AI & Agent Dev Bug SandboxDefensive Tech Intelligence

Drop in an error log

Name: AI & Agent Dev Bug Sandbox
Creator: AI & Agent Dev Bug Sandbox

A sourced fix-playbook workspace for AI and agent engineers. Find the root cause, the affected version, the rollback-safe next step, and edge-case audits.

Active Intelligence Feed

high95%

core: SSRF-safe transports drop streaming request bodies and crash on internationalized hostnames

SSRFSafeTransport and SSRFSafeSyncTransport reconstruct pinned requests using request.content and hostname.encode('ascii'). This raises httpx.RequestNotRead for streaming bodies (generators, async generators, files, multipart) and UnicodeEncodeError for internationalized domain names, causing silent failures or crashes in URL-based utilities such as HTMLHeaderTextSplitter and ChatOpenAI token counting.

V1.6.2 Langchain-Core

high95%

core: `InMemoryVectorStore` raises `NotImplementedError` for relevance-score search and the `similarity_score_threshold` retriever

`InMemoryVectorStore` does not override `_select_relevance_score_fn`, so `similarity_search_with_relevance_scores` and the `similarity_score_threshold` retriever raise `NotImplementedError` even though the store computes cosine similarity internally.

V1.6.3 V1.6.0 V1.6.1 V1.6.2 Langchain-Core

high90%

SummarizationMiddleware bypasses PIIMiddleware and sends unredacted history to the summary model

SummarizationMiddleware invokes the summary model directly inside its before_model hook, bypassing the agent middleware pipeline. This means PIIMiddleware (including strategy='block') never inspects or redacts the summary prompt, allowing PII such as email addresses to be sent to an external summarization provider silently. The issue occurs regardless of middleware ordering in the affected versions unless external sanitization is added.

V1.4.2 Langchain

high85%

Support bounded same-call 401 recovery for externally managed credentials in langchain.mcp

The langchain.mcp MCPAdapter lacks a supported path for externally managed bearer credentials to recover from HTTP 401 by re-reading tokens and retrying the same operation. The existing FastMCP/httpx2.Auth injection seam is undocumented and untested for this scenario, and terminal 401 errors are often swallowed or converted to generic errors by the MCP SDK, blocking classification. This issue requests a bounded, request-local retry mechanism and proper error propagation.

Langchain

high88%

Docker Desktop macOS ignores host_binding_ipv4, exposing Supabase local dev ports to LAN

The documented Docker network host binding to 127.0.0.1 does not restrict access on macOS because Docker Desktop runs Docker inside a Linux VM, causing local Supabase services to remain reachable from other devices on the same LAN.

Docker Desktop

high95%

Pages Router: CSS shared by a page and a next/dynamic component is removed after client navigation

When a CSS file is imported by both a page and a component loaded with next/dynamic and kept mounted via _app, the stylesheet link is incorrectly marked with data-n-p and removed during client-side navigation. This happens because the dynamic CSS manifest is not loaded correctly in the route module and not passed to _document.

V15.5.25 V16.4.0-Canary.55 Next.js

high93%

detached-flush never exits, leaking reparented process per next dev shutdown

Regression in Next.js 16.0.3: detached-flush child spawned on dev server shutdown hangs after submitting telemetry when next.config leaves a live handle, causing orphaned processes to accumulate and consume large memory/CPU.

V16.0.3 V16.1.x V16.2.x V16.3.1 V16.4.0-Canary.0 Next.js

high75%

Next.js Turbopack fails to load native Node addon in pnpm workspace

When using Next.js 16 with Turbopack (default bundler), importing a native Node addon (built with napi-rs) from a separate package in a pnpm workspace during server-side prerendering results in `TypeError: (void 0) is not a function`. The package is added to `serverExternalPackages`, but Turbopack still bundles or mishandles the native module, causing the imported binding to be undefined.

V16.0.0 Next.js

high75%

Jest Manual mocks stopped working in Next.js 13.2.4

Manual mocks in Jest are no longer resolved automatically after upgrading to Next.js 13.2.4; the next/jest preset appears to have broken Jest's default __mocks__ lookup.

V13.2.4 V13.2.5-Canary.32 Next.js

high95%

Supabase hardening docs ALTER DEFAULT PRIVILEGES revoke execute on functions from PUBLIC has no effect due IN SCHEMA

The fourth ALTER DEFAULT PRIVILEGES statement in the Supabase 'Securing your API' docs uses IN SCHEMA public to revoke EXECUTE on functions from PUBLIC, but schema-qualified default ACLs merge with PostgreSQL's built-in default instead of replacing it, so new functions remain callable by anon.

