langchain-ai/langchain

Dependencies

What each package depends on at runtime. Source of truth: each package's pyproject.toml.

`langchain-core` (`libs/core/pyproject.toml`)

langsmith>=0.3.45,<1.0.0
tenacity!=8.4.0,>=8.1.0,<10.0.0
jsonpatch>=1.33.0,<2.0.0
PyYAML>=5.3.0,<7.0.0
typing-extensions>=4.7.0,<5.0.0
packaging>=23.2.0
pydantic>=2.7.4,<3.0.0
uuid-utils>=0.12.0,<1.0
langchain-protocol>=0.0.10

Notable: no provider SDKs, no httpx, no aiohttp. Core stays light.

`langchain` (`libs/langchain_v1/pyproject.toml`)

langchain-core>=1.3.2,<2.0.0
langgraph>=1.1.10,<1.2.0
pydantic>=2.7.4,<3.0.0

Optional extras (install via pip install "langchain[openai,anthropic,...]"):

anthropic, openai, azure-ai, google-vertexai, google-genai, fireworks,
ollama, together, mistralai, huggingface, groq, aws, baseten, deepseek,
xai, perplexity, community

Each extra installs the corresponding partner package.

`langchain-classic` (`libs/langchain/pyproject.toml`)

Inherits from langchain-core, plus a long list of community-derived dependencies. The full list lives in the package's pyproject.toml. Most users install only the optional extras they need rather than the full set.

`langchain-text-splitters` (`libs/text-splitters/pyproject.toml`)

langchain-core>=...

Tokenizer-aware splitters require optional packages (nltk, spacy, sentence-transformers, konlpy); install them as needed.

`langchain-tests` (`libs/standard-tests/pyproject.toml`)

langchain-core>=...
pytest>=...
pytest-asyncio>=...

Plus a small set of helper dependencies for the standard test suites.

`langchain-model-profiles` (`libs/model-profiles/pyproject.toml`)

httpx>=...
typing-extensions>=...

The CLI's only direct runtime needs are HTTP and typing.

Partner packages

Each partner pulls in:

langchain-core>=...
The provider's official SDK (e.g. openai, anthropic, groq, mistralai, httpx-based ollama client)
Sometimes tiktoken (for token counting) or tenacity (for retries)

For the exact pin per partner, look at libs/partners/<provider>/pyproject.toml.

How dependencies stay in sync

uv.lock per package — the canonical resolved set, regenerated by uv lock.
Editable workspace — [tool.uv.sources] in each pyproject.toml points at sibling packages with editable = true, so cross-package changes are immediate.
Dependabot (.github/dependabot.yml) — opens PRs to bump pinned deps. Each partner package has its own dependabot entry.
Constraint deps — some packages have [tool.uv] constraint-dependencies = [...] that hard-pin transitive vulnerabilities (e.g. urllib3>=2.6.3, pygments>=2.20.0).

How to inspect a package's full tree

cd libs/<package>
uv tree                   # full resolved tree from uv.lock
uv pip list               # installed packages in the active env