Severity
Reports at this severity, newest stored first.
The max_length parameter is not applied when using the lightweight 'sentencizer' pipeline, causing spaCy's default limit of 1,000,000 characters to be used instead of the user-specified limit.
When a blog category filter is active, paginated requests to /api-v2/blog-posts omit the category parameter, causing unfiltered posts to be appended to the list.
The @next/codemod next-lint-to-eslint-cli transform hardcodes npx to run @eslint/migrate-config, which is incorrect for pnpm projects and can lead to package manager mismatch, lockfile pollution, or failures in strict environments.
Three security regression tests in langchain-core's prompt loading tests unconditionally create symlinks, causing OSError [WinError 1314] on default Windows environments. This makes the core test suite fail for contributors without elevated privileges or Developer Mode, and the suite has no Windows CI to catch it.
Next.js reports an error that mentions 'searchParams' when the actual inaccessible dynamic data is 'params' inside a 'use cache' context. This misleads developers by pointing to the wrong property, causing confusion and wasted debugging time.
On Windows, path validation in FilesystemClaudeTextEditorMiddleware and FilesystemClaudeMemoryMiddleware rejects valid nested virtual paths due to backslash vs forward slash mismatch in allowed_prefixes comparison.
On Windows, FilesystemFileSearchMiddleware returns virtual paths containing native backslashes (e.g., '/src\\nested\\example.py') instead of the contract's forward-slash format, causing inconsistent and non-portable tool outputs.
When filtering a numeric column by value 0 in Supabase Table Editor, the visible rows are filtered correctly but the row count still reflects the unfiltered table because the count query omits the filter due to a truthiness check on the converted value 0.
In langchain-core, `merge_configs` calls `ensure_config` on each input, which injects `DEFAULT_RECURSION_LIMIT = 25` when absent. This makes an explicitly provided `recursion_limit=25` indistinguishable from the injected default, causing it to be silently removed from the merged config.
pgMeta.tables.update (primary_keys path) and pgMeta.columns.update (is_unique:false and check paths) build DO $$ ... $$ blocks that embed identifiers via ident(), causing syntax error when any identifier contains the literal byte sequence $$.
When filtering objects in the Storage explorer using the search box, deleting one or more of the filtered objects causes the file list to reset and display the full unfiltered bucket contents, while the search input still shows the filter text. This leaves the UI in an inconsistent state and may mislead users into thinking matching items still exist.
Following the Authentication with Cache Components guide with 'use cache: private' leads to one DB query per prefetched page link, multiplying user lookups. The documented pattern does not share cached user data across independent PPR requests.
本地开发时，Studio 由于 PG_META_CRYPTO_KEY 环境变量在 Docker Compose 和 Studio 之间不一致，导致无法读取数据库元数据。文档未提供同步说明，造成开发者环境不可用。
ModelRouterMiddleware._latest_human_message uses next() without a default, causing StopIteration to be converted into an opaque RuntimeError on both sync and async paths when no HumanMessage exists in the state. The error does not identify the middleware or the remedy.
ChatGroq in langchain-groq allows n=2 during construction for non-streaming requests, sending an invalid parameter to the Groq API which returns HTTP 400.
After #50516, legacy JWT API keys are masked in ConnectSheet, but reveal/copy actions incorrectly call the secret key reveal API which fails on Supabase-managed projects, preventing users from accessing their service_role key.
In Supabase Dashboard Authentication > Users, the user details drawer cannot be closed using the top-right close/collapse control. The panel remains open until navigating away; no JavaScript errors are logged.
The Supabase local development configuration documentation still shows `[inbucket]` even though the CLI was updated to use `[local_smtp]` backed by Mailpit. This causes confusion and misconfiguration when users copy outdated settings.
Supabase documentation for AI tools suggests installing plugins via `npx plugins`, but the npm package `plugins` is unmaintained and its GitHub repository returns 404. Vercel has moved this functionality to the `skills` CLI, so the docs should be updated.
In Next.js 16.3.5-16.4.0-canary.32, a redirect() inside a Suspense boundary in a layout triggers an instant navigation validation error on every warm request, although redirect is intentional control flow. This suppresses genuine blocking-prerender-dynamic findings on the same route.
The `_convert_content_block` function in `langchain.mcp` silently discards metadata fields (name, title, description, size, and URI for embedded resources) when converting MCP `ResourceLink` and `EmbeddedResource` objects to LangChain content blocks, leading to loss of information.
Blob.as_string() uses the default 'utf-8' encoding, which does not strip a UTF-8 byte order mark (BOM). Files written by Windows tools (Notepad, PowerShell, etc.) often include a BOM, and this BOM is returned as part of the string, contaminating downstream processing such as Markdown heading parsing.
The observability/inspect documentation page contains a Query performance section with multiple broken links and lists several deprecated Supabase CLI inspect subcommands. This misleads users into using outdated commands and leads to dead links. The fix updates the section to reflect the current CLI subcommands, removes deprecated entries from the main list, and adds a deprecation notice.
During background revalidation of partially prerendered (PPR) routes, Next.js reads the Link header from the already-finished response object instead of from the values React passed to appendHeader, causing Flight-triggered regenerations to store no Link header and lose font preload hints.
The standard chat model integration tests in langchain-tests 1.1.9 verify that input_tokens, output_tokens, and total_tokens are integers but do not assert that total_tokens equals the sum of input_tokens and output_tokens. A model can report inconsistent usage metadata (e.g., input_tokens=10, output_tokens=105, total_tokens=15) and still pass both test_usage_metadata and test_usage_metadata_streaming.
26 unit tests across test_shell_tool.py and test_shell_execution_policies.py fail on Windows because ShellToolMiddleware hardcodes /bin/bash, uses POSIX-only signals and the resource module, and the tests lack platform skip markers or proper patching of the _HAS_RESOURCE flag.
Client-side next/form string actions append FormData entries to URLSearchParams without normalizing line endings according to the HTML specification, causing LF-only line breaks instead of CRLF.
When using dynamic(..., { ssr: false }) in the Pages Router, if a sibling Suspense boundary throws during hydration and React retries after the dynamic import has resolved, the loader's useSyncExternalStore uses the current loaded state as the server snapshot. This causes React to see a mismatch between the server-rendered loading state and the now-loaded client state, discarding the server-rendered DOM and falling back to client rendering.
Next.js 16.4.0-canary.22 with Turbopack and experimental cacheComponents reports a dev validation error when a page uses a dynamic import for a client component. The page renders but the validation worker fails with 'module factory is unavailable'. Static imports or disabling devValidationWorker resolve the issue.
11 of 12 branching endpoints document only 500 while API returns 401/403/429; GET /v1/branches/{id}/diff uniquely requires environment:write scope but docs don't explain why, causing generated clients to mishandle auth failures and integrators to request excessive permissions.