langchain-dependencies

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha a78b2e2257e3 · 28 Oct 2026Report an issue or request a re-scan

• Publisherlangchain-ai GitHub organizationOwner of the repository this skill is read from
• Source folderlangchain-ai/langchain-skills/config/skills/langchain-dependenciesThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdicta78b2e2257e3A new audit runs when the source changes
• Repository statusNot archivedLast push 2 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: INVOKE THIS SKILL when setting up a new project or when asked about package versions, installation, or dependency management for LangChain, LangGraph, LangSmith, or Deep Agents. Covers required packages, minimum…

---
name: langchain-dependencies
description: "INVOKE THIS SKILL when setting up a new project or when asked about package versions, installation, or dependency management for LangChain, LangGraph, LangSmith, or Deep Agents. Covers required packages, minimum versions, environment requirements, versioning best practices, and common community tool packages for both Python and TypeScript."
---

<overview>
The LangChain ecosystem is split into focused, independently-versioned packages. Understanding which packages you need — and their version constraints — prevents incompatibilities and keeps upgrades predictable.

**Key principles:**
- **LangChain 1.0 is the current LTS release.** Always start new projects on 1.0+. LangChain 0.3 is legacy maintenance-only — do not use it for new work.
- **langchain-core** is the shared foundation: always install it explicitly alongside any other package.
- **langchain-community** (Python only) does NOT follow semantic versioning; pin it conservatively.
- **LangGraph vs Deep Agents:** choose one orchestration approach based on your use case — they are alternatives, not a required stack (see [Framework Choice](#framework-choice) below).
- Provider integrations (model, vector store, tools) are installed separately so you only pull in what you use.
</overview>

---

## Environment Requirements

<environment-requirements>

| Requirement | Python | TypeScript / Node |
|-------------|--------|-------------------|
| Runtime minimum | **Python 3.10+** | **Node.js 20+** |
| LangChain | **1.0+ (LTS)** | **1.0+ (LTS)** |
| LangSmith SDK | >= 0.3.0 | >= 0.3.0 |

</environment-requirements>

---

## Framework Choice

<framework-choice>
Pick **one** agent orchestration layer. You do not need both.

| Framework | When to use | Core extra package |
|-----------|-------------|--------------------|
| **LangGraph** | Need fine-grained graph control, custom workflows, loops, or branching | `langgraph` / `@langchain/langgraph` |
| **Deep Agents** | Want batteries-included planning, memory, file context, and skills out of the box | `deepagents` (depends on LangGraph; installs it as a transitive dep) |

Both sit on top of `langchain` + `langchain-core` + `langsmith`.
</framework-choice>

---

## Core Packages

<python-packages>

### Python — always required

| Package | Role | Min version |
|---------|------|-------------|
| `langchain` | Agents, chains, retrieval | 1.0 |
| `langchain-core` | Base types & interfaces (peer dep) | 1.0 |
| `langsmith` | Tracing, evaluation, datasets | 0.3.0 |

### Python — orchestration (pick one)

| Package | Use when | Min version |
|---------|----------|-------------|
| `langgraph` | Building custom graphs directly | 1.0 |
| `deepagents` | Using the Deep Agents framework | latest |

### Python — model providers (pick the one(s) you use)

| Package | Provider |
|---------|----------|
| `langchain-openai` | OpenAI (GPT-4o, o3, ...) |
| `langchain-anthropic` | Anthropic (Claude) |
| `langchain-google-genai` | Google (Gemini) |
| `langchain-mistralai` | Mistral |
| `langchain-groq` | Groq (fast inference) |
| `langchain-cohere` | Cohere |
| `langchain-fireworks` | Fireworks AI |
| `langchain-together` | Together AI |
| `langchain-huggingface` | Hugging Face Hub |
| `langchain-ollama` | Ollama (local models) |
| `langchain-aws` | AWS Bedrock |
| `langchain-azure-ai` | Azure AI Foundry |

### Python — common tool & retrieval packages

These packages have tighter compatibility requirements — use the latest available version unless you have a specific reason not to.

| Package | Adds | Notes |
|---------|------|-------|
| `langchain-tavily` | Tavily web search (`TavilySearch`) | Dedicated integration package; prefer latest |
| `langchain-text-splitters` | Text chunking utilities | Semver, keep current |
| `langchain-community` | 1000+ integrations (fallback) | **NOT semver — pin to minor series** |
| `faiss-cpu` | FAISS vector store (local) | Via `langchain-community`; use latest |
| `langchain-chroma` | Chroma vector store | Dedicated integration package; prefer latest |
| `langchain-pinecone` | Pinecone vector store | Dedicated integration package; prefer latest |
| `langchain-qdrant` | Qdrant vector store | Dedicated integration package; prefer latest |
| `langchain-weaviate` | Weaviate vector store | Dedicated integration package; prefer latest |
| `langsmith[pytest]` | pytest plugin for LangSmith | Requires langsmith >= 0.3.4 |

> **langchain-community stability note:** This package is NOT on semantic versioning. Minor releases can contain breaking changes. Prefer dedicated integration packages (e.g. `langchain-chroma`, `langchain-tavily`) when they exist — they are independently versioned and more stable.

</python-packages>

<typescript-packages>

### TypeScript — always required

| Package | Role | Min version |
|---------|------|-------------|
| `@langchain/core` | Base types & interfaces (peer dep) | 1.0 |
| `langchain` | Agents, chains, retrieval | 1.0 |
| `langsmith` | Tracing, evaluation, datasets | 0.3.0 |

### TypeScript — orchestration (pick one)

| Package | Use when | Min version |
|---------|----------|-------------|
| `@langchain/langgraph` | Building custom graphs directly | 1.0 |
| `deepagents` | Using the Deep Agents framework | latest |

### TypeScript — model providers (pick the one(s) you use)

| Package | Provider |
|---------|----------|
| `@langchain/openai` | OpenAI (GPT-4o, o3, ...) |
| `@langchain/anthropic` | Anthropic (Claude) |
| `@langchain/google-genai` | Google (Gemini) |
| `@langchain/mistralai` | Mistral |
| `@langchain/groq` | Groq (fast inference) |
| `@langchain/cohere` | Cohere |
| `@langchain/aws` | AWS Bedrock |
| `@langchain/azure-openai` | Azure OpenAI |
| `@langchain/ollama` | Ollama (local models) |

### TypeScript — common tool & retrieval packages

| Package | Adds | Notes |
|---------|------|-------|
| `@langchain/tavily` | Tavily web search (`TavilySearch`) | Dedicated integration package; prefer lates

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/langchain-ai/langchain-skills
git -C langchain-skills checkout a78b2e2257e3

Works in

1. 2026-10-28
   ✓SAFE B 89 / 100

   first audit · source a78b2e2257e3

Questions about langchain-dependencies

• github.com/langchain-ai/langchain-skills/tree/main/config/skills — the audited source at commit a78b2e2257e3 and every finding aboveObserved · 28 Oct 2026

Spotted something wrong? Report a correction · Methodology