Supabase

high75%

Layout redirect during client navigation causes repeated ?_rsc requests and blank page

Next.js App Router client-side Link navigation to a route whose shared layout calls redirect triggers infinite RSC fetch loop; direct destination navigation works. Reproduced on Next 15.1.7 through 16.4.0-canary.57 with both webpack and Turbopack.

V15.1.7 V16.3.8 V16.4.0-Canary.57 Next.js

high85%

Turbopack fails to resolve next/package.json when pnpm v11 enableGlobalVirtualStore creates symlink outside project root

With pnpm v11's enableGlobalVirtualStore enabled, node_modules/next is a symlink to a global store outside the project root. Turbopack's filesystem resolution restricts access to the project root, causing 'Couldn't find the Next.js package' in dev mode. Webpack works; this is a Turbopack-specific limitation.

V16.2.4 Vcanary Next.js

high92%

Scroll-to-top lost on navigation when root parallel-slot catch-all sits next to sibling dynamic segment (Next.js 16.3+ optimistic routing regression)

In Next.js 16.3.0 and later with optimisticRouting enabled by default, navigation from a dynamic segment to another dynamic route can fail to reset scroll position. This occurs when the app has a root parallel slot with a catch-all page returning null, alongside a sibling dynamic route. Predicted route trees reify stale params, causing a server mismatch and retry that consumes the scroll-ref on an empty catch-all leaf, so the new page retains the previous scroll offset.

V16.3.0 V16.3.1 V16.3.2 V16.3.3 V16.4.0-Canary.10 Next.js

high75%

Next.js fails to generate static shell when generateMetadata uses runtime data with cacheComponents and htmlLimitedBots enabled

When cacheComponents is true and htmlLimitedBots matches all bots, using runtime data (e.g. await connection()) inside generateMetadata causes Next.js 16 dev server to log 'did not produce a static shell and Next.js was unable to determine a reason', disrupting development and potentially affecting build/start.

V16.0.0 V16.0.1 V16.0.2 V16.0.3 V16.0.4 V16.0.5 Next.js

high75%

Static metadata rendered in <body> instead of <head> in Next.js 15.5.4

In Next.js 15.5.4, metadata defined via 'export const metadata' is incorrectly rendered inside <body> instead of <head>, breaking Open Graph, Twitter Cards, and SEO. Downgrading to 15.2.4 restores correct behavior.

V15.5.4 Next.js

high90%

Turbopack runs swcPlugins after React Compiler, breaking Lingui macro message extraction

When reactCompiler and turbopackRustReactCompiler are enabled, the Rust React Compiler runs in the preprocess stage before user-registered swcPlugins, so macro plugins like @lingui/swc-plugin see compiler-hoisted JSX and emit incorrect message IDs, causing silent translation fallback and client/server mismatch.

V16.4.0-Canary.57 V16.3.6 Next.js

high82%

revalidateTag during streaming Route Handler response is silently dropped

revalidateTag or revalidatePath called after a Route Handler returns a streaming Response is queued but never executed, causing stale cache entries with no warning.

V16.3.3 V16.3.8 V16.4.0-Canary.54 Next.js

high92%

Invalid tool call blocks are not filtered in langchain-groq and langchain-mistralai v1 converters

The v1 message converters in langchain-groq and langchain-mistralai do not filter out invalid_tool_call blocks, causing them to be passed to Groq and Mistral APIs. These providers may reject such blocks when replaying partial or malformed tool-call history, leading to runtime errors. Other providers (OpenAI, Anthropic, Fireworks) already filter these blocks.

Vlangchain-Groq<=1.1.3 Vlangchain-Mistralai<=1.1.6 Langchain

high95%

Turbopack asset rule for CSS query url fails in Server Components

When configuring Turbopack rules to treat `.css?url` imports as asset type, importing from a Server Component fails with 'css client asset is not css chunk placeable'. The same configuration works from Client Components and for other asset types like SVG.

V16.3.8 V16.4.0-Canary.57 Next.js

high75%

redirect() silently fails and enters infinite render loop on client-side navigation to fully dynamic route with cacheComponents enabled

Clicking a client-side <Link> to a route that calls redirect() never navigates and spins at ~100% CPU when the route builds as fully dynamic (ƒ) under cacheComponents=true. The redirect is caught by RedirectBoundary but never commits, so router.replace is never called. Direct visits work; only production client navigations are affected.

V16.3.1 V16.3.3 V16.4.0-Canary.6 Next.js

high95%

XMLOutputParser streaming drops valid Unicode root tags

Streaming with XMLOutputParser silently loses data when the root XML element uses a valid Unicode name (e.g., Chinese tags). The parser's start-tag detection regex only matches ASCII letters, colon, and underscore, causing it to skip Unicode roots and either return empty output or omit the root hierarchy.

