LangGraph JavaScript custom authentication may allow cross-user access to Store data

A GitHub security advisory disclosed that LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by the authorization handler, allowing an authenticated ordinary user without administrator privileges to read, overwrite, search or delete other users' Store data. Trigger conditions include the deployment using an affected langgraph-api version, the Store authorization handler relying on rewriting the request namespace to restrict user access, and multiple users' data being stored through that authorization path; Python custom authentication and JavaScript or TypeScript handlers that directly reject requests for unauthorized namespaces are not affected. Affected versions are 0.1.2 and above, before 0.15.0; the fixed version 0.15.0 applies authorization changes and validates the namespace before executing Store operations; deployments unable to upgrade immediately can change the handler to reject requests for unauthorized namespaces, and this must cover every Store operation exposed by the deployment.