LangGraph patches checkpoint namespace collisions

What happened

Labels containing a dot could collide with nested checkpoint namespaces. A caller able to control the affected namespace labels could access data belonging to another namespace.

The maintainer published GHSA-6hmw-9432-67qq on 21 October; its CVE record was published on 23 October. The affected storage packages are fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2. These publication dates are separate from the patch-release dates. This is distinct from the earlier namespace-prefix issue CVE-2026-71433. The maintainer rates it Moderate, with a CVSS 4.0 score of 6.0.