (a label or spans of the input) instead of free-form token-by-token generation. LangChain shipped a langchain-scaledown integration and LangSmith LLM Gateway support the same day, with middleware for history summarization, tool-result compression and structured extraction. ScaleDown claims 200x faster and 467x cheaper than frontier models on these narrow tasks; Extract and Summarize are on OpenRouter at $0.04 per million input tokens.

Zoom

LangSmith SDK v0.14.2 (2026-09-30): Python ls.address (#3581), JS OTel tool fields (#3592), primary replica keeps original run ids (#3623).

Zoom

LangChain shipped langchain-openai==1.6.7 on 2026-09-30: PR #40532 auto-discovers Azure Workload Identity for AzureChatOpenAI; optional azure-identity extra; explicit credentials still win.

Zoom

LangChain shipped langchain-anthropic==1.7.5 and langchain-core==1.6.6 on 2026-09-29, landing #40882: Claude Sonnet 5.5 model profile and capability discovery; reject unsupported forced tool_choice/thinking; allow mid-conversation system/tool changes; preserve computer-toolset namespaces, encrypted advisor blocks, and refusal details through streaming and replay. Invalid tool calls can fall back to unforced structured output or explicit method="json_schema".

Zoom

LangChain shipped langchain==1.4.3 on 2026-09-28 (on PyPI): init_chat_model supports AWS Bedrock Mantle chat models via langchain-aws Mantle interfaces; recognizes GPT-6 structured output without profiles; create_agent emits error ToolMessages for invalid tool calls missing results on replay; sanitizes cache settings for fallback models. Key PRs: #40837, #40844, #40530, #40886 vs 1.4.2.

Zoom

LangChain4j 1.20.2 (2026-09-28) focuses on Agent-to-Agent (A2A) client fixes: tenant() on A2AClientInstance/A2AClientBuilder, @A2AClientAgent(tenant=…) auto-attaches tenant on every MessageSendParams (or parses it from /.well-known/{tenant}/agent-card.json), and filters tenant method args so they are not exposed as LLM tool parameters. AgenticScope/ResultWithAgenticScope toString guards against circular refs.

Zoom

LangChain shipped LangSmith Python SDK 0.14.1 on 2026-09-25 (rolling in 0.14.0): address runs and feedback by agent rather than only by project; sandboxes can receive delegated LangSmith access and login service URLs (JS too); ClaudeSDKClient.receive_messages() is traced with stop_reason plus tool/response IDs; OTel exports add tool_call_id, tool_definitions, and finish_reasons. JS package moves to 0.10.5.

Zoom

LangChain's multi-agent runtime framework LangGraph shipped CLI version 0.4.32, substantially expanding self-hosted infrastructure capabilities. The update introduces native listener integration for self-hosted deployments via the langgraph deploy command, featuring a dedicated --image-uri flag to deploy custom containerized agent instances into private infrastructure. In multi-agent environments, the CLI refines command routing by supporting typed agent_id flags and environment variable fallbacks, streamlining complex agent topology management. The release also remediates AnyIO dependency vulnerabilities across example lockfiles to fortify enterprise production deployments.

Zoom

LangChain.js shipped @langchain/[email protected] on 2026-09-27: ports explicit prompt-cache options across Chat Completions and Responses, preserves content-block breakpoints, and maps cache-write usage to cache_creation. A same-tag fix serializes promptCacheRetention: "in-memory" as API-legal "in_memory" and unifies precedence (per-call → modelKwargs → constructor); Chat Completions no longer drops modelKwargs.

Zoom

LangGraph.js shipped @langchain/[email protected] on 2026-09-25 (with @langchain/[email protected] and Vue/Svelte twins). useStream's "enqueue" multitask strategy can set queue: "server" so queued runs hit backend Runs REST instead of an in-memory client queue—surviving reloads, visible across sessions, with server-side cancelQueued/clearQueue. Default remains queue: "local"; custom AgentServerAdapter transports are unsupported. For frontends that need durable, collaborative agent queues.

Zoom

LangChain4j 1.20.1 landed 2026-09-25 atop the 1.20.0 line. AI Services now choose sync, TokenStream, CompletableFuture/CompletionStage, or Flow.Publisher by return type; non-blocking reaches tools, memory, guardrails, and the retrieval graph (@Experimental). Opt-in langchain4j-jackson3 routes JSON through Jackson 3 with typed JsonRead/WriteException. 1.20.1 lets @McpClientSupplier methods also take supplier parameters for per-request MCP clients. Aimed at Quarkus/Vert.x/WebFlux teams needing concurrent agents.

Zoom