LangChain for Python 0.3

Apply to the legacy LangChain 0.3 line and its langchain-core 0.3 dependency line, with compatible integration packages and the included Python baseline.

Prompt injection and templates

• Treat user messages, retrieved Document.page_content, metadata, stored memory, and tool results as untrusted data. Keep them separate from developer-controlled instructions; none may grant tool authorization or change the principal.
• Build message roles in application code. Accept user text as HumanMessage content rather than accepting client-selected SystemMessage, AIMessage, or tool-call records. Validate imported history before it reaches MessagesPlaceholder.
• Keep PromptTemplate and ChatPromptTemplate template structure under developer control; pass external text only as variable values. Prefer f-string templates or direct message construction; never accept untrusted Jinja2 templates, even with its sandbox. Pass simple values rather than credential-bearing objects to formatters.
• Treat Hub prompts, chain/agent configurations, and serialized runnables as executable application configuration. Review their origin and content before use; never let a request select a remote artifact or enable its embedded model configuration.
• Prefer the LangSmith SDK over the deprecated langchain.hub.pull(). Pull only reviewed prompts from your own organization, pinned to a commit hash; never pass dangerously_pull_public_prompt=True, include_model=True, or secrets_from_env=True for a public owner/name prompt. A same-organization prompt is only as trustworthy as every