0.23.0 (2026-05-27)
Features
Bug Fixes
- ci: harden Python SDK e2e tests against transient backend failures (#3666) (5fdedaa)
- ci: split OpenAI keys per workflow + drop sdk examples to gpt-5-mini (#3641) (6b58467)
- deps: restore urllib3 2.6.3 in python-sdk (regression from rebase) (c52b6ad)
- deps: upgrade aiohttp, starlette, pillow, lxml (#3564) (498847e)
- deps: upgrade aiohttp, starlette, pillow, lxml (Python heavy) (498847e)
- deps: upgrade black to 26.3.1 (CVE: arbitrary file write) (#3678) (b4f9fe6)
- deps: upgrade black to 26.3.1 in python-sdk (CVE, Dependabot #556) (2283a88)
- deps: upgrade black to 26.3.1 in python-sdk (Dependabot #556) (#3766) (2283a88)
- deps: upgrade GitPython, protobuf, nbconvert (Dependabot) (#3655) (060a3ae)
- deps: upgrade GitPython, protobuf, nbconvert to resolve security alerts (060a3ae)
- deps: upgrade langsmith sdk security floors (2e18927)
- deps: upgrade LangSmith SDK security floors (#4041) (2e18927)
- deps: upgrade mcp Python SDK to >= 1.23.0 (DNS rebinding) (#3707) (2689e8a)
- deps: upgrade mcp to 1.27.0 in python-sdk (Dependabot #329) (#3767) (550eb90)
- deps: upgrade picomatch, merge, jupyterlab, notebook (Dependabot) (#3658) (bf8cd9a)
- deps: upgrade pyasn1, filelock, Pygments, nltk (Python patches) (#3561) (27152ca)
- deps: upgrade PyJWT, pillow, onnx (Dependabot) (#3656) (5eb44a3)
- deps: upgrade PyJWT, pillow, onnx to resolve security alerts (5eb44a3)
- deps: upgrade python-liquid to 2.2.0 — filesystem loader path escape (#3986) (6c390e3)
- deps: upgrade python-liquid to 2.2.0 — filesystem loader path escape (alerts #1066-#1068) (6c390e3)
- deps: upgrade tornado to 6.5.5 (Dependabot #555) (#3651) (7541e89)
- deps: upgrade tornado to 6.5.5 to resolve DoS vulnerability (CVE) (7541e89)
- deps: upgrade tornado, urllib3, cryptography (Dependabot) (#3657) (f8a2e9a)
- deps: upgrade tornado, urllib3, cryptography to resolve security alerts (f8a2e9a)
- deps: upgrade urllib3 to 2.6.3 in python-sdk (alerts #343, #331, #330) (#3843) (c52b6ad)
- deps: upgrade urllib3 to 2.7.0 — decompression-bomb bypass, header forwarding (#3985) (071cea7)
- deps: upgrade urllib3 to 2.7.0 — decompression-bomb bypass, header forwarding (alerts #1071-#1082) (071cea7)
- python-sdk: retry evaluator calls on gateway/edge transient failures (#3993) (03306ab)
- python-sdk: scope disable_sending to trace lifetime (#3981 root cause, supersedes #3979) (#4148) (64d8e2d)
- python-sdk: surface masked server errors + log loaded prompts once (#4197) (5da291d)
- release: path-routed Release-As shadows for 6 polluted components (#3627) (b39d59e)
- release: scope Release-As to langwatch, restore other components (#3618) (e259e79)
- sdk: dedicated TracerProvider isolation for coexistence with other OTel SDKs (#4204) (d5c9cfd)
- security: upgrade high-severity pip dependencies (excluding langchain-core) (#3929) (f2d5de6)
- security: upgrade jupyter-server to 2.18.2 (#3894) (a1c403e)
- security: upgrade jupyter-server to 2.18.2 (CVE-2026-35397, CVE-2026-40110) (a1c403e)
- traces: parse JSON-string langwatch.input when extracting primary I/O (#3419) (1e87641)
Miscellaneous
- ci: sign release images with cosign and publish CycloneDX SBOMs (#4155) (9b65850)
- deps-dev: bump faiss-cpu from 1.12.0 to 1.13.2 in /python-sdk (#2096) (636ac8d)
- deps-dev: bump fonttools from 4.62.0 to 4.62.1 in /python-sdk (#3729) (d4bc026)
- deps-dev: bump openinference-instrumentation-litellm (312deb7)
- deps-dev: bump openinference-instrumentation-litellm from 0.1.24 to 0.1.30 in /python-sdk (#3732) (312deb7)
- deps-dev: bump openinference-instrumentation-openai (ed63c26)
- deps-dev: bump openinference-instrumentation-openai from 0.1.30 to 0.1.45 in /python-sdk (#3726) (ed63c26)
- deps-dev: bump streamlit from 1.48.1 to 1.57.0 in /python-sdk (#2087) (21a1d24)
- deps: bump opentelemetry-api from 1.36.0 to 1.40.0 in /python-sdk (#2090) (9d6bbc3)
- deps: bump opentelemetry-instrumentation-crewai from 0.47.5 to 0.53.0 in /python-sdk (#2094) (44dc407)
- deps: bump opentelemetry-instrumentation-crewai in /python-sdk (44dc407)
- deps: bump the pip group across 9 directories with 2 updates (#3895) (fb10e26)
- python-sdk: single-footer shadow Release-As 0.23.0 (1002978)
- release as 3.2.1 (ca9d7a9)
- release as 3.2.1 (override release-please from 3.3.0) (#3615) (ca9d7a9)
- relicense langwatch from BSL 1.1 to Apache 2.0 (+ ee/ for enterprise modules) (#4085) (23b9dcd)
- scope Release-As to langwatch, restore other components (e259e79)
- security: add dependency age gates (#3523) (78f5b20)