langchain 1.0.5 for JavaScript: piiRedactionMiddleware deprecated

langchain@1.0.5 marks its PII redaction middleware deprecated and ships a replacement for it in the same release. In the published declaration files, piiRedactionMiddleware and its options type PIIRedactionMiddlewareConfig both carry a bare @deprecated marker, where 1.0.4 declared the function @public and gave the type no marker at all. Both names are still exported from the package root and both still work, so an upgrade from 1.0.4 compiles; none of the five patch entries in the release’s changelog mentions either name.

What changed

• Both PII redaction exports are deprecated, and the marker names no successor. @deprecated appears on its own in dist/agents/middleware/piiRedaction.d.ts for the function and for the type, with no replacement in the tag and no removal date. Emendant reports each named import of either one from langchain, which is how you find the call sites before a later major removes them.
• The replacement arrived in the same release, with a different shape. 1.0.5 adds piiMiddleware and a new agents/middleware/pii module behind it, along with PIIMiddlewareConfig, PIIStrategy, BuiltInPIIType and five detectors. It takes one PII type per call rather than a record of rules, so porting is not a rename.

Before and after

The deprecated middleware took a record of custom regular expressions in a single call, as its own declaration example shows:

import { createAgent, piiRedactionMiddleware } from 'langchain';

const agent = createAgent({
  model: new ChatOpenAI({ model: 'gpt-4' }),
  tools: [lookupUser],
  middleware: [piiRedactionMiddleware({ rules: { ssn: /\b\d{3}-?\d{2}-?\d{4}\b/g } })],
});

Both changes carry an assisted fix, so emendant fix asks a model once you name a provider. Expect a decline. The guidance for a deprecation asks for a rewrite only where the release names a direct replacement with the same behaviour, and this release does not. The replacement below is the new declaration’s own documented example rather than anything the tool produces:

import { createAgent, piiMiddleware } from 'langchain';

const agent = createAgent({
  model: 'openai:gpt-4',
  middleware: [piiMiddleware('email', { strategy: 'redact' })],
});

Migration guidance and its limits

Both findings carry an assisted fix. Naming a model provider on the command line or in emendant.json lets emendant fix try them, and without one they are reported with their guidance and nothing is sent anywhere. Do not expect a patch. Both names are deprecated rather than removed and both still work, so the guidance asks for a rewrite only where the release names a direct replacement with the same behaviour, and piiMiddleware is a different shape rather than a new spelling. A scan gives you the file and line of every import of the two names, and the edit is yours.

Port each call site deliberately. piiRedactionMiddleware accepted any number of custom rules as named regular expressions, and its documentation says it restored the original values into model responses so tools received them unredacted. piiMiddleware takes one type per call, from email, credit_card, ip, mac_address and url or a custom type with a detector, and offers block, redact, mask and hash as strategies. The new declaration describes no restore step, so a tool that needs the real value needs rethinking rather than a new argument.

Check the scope defaults while you are there. applyToInput defaults to true, and applyToOutput and applyToToolResults both default to false, so a single piiMiddleware call covers less of the conversation than the old middleware’s two phases did.

Each matcher is an import-specifier match on langchain, and it follows the imported name rather than the local one. An import of BuiltInPIIType renamed to piiRedactionMiddleware on the way in is not a use of the deprecated function and is not reported, and neither is either name imported from a compatibility module of your own. The package exposes no subpath for this middleware, so the root import is the only route Emendant has to cover, but a namespace import, a re-export through your own module or a dynamic import('langchain') is still outside what these two entries see. A clean scan does not prove your agents have left the deprecated middleware behind.

What Emendant detects, fixes and verifies

2 changes in langchain 1.0.5. 0 patched by a transform, 2 patched only with a model provider you name, 0 report only. Every patch is proved in a copy of your repository before it is offered, and its header names the checks that passed. This table is generated from the feed entry, so it cannot claim more than the entry does.

emendant explain <change-id> prints any row's entry, guidance and sources at the terminal.

Coverage

Snapshot

2026-09-20.1, sequence 27, signed 20 September 2026

Minimum CLI

emendant@0.1.0

Feed entry

feed/npm/langchain/1.0.5.json

emendant feed status shows the snapshot your machine holds, and emendant feed update fetches the latest.

Primary sources

Every claim above was checked against these, each pinned to the release rather than to a default branch.

• langchain@1.0.5npm registry, the published package
• langchain@1.0.4npm registry, the published package

Scan your repository

Runs locally, reads your lockfile and source, sends nothing anywhere.

npx emendant scan

Then npx emendant fix writes the patches the table says exist. The getting started guide covers the flags and the patch grades.