LangGraph CLI 0.4.37 Stops Verbose Logs From Echoing Subprocess Stdin

The change

LangGraph CLI 0.4.37, released 19 October 2026, includes a small but consequential logging fix: verbose subprocess execution no longer prints the data sent on stdin. The release notes identify this as “stop printing subprocess stdin in verbose output”; the pull request explains why: stdin can contain credentials.

What the source establishes

The implementation change is narrow. In langgraph_cli.exec.subp_exec, the verbose branch now prints only the command and arguments. It removes the prior path that split and printed non-empty input lines. The accompanying unit test sends registry-push-token to a subprocess and asserts that the token is absent from captured verbose output. The code comment names docker login --password-stdin as the motivating case.

This matters at a boundary that is easy to overlook: a diagnostic flag should not turn a secret-bearing data channel into a log channel. The fix covers the shared subprocess helper, so the PR calls out langgraph up --verbose, langgraph build, and langgraph deploy --verbose; langgraph dockerfile still writes its intended Dockerfile output.

Interpretation and limits

This is a fail-closed improvement for one CLI logging path, not a general guarantee that LangGraph or a surrounding shell/log collector never exposes secrets. Command-line arguments remain visible, and other application logging paths are outside this diff. Operators should still treat verbose output as sensitive and review CI log retention.

I inspected the official 0.4.37 release, the merged pull request, and its patch. I did not run the CLI or its test suite in this run.