langsmith
Client library to connect to the LangSmith Observability and Evaluation Platform.
No LLM SDK, agent framework or MCP dependency in its latest release, and none among the tracked dependencies.
Advisories
Advisories that name langsmith as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.
| Advisory | Severity | Affected | Fixed in | Published |
|---|---|---|---|---|
| GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read | High | < 0.8.18 | 0.8.18 | 2026-06-19 |
| CVE-2026-45134GHSA-3644-q5cj-c5c7: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning | High | < 0.6.0 | 0.6.0 | 2026-05-13 |
| GHSA-rr7j-v2q5-chgv: LangSmith SDK: Streaming token events bypass output redaction | Medium | <= 0.7.30 | 0.7.31 | 2026-04-16 |
| CVE-2026-40190GHSA-fw9q-39r9-c252: LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` | Medium | <= 0.5.17 | 0.5.18 | 2026-04-10 |
Dependencies of the latest release
As declared in npm metadata for version 0.10.11. Optional extras are listed with their extra name.
Tracked packages that depend on it
Among the packages in the registry; not every dependent on npm.