new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

LangChain · LangGraph · all subjects

deployment & observability

15 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Rate limiting configuration for Agent Server

Agent Server v0.11 and later support opt-in Go core rate limits for unary core-api RPCs and Redis stream publish bytes, with Redis-backed GCRA enforcement, shadow/enforce modes, and LS_RATE_LIMITS bootstrap config with YAML override. Rate-limit observability metrics include configured-limit gauges (lg_api_rate_limit_configured_rate, lg_api_rate_limit_configured_burst) and per-bucket rate_limit_key tags. v0.13 adds per-method unary response-bytes rate limit and configures core rate limits exclusively through environment variables.

Prometheus metrics support in Agent Server

Agent Server v0.11 and later support opt-in Prometheus metrics scrape. Set LSD_PROM_METRICS_ENABLED=true to expose OTel metrics on a dedicated Prometheus scrape endpoint at port LSD_PROM_METRICS_PORT (default 9464). Metrics include run lifecycle, latency, stream, and worker gauges. Set EXPOSE_INTERNAL_METRICS_PROMETHEUS=true to expose internal metrics migrated from the main API /metrics path. Datadog OTLP push continues to work alongside Prometheus.

Security fix: loopback webhook targets denied by default

v0.10.0rc1 introduces a breaking change where loopback webhook targets are now denied by default to fix authentication-bypass primitive (GHSA-2c9q-c2q9-qgqv). The webhooks.url.disable_loopback policy now defaults to true, blocking relative-URL webhooks and localhost/127.x/::1/host.docker.internal absolute URLs. Deployments can opt back in by setting webhooks.url.disable_loopback: false in langgraph.json or LANGGRAPH_WEBHOOKS JSON env var, but only when routes are controlled.

Authorization fix for run and cron creation

v0.10.0rc1 changes authorization: POST /runs and POST /threads/{thread_id}/runs now authorize the attached assistant via assistants.read auth event instead of assistants.search. This fixes GHSA-jfj5-wrj9-63x4. Deployments with custom auth handlers must: (1) ensure equivalent @auth.on.assistants.read handler returning the same owner-style filter, (2) move logic that inspected value[metadata] from assistants.read to @auth.on.runs.create_run and @auth.on.crons.create.

Graceful shutdown handoff for distributed runtime

Graceful shutdown handoff was added for distributed runtime, allowing in-flight runs to transfer to the next pod without using a retry attempt.

gRPC server health check integration with /ok endpoint

gRPC server health check was integrated with the `/ok` endpoint in the liveness probe to ensure proper startup coordination.

OTEL instrumentation requires explicit opt-in

Instrumentation for OTEL now requires explicit opt-in with `LS_APM_OTEL_ENABLED=true` for improved control over telemetry collection.

License check resilience with cached fallback and grace period

License check resilience was improved during upstream outages through a cached fallback, a 24-hour grace period, and automatic cleanup of Redis entries.

gRPC server startup timeout increased to 1 minute

The gRPC server startup timeout was increased to 1 minute to prevent occasional connection timeouts with the core server.

Custom route authorization support

Support for authorization on custom routes was implemented, controlled by the `enable_custom_route_auth` flag, allowing security policies to apply to user-defined Starlette endpoints.

Custom middleware order configuration

A new `middleware_order` setting was introduced to apply authentication middleware before custom middleware, allowing finer control over protected route configurations.

Configurable webhook support with custom headers

Configurable webhook support was introduced, allowing users to customize submitted webhooks and headers for webhook integration.

Configurable fields exposure to webhooks

Configuration was added to control which payload fields can be exposed to webhooks, enhancing security by limiting sensitive data exposure.

Thread copy operation authorization

Create permissions are required for copying threads to ensure proper authorization and prevent unauthorized thread duplication.

Configurable header support for assistants endpoints

Configurable headers were added to assistant endpoints to enhance request customization capabilities.

Give your agent this brain