V1.6.6 Vmaster Langchain-Core

high95%

Next.js 16.3.0+ published types break TypeScript <6 due to missing URLPatternInput/URLPatternOptions names

Since Next.js 16.3.0, the published .d.ts files reference global type names URLPatternInput, URLPatternOptions, and URLPattern generic parameters that are only available in TypeScript 6.0+. This causes TypeScript 5.x users with skipLibCheck: false to encounter TS2304 errors in next/dist/server/web/spec-extension/url-pattern.d.ts, breaking typechecking for any project that types its next.config.ts.

V16.3.0 V16.4.0-Canary.58 Next.js

high95%

stdio sessions hang forever when a server never responds (no default read_timeout_seconds)

langchain_mcp_adapters.sessions._create_stdio_session constructs an MCP ClientSession without a default read_timeout_seconds, so any request to a non-responsive stdio server (e.g., during initialize()/call_tool()/list_tools()) blocks indefinitely. The MCP SDK already supports per-request timeouts via read_timeout_seconds; this library simply fails to set a default.

V0.3.2 Vmain Langchain-Mcp-Adapters

high85%

Strict route matching drops pages in sibling route groups when a parallel slot catch-all is present

Next.js 16.4+ strict route matching incorrectly treats a parallel slot catch-all from one route group as part of routes in sibling groups, causing valid pages to be reported as unmatched and failing dev/production webpack builds.

V16.4.0 V16.5.0-Canary.2 Next.js

high90%

App Router: a <Link> clicked while its prefetch is in flight commits with no <title> (and can commit an empty segment) — Pending segment-cache entry is handed to React as a plain promise

When a navigation clicks a Link during an in-flight prefetch, a pending segment-cache entry is passed to React as a plain promise. In partial or rejected prefetches the promise resolves to null, causing React to commit an empty segment and drop the document title.

V16.2.11 V16.3.5 Vcanary Next.js

high85%

Turbopack outputFileTracingIncludes glob walk crashes with ELOOP on pnpm nested workspace symlink cycles

When `outputFileTracingIncludes` is configured, the include-glob walk traverses the entire tracing root and follows symlinks without robust cycle detection. In legal pnpm workspaces where a package nested inside another declares its ancestor as dependency, this creates a self-embedding symlink chain that triggers ELOOP and fails the build.

V16.3.0 V16.3.1 V16.3.1-Canary.22 Next.js (Turbopack)

high85%

Turbopack first-wins module registration installs wrong factory for async loader with divergent bodies in different chunks

Turbopack emits the same async-loader module ID with different factories depending on chunk availability. The runtime's first-wins installation causes order-dependent behavior, leading to intermittent dynamic import failures: 'module factory is not available'.

V16.3.3 V16.4.0-Canary.12 Next.js

high92%

merge_message_runs raises for ChatMessage roles and FunctionMessage names that differ

The merge_message_runs utility attempts to merge consecutive ChatMessage or FunctionMessage objects based solely on message class, leading to ValueError when their identifying fields (role or name) differ. This violates expected behavior and breaks common message processing pipelines.

Vlangchain-Core 1.6.1 LangChain

high68%

Non-deterministic build output due to unordered CSS module processing

Next.js builds produce different file hashes for the same source code, caused by non-deterministic ordering of CSS modules during webpack compilation, affecting static export reproducibility.

V13.4.10 V14.2.0-Canary.17 Next.js

high95%

RunnableParallel ignores max_concurrency on ainvoke/astream while invoke/stream honour it

RunnableParallel's async execution paths (ainvoke and _atransform) do not read the `max_concurrency` configuration key, causing all branches to run concurrently and potentially violating downstream rate limits. The sync path correctly uses a thread pool with the configured limit.

V1.6.5 LangChain

Active Intelligence Feed🟢🟢🟢

core: SSRF-safe transports drop streaming request bodies and crash on internationalized hostnames

core: `InMemoryVectorStore` raises `NotImplementedError` for relevance-score search and the `similarity_score_threshold` retriever

SummarizationMiddleware bypasses PIIMiddleware and sends unredacted history to the summary model

Support bounded same-call 401 recovery for externally managed credentials in langchain.mcp

Docker Desktop macOS ignores host_binding_ipv4, exposing Supabase local dev ports to LAN

Pages Router: CSS shared by a page and a next/dynamic component is removed after client navigation

detached-flush never exits, leaking reparented process per next dev shutdown

Next.js Turbopack fails to load native Node addon in pnpm workspace

Jest Manual mocks stopped working in Next.js 13.2.4

Supabase hardening docs ALTER DEFAULT PRIVILEGES revoke execute on functions from PUBLIC has no effect due IN SCHEMA

