pull_prompt

Pulled prompts should be treated as executable configuration, not plain text.

The secrets and secrets_from_env arguments only control explicit serialized LangChain secret references in the manifest. They do not prevent deserialized model integrations from using their own environment-based credential defaults during initialization. For example, a deserialized OpenAI chat model may still use OPENAI_API_KEY from the environment if its constructor supports that default.

Avoid pulling public prompts or prompts outside your own organization unless you have reviewed and trust their contents. When you do pull a trusted external prompt, prefer pinning to a specific commit SHA rather than following a mutable latest version. This is especially important when include_model=True.

Updated to take arguments secrets and secrets_from_env which default to None and False, respectively.

By default, explicit serialized LangChain secret references in a pulled manifest are not resolved from environment variables unless you specify secrets_from_env=True.

These updates were made to remediate vulnerability GHSA-c67j-w6g6-q2cm in the langchain-core package which this method (but not the entire langsmith package) depends on.