LangGraph Version Pinning & Upgrade Checklist

Look forLangGraph 1.0 is a long-term-support (LTS) release, developed until 2.0 and then maintained for at least a year. Breaking changes come only in major releases, and deprecated features keep working for at least one minor release. The GitHub release notes through 1.2.18 on October 26, 2026 list no breaking change in 1.x. LangGraph 0.4 gets security patches and critical fixes until December 2026.

Look forExpect minor releases every one to two months and patches as often as weekly. PyPI lists 38 stable LangGraph releases between October 12, 2025 and October 12, 2026, from 1.0.0 to 1.2.14.

Look forPin langgraph, the checkpointer package, langgraph-cli, langgraph-api, and the SDK together and upgrade them as a set. Two advisories set floors. CVE-2026-115883 (Moderate, October 21, 2026): in the Postgres and SQLite stores, a namespace label containing a dot can read, overwrite, or delete another namespace's items. Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2, which require langgraph-checkpoint 4.3.0. Self-hosted Agent Servers need 0.15.5 or 0.16.2. InMemoryStore is unaffected. CVE-2026-115885 (Moderate, October 23, 2026): langgraph deploy --verbose in langgraph-cli 0.4.15 to 0.4.31 printed a registry push token that lives up to 12 hours. Use CLI 0.4.32 or later and purge CI logs from verbose deploys. Use langgraph 1.2.17 (October 24, 2026) or later. Earlier releases dropped an explicit recursion_limit equal to the default, so a looping graph could run past the step limit you set. Add a test that a deliberate loop stops at your configured limit. Engineers have reported a 0.4.4 release that failed on a basic import hours after publication. They also reported a Postgres saver release that could not read existing checkpoints, and a CLI that pinned an older API package.

Look forv1 deprecates the prebuilt create_react_agent in favor of LangChain's create_agent. The graph API and the execution model stay the same. LangGraph 1.x requires Python 3.10 or later.

Look forCheckpoints store serialized state, so renaming or retyping a field can stop open threads from restoring. Add fields with defaults, migrate or close open threads before removing a field, and test resume from a checkpoint written by the previous release.

Look forEngineers report course notebooks and tutorials that broke within weeks, and docs that lagged releases. Check examples against the installed version, and read the GitHub release notes before each minor upgrade.