Layout redirect during client navigation causes repeated ?_rsc requests and blank page

Turbopack fails to resolve next/package.json when pnpm v11 enableGlobalVirtualStore creates symlink outside project root

Scroll-to-top lost on navigation when root parallel-slot catch-all sits next to sibling dynamic segment (Next.js 16.3+ optimistic routing regression)

Next.js fails to generate static shell when generateMetadata uses runtime data with cacheComponents and htmlLimitedBots enabled

Static metadata rendered in <body> instead of <head> in Next.js 15.5.4

Turbopack runs swcPlugins after React Compiler, breaking Lingui macro message extraction

revalidateTag during streaming Route Handler response is silently dropped

Invalid tool call blocks are not filtered in langchain-groq and langchain-mistralai v1 converters

Turbopack asset rule for CSS query url fails in Server Components

redirect() silently fails and enters infinite render loop on client-side navigation to fully dynamic route with cacheComponents enabled

XMLOutputParser streaming drops valid Unicode root tags

Next.js 16.3.0+ published types break TypeScript <6 due to missing URLPatternInput/URLPatternOptions names

stdio sessions hang forever when a server never responds (no default read_timeout_seconds)

Strict route matching drops pages in sibling route groups when a parallel slot catch-all is present

App Router: a <Link> clicked while its prefetch is in flight commits with no <title> (and can commit an empty segment) — Pending segment-cache entry is handed to React as a plain promise

Turbopack outputFileTracingIncludes glob walk crashes with ELOOP on pnpm nested workspace symlink cycles

Turbopack first-wins module registration installs wrong factory for async loader with divergent bodies in different chunks

merge_message_runs raises for ChatMessage roles and FunctionMessage names that differ

Non-deterministic build output due to unordered CSS module processing

RunnableParallel ignores max_concurrency on ainvoke/astream while invoke/stream honour it

core: SSRF-safe transports drop streaming request bodies and crash on internationalized hostnames

core: `InMemoryVectorStore` raises `NotImplementedError` for relevance-score search and the `similarity_score_threshold` retriever

SummarizationMiddleware bypasses PIIMiddleware and sends unredacted history to the summary model

Support bounded same-call 401 recovery for externally managed credentials in langchain.mcp

Docker Desktop macOS ignores host_binding_ipv4, exposing Supabase local dev ports to LAN

Pages Router: CSS shared by a page and a next/dynamic component is removed after client navigation

detached-flush never exits, leaking reparented process per next dev shutdown

Next.js Turbopack fails to load native Node addon in pnpm workspace

Jest Manual mocks stopped working in Next.js 13.2.4

Supabase hardening docs ALTER DEFAULT PRIVILEGES revoke execute on functions from PUBLIC has no effect due IN SCHEMA

Layout redirect during client navigation causes repeated ?_rsc requests and blank page

Turbopack fails to resolve next/package.json when pnpm v11 enableGlobalVirtualStore creates symlink outside project root

Scroll-to-top lost on navigation when root parallel-slot catch-all sits next to sibling dynamic segment (Next.js 16.3+ optimistic routing regression)

Next.js fails to generate static shell when generateMetadata uses runtime data with cacheComponents and htmlLimitedBots enabled

Static metadata rendered in <body> instead of <head> in Next.js 15.5.4

Turbopack runs swcPlugins after React Compiler, breaking Lingui macro message extraction

revalidateTag during streaming Route Handler response is silently dropped

Invalid tool call blocks are not filtered in langchain-groq and langchain-mistralai v1 converters

Turbopack asset rule for CSS query url fails in Server Components

redirect() silently fails and enters infinite render loop on client-side navigation to fully dynamic route with cacheComponents enabled

XMLOutputParser streaming drops valid Unicode root tags

Next.js 16.3.0+ published types break TypeScript <6 due to missing URLPatternInput/URLPatternOptions names

stdio sessions hang forever when a server never responds (no default read_timeout_seconds)

Strict route matching drops pages in sibling route groups when a parallel slot catch-all is present

App Router: a <Link> clicked while its prefetch is in flight commits with no <title> (and can commit an empty segment) — Pending segment-cache entry is handed to React as a plain promise

Turbopack outputFileTracingIncludes glob walk crashes with ELOOP on pnpm nested workspace symlink cycles

Turbopack first-wins module registration installs wrong factory for async loader with divergent bodies in different chunks

merge_message_runs raises for ChatMessage roles and FunctionMessage names that differ

Non-deterministic build output due to unordered CSS module processing

RunnableParallel ignores max_concurrency on ainvoke/astream while invoke/stream honour it

Ecosystem Topology

Agent Frameworks

Vector Databases

Toolchains

Active Intelligence Feed