Severity
Reports at this severity, newest stored first.
On supabase.com, opening and closing a navbar mega-menu leaves a permanently mounted container (forceMount) that overlays hero content and intercepts pointer events, preventing text selection and CTA clicks.
Setting `"type": "commonjs"` in a Next.js project using Turbopack causes build and dev failures because Turbopack enforces the declared module format on App Router source files (which are written as ESM) and on generated `.next-internal` server-action entries, even though Webpack ignores this field. The issue affects all App Router files and internal virtual modules, not just the `'use client'` proxy previously fixed.
langchain-openai fails to classify errors embedded in HTTP 200 responses from OpenAI-compatible gateways. Non-streaming invoke raises a bare ValueError, streaming raises an unclassified openai.APIError, and Responses API raises ValueError. This prevents callers from accessing is_retryable and other ModelError attributes, breaking retry logic and potentially causing silent degradation.
The `_convert_to_v1_from_converse` translator in langchain-core drops redacted reasoning content blocks (e.g., from GPT-6 Sol/Luna/Astra via Bedrock), causing loss of reasoning context in multi-turn conversations when using `output_version="v1"`. This leads to the next turn not sending back the reasoning, potentially degrading model performance.
The langchain-mcp-adapters library discards structuredContent when an MCP tool returns isError=True. It raises _MCPToolExecutionError before reading the field and never attaches it to the resulting error ToolMessage, unlike the success path. This causes loss of machine-readable error payloads and leaves only a placeholder text when content is empty.
In langchain-core's _compat_bridge._iter_protocol_blocks, tool_call content blocks lacking an explicit index are keyed by ("__lc_no_index__", block_type, position_in_chunk). When Gemini streams parallel function calls as separate chunks each containing one complete tool_call block at position 0, the keys collide. _accumulate then overwrites the earlier block with the later one, silently dropping the first tool call. This leads to incorrect model behavior and, with Gemini 3, the lost call may carry the thought_signature, causing upstream validation issues or silent execution of only one of the requested tools.
When a dict is passed to EvaluationResult.feedback_config, the dataclass __post_init__ coerces it to FeedbackConfig, which ignores unknown fields. This causes silent data loss and contradicts the Union[FeedbackConfig, dict] type hint.
`InMemoryVectorStore.add_documents` and `aadd_documents` silently drop documents when the embedding model returns fewer vectors than the number of input documents. The root cause is the use of `zip(..., strict=False)` in the underlying `add_texts`/`aadd_texts` methods. A `ValueError` should be raised immediately to prevent silent data loss.
The `add_texts` method in `langchain-core` does not raise a `ValueError` when the number of provided IDs does not match the number of texts, despite the docstring stating otherwise. This leads to silent data loss as extra texts are discarded via `zip(strict=False)`. A regression from commit `6dd9f053e3` removed explicit validation.
Merging two AddableDict instances with different value types for the same key silently discards the left-hand value and replaces it with the right-hand value, potentially causing hidden data loss in LCEL stream aggregation.
BasePromptTemplate._validate_input uses isinstance(inner_input, dict) instead of collections.abc.Mapping, causing standard library mappings that are not dict subclasses to be mishandled. Single-variable templates silently render the mapping's repr into the prompt, while multi-variable templates raise a misleading TypeError. All template formats and both sync/async paths are affected. Fix is to check Mapping and convert to dict.
Using create_agent with response_format=ToolStrategy and a model returning an AIMessage without tool_calls results in a response missing the structured_response key instead of raising an error (handle_errors=False) or retrying (handle_errors=True), causing silent downstream failures.
When .bind(tools=[...]) is called before .with_structured_output(schema) on ChatOpenAI, the tool bindings are silently discarded from the HTTP request. The model returns a plausible but hallucinated structured output because the tools (e.g., web_search) were never sent to the API. This affects both OpenAI native tools and custom LangChain tools, and there is no error or warning.
When using Anthropic's compaction beta with LangChain agents, invoking with print_mode="messages" or streaming with stream_mode="messages" causes a BadRequestError because the message content includes an unsupported 'index' field in compaction blocks.
When optimisticRoutes is enabled and a path is rewritten (e.g., /team → /en/team), the client applies an optimistic navigation state based on the unrewritten URL. This incorrectly sets the locale (or other dynamic params) to the raw path segment instead of the rewritten value, leading to flashing 404s, wrong data fetching, or transient wrong locale rendering until the server response resolves.
