[Release] langchain-ai/langchain langchain-core==1.3.0a3: langchain-core==1.3.0a3

langchain-core version 1.3.0a3 is released with improvements to streaming metadata, chat model invocation parameters, SSRF security hardening, and various bug fixes. Key updates include checkpoint namespace behavior preservation for backwards compatibility, enhanced traceable metadata for chat models and LLMs, and fixes for OpenAI responses API conversion. The release includes dependency updates (pytest 9.0.3) and security patches for CVE-2026-4539 related to Pygments.

Key Points

• •Preserve checkpoint_ns behavior in streaming metadata for backwards compatibility
• •Add chat model and LLM invocation parameters to traceable metadata for better observability
• •Restore cloud metadata IPs and link-local range in SSRF policy for security
• •Harden private SSRF utilities to prevent server-side request forgery attacks
• •Fix OpenAI responses API conversion to handle content blocks without type key
• •Implement reference counting for inherited run trees to support proper garbage collection
• •Reduce streaming metadata overhead and improve performance
• •Add ContextOverflowError exception and raise in Anthropic and OpenAI integrations
• •Support multimodal token counting with approximate token counting improvements
• •Update Pygments to >=2.20.0 across all packages for CVE-2026-4539 security patch

Workflow Diagram

Concepts