Advisories for Pypi/Langgraph-Checkpoint-Postgres package

2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters. Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return …