When a deploymentId is configured, Server Action responses do not include the x-nextjs-deployment-id header, so stale clients cannot detect version skew and attempt to apply incompatible flight data, causing a Turbopack runtime crash.
PIIMiddleware's state hooks scan only the most recent message of each type, so PII in earlier human messages, tool results, or assistant messages is passed to the model unredacted and 'block' strategy does not raise. This can leak sensitive data when history is supplied by external systems or multi-agent handoffs.
The bundled mini-css-extract-plugin v2.4.4 in Next.js does not respect matchResource (`!=!`) in importModule, causing relative asset paths in CSS url() to resolve against the wrong directory. This breaks asset references for any webpack loader using matchResource to emit CSS. Fixed upstream in mini-css-extract-plugin v2.10.2.
With partialPrefetching enabled, dynamic pages are rendered four times per request (request, runtime prefetch, shell upgrade x2). Timers scheduled during each render capture AsyncLocalStorage context and retain large React Flight request and cache state, causing memory retention of ~3.8 MiB per request for a 10-minute timer, up to 45 GiB at 20 rps.
The HuggingFaceEndpoint class discards the explicitly provided huggingfacehub_api_token when endpoint_url points to a dedicated Inference Endpoint served from *.endpoints.huggingface.cloud, because the internal _is_huggingface_hosted_url check does not recognise this hostname. This causes requests to protected endpoints to be sent without an Authorization header, resulting in 401 Unauthorized, and may silently replace the explicit token with a cached or environment token if present.
The filesystem middleware reads and writes files using the system's locale encoding instead of UTF-8. On Windows and other non-UTF-8 locales, non-ASCII content such as accents or CJK characters raises UnicodeEncodeError/UnicodeDecodeError or silently writes files in a non-UTF-8 encoding, breaking interoperability and causing tool call failures.
ChatAnthropic._assert_valid_model_configuration() only rejects manual thinking for models starting with claude-opus-5. Anthropic also rejects manual thinking for claude-opus-4-7, claude-opus-4-8, and claude-sonnet-5, so LangChain forwards invalid requests and the API returns HTTP 400.
When Next.js is started with `-H 127.0.0.1` behind a reverse proxy that sets `X-Forwarded-Proto: https`, middleware rewrites targeting the same server are incorrectly treated as external and proxied over the network using the `https` scheme against the plain-HTTP port, resulting in `write EPROTO ... wrong version number` and a 500 response. The root cause is an asymmetric normalization of loopback hostnames between the router server's `initUrl` and the URL exposed to middleware.
When using HumanInTheLoopMiddleware with an async agent (agent.ainvoke), the middleware's aafter_model method delegates to synchronous after_model, which calls interrupt(). In the async execution path, the LangGraph config context variable is not set, causing get_config() to raise RuntimeError, breaking the approval flow.
A cancelled request to /_next/image leaves a stale in-flight promise in the image optimization cache, causing subsequent requests for the same image URL to hang indefinitely until server restart.
Next.js 16.3.x uses httpxy for rewrites with a shared keep-alive agent, which can reuse an idle socket at the same moment the upstream closes it, causing a race condition that intermittently returns 500 on the second socket connection.
ChatGroq.bind_tools() does not consult the resolved model profile's tool_calling capability. For models like allam-2-7b that LangChain's own profile marks as tool_calling=False, bind_tools still formats and sends tool definitions to the Groq API, which returns HTTP 400 with "tool calling is not supported with this model".
BaseCumulativeTransformOutputParser converts incoming AIMessage to BaseMessageChunk using chunk.model_dump(), but BaseMessageChunk lacks tool_calls, causing tool calls to be dropped. This results in empty stream/astream output for non-streaming chat models (e.g., disable_streaming="tool_calling") even though invoke works correctly.
在 next dev 使用 Turbopack 时，编辑经过 turbopack.rules 配置的 loader 处理的文件会触发 loader 链执行两次。第一次调用传入文件旧内容，第二次传入新内容。对于依赖文件 mtime 或自行读取文件系统的 loader（如 @tailwindcss/turbopack），可能导致缓存陈旧，最终输出滞后一个编辑版本。Webpack 模式无此问题。
next/jest transformer imports server runtime code that monkey-patches process event methods, causing test file process.on() calls to attach listeners to the real Jest process, leading to memory leaks across test files.