Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-langsmith for
openSUSE:Factory checked in at 2026-07-15 16:36:42
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-langsmith (Old)
and /work/SRC/openSUSE:Factory/.python-langsmith.new.1991 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-langsmith"
Wed Jul 15 16:36:42 2026 rev:9 rq:1365651 version:0.10.3
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-langsmith/python-langsmith.changes
2026-07-12 17:09:48.046552043 +0200
+++
/work/SRC/openSUSE:Factory/.python-langsmith.new.1991/python-langsmith.changes
2026-07-15 16:57:50.839499239 +0200
@@ -1,0 +2,24 @@
+Tue Jul 14 11:41:22 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to 0.10.3:
+ * Fix a cross-tenant data leak where auto-batch run processing
+ could drop a request's workspace override and send runs to the
+ wrong workspace
+ * Raise the minimum supported LangSmith backend to 0.16.13rc1
+ * Capture realtime/TTS model costs for the optional LiveKit and
+ Pipecat voice integrations (extras not enabled in this package)
+- Security references for tracking (already fixed in this package; not
+ newly fixed by 0.10.3, verified while updating):
+ * CVE-2026-45134 (boo#1266666): the prompt-pull methods deserialized
+ attacker-controlled prompt manifests (serialized LangChain objects
+ and model configuration); fixed upstream in langsmith 0.8.0 and
+ shipped here since 0.9.3
+ * CVE-2026-41182 (boo#1262699): output redaction (hide_outputs) was
+ not applied to streaming token events, leaking streamed content;
+ fixed upstream in langsmith 0.7.31 and shipped here since 0.9.3
+ * CVE-2026-40190 (boo#1262017): prototype pollution in a vendored
+ lodash set() helper affects only the JavaScript/TypeScript SDK
+ (Node.js); this Python package does not ship that code and is not
+ affected
+
+-------------------------------------------------------------------
Old:
----
langsmith-0.10.2.tar.gz
New:
----
langsmith-0.10.3.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-langsmith.spec ++++++
--- /var/tmp/diff_new_pack.AWCWZe/_old 2026-07-15 16:57:52.507555549 +0200
+++ /var/tmp/diff_new_pack.AWCWZe/_new 2026-07-15 16:57:52.507555549 +0200
@@ -17,7 +17,7 @@
Name: python-langsmith
-Version: 0.10.2
+Version: 0.10.3
Release: 0
Summary: Client library for the LangSmith LLM tracing and evaluation
platform
License: MIT
++++++ langsmith-0.10.2.tar.gz -> langsmith-0.10.3.tar.gz ++++++
++++ 3374 lines of diff (skipped)
