Summary

Bumps the Google/LangChain stack to the latest patch releases and includes the Anthropic compatibility fix required to keep tool calling working under the new @langchain/core:

• @langchain/core 1.1.44 → 1.1.48
• @langchain/google-common / google-gauth / google-genai / google-vertexai 2.1.28 → 2.1.31
• @anthropic-ai/sandbox-runtime → 0.0.54 (npm audit alignment)
• fix: Anthropic streamed tool-input aggregation under @langchain/core ≥ 1.1.46 (see below)

The overrides $-references follow the dependencies versions automatically. Lockfile regenerated.

Anthropic tool-input compatibility fix

@langchain/core ≥ 1.1.46 changed streaming content-block aggregation ("keep different block types separate when merging chunks" + "v1 message casting"). For Anthropic tool calls this now leaves the tool_use content block's input empty — the streamed input is split into a separate input_json_delta block (v1-cast to a stray text block). The assembled arguments still live on message.tool_calls, but every consumer that reads tool input from message.content breaks:

• _formatContent re-serialization → Unsupported message content format (multi-turn tool calls, summarization).
• @langchain/anthropic's AnthropicToolsOutputParser, used by withStructuredOutput (e.g. title generation) → OUTPUT_PARSING_FAILURE on empty input.

Fixed in two layers, without disturbing the fork's Vertex/GCP/Azure-specific handling:

1. Source — utils/message_outputs.ts: emit the partial tool input as an untyped { index, input } block so core merges it back into whichever block sits at that index (tool_use or server_tool_use), restoring the input in message.content. Fixes all content-reading consumers at the source.
2. Defensive — utils/message_inputs.ts _formatContent: restore an emptied tool_use input from message.tool_calls, falling back to merging sibling input_json_delta blocks by index; drop orphaned delta / text-with-input blocks instead of throwing. Covers persisted/legacy messages.

Tests

• Unit (utils/streaming-tool-input.test.ts): orphan-skip, restore-from-tool_calls, no-overwrite, sibling-delta merge, and type-less chunk emission + aggregation.
• Live (llm.spec.ts): "converting messages doesn't drop tool input".
• The sibling-merge and live tests are ported from @langchain/anthropic's own regression suite.

Why core and google-* must move together

@langchain/google-common@2.1.29 (PR #10776) switched function-call id generation back to importing v4 from @langchain/core/utils/uuid (2.1.28 imported it from standalone uuid). That import path is what crashed in LibreChat#13003 — (0, _langchain_core_utils_uuid.v4) is not a function — due to a Rolldown CJS emit bug in older @langchain/core.

@langchain/core@1.1.48 (PR #10832, "make CJS default re-exports callable") fixes that emit. Verified:

require('@langchain/core/utils/uuid').v4()  // -> '9aac90b4-…' (callable ✅; non-callable namespace object in 1.1.44)

So the revert is safe only when core is also ≥ 1.1.48. Note google-common@2.1.31 only declares core ^1.1.47, but the callable-export fix landed in 1.1.48 — so core is pinned to an exact 1.1.48 here, not a ^ range.

Changelog breakdown (current → bumped)

@langchain/core 1.1.44 → 1.1.48 — 1.1.45 deprecations + Deno fix · 1.1.46 inline ansi-styles/camelcase/decamelize, keep distinct content-block types separate when merging · 1.1.47 add UUID v6, v1 casting after streaming aggregation · 1.1.48 fix(core): make CJS default re-exports callable (#10832; the #13003 root cause), OpenRouter reasoning v1 blocks, OpenAI Responses custom-tool streaming.

@langchain/google-common 2.1.28 → 2.1.31 — 2.1.29 uuid-vuln remediation (reverts to core uuid import, #10776) · 2.1.30 structured output parsing with includeRaw+reasoning · 2.1.31 fix: missing stream usage metadata on Gemini (#9912).

google-genai / google-gauth / google-vertexai — uuid remediation (genai) + dependency passthroughs.

What this does NOT do

Does not address the Gemini union-type schema throw (zod_to_gemini_parameters: Gemini cannot handle union types, langchainjs#9691) — still open upstream and unchanged in google-common@2.1.31. That case is handled downstream in LibreChat by flattening union schemas before they reach the Gemini converter.

Validation

• Live (against the real Anthropic API): structured-output title generation, parallel web_search (server tool) + calculator (regular tool), tool round-trips / follow-ups, plus the new tests — all pass.
• npm install clean (no peer-dependency conflicts); npm run build (rollup + tsc) clean.
• CI green (unit shards, typecheck, lint, change-gated live integration).