[LangGraph] Ease migration of checkpoints to 0.3.0 while respecting CVE in JsonPlusSerializer's "json" mode

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Unknown
    • None
    • Affects Version/s: langgraph-checkpoint-mongodb-0.3.0
    • Component/s: AI/ML, LangGraph
    • None
    • None
    • Python Drivers
    • None
    • None
    • None
    • None
    • None
    • None

      Context

      Describe the background behind the problem.

      Users are reporting errors when they attempt to migrate to 0.3.0 (and 0.2.2?). This is based on the changes we made to address the JsonPlusSerializer's "json" mode. (https://osv.dev/vulnerability/GHSA-wwqv-p2pp-99h5)

      Definition of done

      What must be done to consider the task complete?

      The assignee must first determine if this only happens when checkpoints were created on a legacy version of langgraph-checkpoint-mongodb. If so, let's reproduce and discuss how to move forward. It may be as simple as adding a try/catch on signature/length, and then adding the default argument.

      Pitfalls

      What should the implementer watch out for? What are the risks?

      If this isn't viable, we may be faced with the suboptimal decision to raise an exception with an explanation, and point users to migrate checkpoints at the application level.

            Assignee:
            Unassigned
            Reporter:
            Casey Clements
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: