Severity
Reports at this severity, newest stored first.
XMLOutputParser.parse() raises OutputParserException for valid XML where a non-declaration element has an encoding attribute and the opening tag is followed by a newline. The regex used to remove the XML declaration is too broad and matches such element tags, causing the parser to remove the opening tag and produce malformed XML.
Next.js client bundles include unused constants from next/dist/shared/lib/constants.js and next/dist/lib/constants.js because client entrypoints resolve to CommonJS files, preventing Webpack/Turbopack from performing tree shaking. A user-provided webpack workaround redirects imports to ESM equivalents.
useGitHubAuthorizationQuery makes redundant retries (3x by default) for 404 responses because retry: false specified in a FIXME was not implemented.
Streaming large tool call arguments through (prompt | model).stream() or with_structured_output(...).stream() triggers repeated parse_partial_json calls on every AIMessageChunk addition, causing quadratic CPU time as arguments grow.
In Next.js dev with Turbopack, editing a file after client-side navigation does not trigger hot module replacement until a manual page reload. The HMR subscription for the new route is not registered after client navigation.
ContextThreadPoolExecutor.map() calls len(iterables[0]) to preallocate contexts, which raises TypeError for generators and other unsized iterables, even though the standard ThreadPoolExecutor.map() accepts them. The proposed fix delegates directly to super().map(), relying on the existing submit() override for context propagation.
When `HumanInTheLoopMiddleware` is configured with an `InterruptOnConfig` that includes an explicit `args_schema`, the generated `ReviewConfig` in the interrupt payload omits that schema. This is a silent configuration failure: the schema is accepted but not propagated, preventing schema-driven client-side handling.
The AI rename feature in the Supabase Dashboard SQL Editor fetches a valid title and description from the AI endpoint, but the Name field in the Rename dialog remains unchanged after the loading state finishes.
The elevenlabs-speech-to-text Edge Function README references a non-existent BotFather screenshot, causing a broken image on GitHub.
The Supabase Realtime broadcast documentation contains contradictory inline comments for the `private` parameter in SQL examples. Two of three examples reverse the meaning of `true` and `false`, and none explain what the boolean actually does. This can lead developers to accidentally send messages to the wrong channel type (public vs private), causing authorization bypass or unexpected visibility. The underlying SQL functions define `private => true` as private channel (default) and `false` as public channel.
Next.js 16.3.8 with Turbopack shows a hydration error overlay when Cursor's built-in browser stamps data-cursor-ref attributes on DOM nodes. The attribute is not in server HTML or the React tree, so the mismatch is a false positive.
When building with bun --bun, Next.js logs a spurious error about usePathname outside Suspense for routes with fallback params, even though the component is inside Suspense. Root cause is an unhandled promise rejection in the aborted branch of makeHangingPromiseWithError, which Bun does not filter because AsyncLocalStorage context is missing in unhandledRejection listeners.
When navigating to a route that introduces a new nested layout, Next.js scrolls to the page segment instead of the top of the newly mounted layout, causing the layout's heading and intro content to be bypassed. This occurs because the scroll ref is only accumulated for leaf segments in render-tree.ts.
Three trigger function examples in examples/prompts/use-realtime.md have incorrectly placed AS $$, resulting in invalid SQL that cannot be executed.
The Supabase realtime prompt documentation contains an invalid PostgreSQL row-level security policy example that uses USING with FOR INSERT. This prevents users from creating the documented private-channel write policy.
The JavaScript v2 reference contributor instructions in apps/docs/CONTRIBUTING.md still direct authors to edit apps/docs/spec/supabase_js_v2.yml and describe legacy $ref extraction, even though JavaScript v2 now uses the TypeDoc pipeline and is excluded from the legacy generator. This misleads contributors and hides the active authoring workflow.
When using Incremental Static Generation (ISG) via `unstable_revalidate`, a custom `_app` component's `getInitialProps` may attempt to set response headers (e.g. Cache-Control) after the page response has already been sent. In production this triggers 'Cannot set headers after they are sent' errors or silently overrides the ISG page's cache headers, while development mode does not reproduce the issue.
The splitter terminates fenced code blocks whenever it sees any line of three or more backticks or tildes, ignoring CommonMark rules that require a closing fence to match the opening character and have at least the opening length. This creates extra chunks and wrong `Code` metadata when the content includes an inner shorter fence or a mismatched fence.
When `ensure_ascii=False` is passed to `split_text`, `_json_size` still measures using `json.dumps` with default `ensure_ascii=True`, causing non-ASCII chunks to be far below `max_chunk_size` and producing more chunks than expected.
When an input raises an exception not in exceptions_to_handle, batch/abatch re-raise immediately, skipping the cleanup loop that closes root callback runs, causing them to remain pending forever in tracers like LangSmith.
The Supabase documentation example for assigning role custom claims with Firebase Admin SDK incorrectly references `userRecord.id`, which does not exist on Firebase UserRecord objects. The correct property is `userRecord.uid`. Following the example as written causes a runtime error when calling `setCustomUserClaims` with `undefined` as the user identifier.
On mobile/tablet, opening the search modal while the hamburger menu is open leaves the menu overlapping the search interface, causing a UX issue. The menu should automatically close when search is triggered.
The React pattern in examples/prompts/use-realtime.md contains a syntax error due to using await inside a synchronous useEffect callback, preventing users from copying the example. The fix wraps the asynchronous setup in an inner async function and returns a proper cleanup function.
In langchain-core's test_convert_to_openai_data_block, the Responses API file/url case sets up test data but never calls the conversion function or asserts the result, leaving the branch untested. The fix adds the missing call and assertion.
When ModelFallbackMiddleware falls back to ChatAnthropicMantle (langchain-aws), cache_control markers are silently removed from both model_settings and message content blocks, disabling prompt caching and increasing costs. The root cause is a missing _llm_type in _ANTHROPIC_LLM_TYPES.
Current batched HITL interrupts force approval UIs to infer tool action context from positional lists and skip response validation, leading to fragile integrations and potential stuck threads. This change adds per-call interrupts with typed tool_approval values and per-tool response_schema validation.
PromptTemplate.from_template("Value: {}") is accepted silently, reports an empty input variable, and then raises IndexError on every .format() call. It should be rejected at creation time with a clear ValueError, consistent with the all-digit `{0}` case.
Two unit tests in the langchain package (tests/unit_tests/test_version.py and tests/unit_tests/test_dependencies.py) open pyproject.toml using Path.open() without specifying encoding. On Windows systems with a non-UTF-8 locale (e.g., cp936), Python defaults to the locale encoding, causing UnicodeDecodeError when encountering UTF-8 bytes. The fix is to pass encoding="utf-8" to the open calls.
Multiple unit test call sites read pyproject.toml without specifying encoding='utf-8'. On Windows with a non-UTF-8 locale (e.g., cp936), Python defaults to the ANSI code page, leading to UnicodeDecodeError because the file is valid UTF-8 and contains non-ASCII characters. Issue #40588 fixed two call sites, but two remain: one active in langchain_v1 summarization tests and one latent in langchain-classic dependencies tests.
The ImportError messages raised when importing moved REPL tools/agents in langchain-classic contain outdated and dead links to SECURITY.md and a GitHub discussion, and have missing spaces causing link concatenation. This leads users to 404 pages or broken links, reducing safety guidance.