Severity
Reports at this severity, newest stored first.
The ImportError messages raised when importing moved REPL tools/agents in langchain-classic contain outdated and dead links to SECURITY.md and a GitHub discussion, and have missing spaces causing link concatenation. This leads users to 404 pages or broken links, reducing safety guidance.
Docstring examples in langchain-core reference modules 'langchain_core.output_parser', 'langchain_core.runnable', and 'langchain_core.documents' which do not exist, causing ModuleNotFoundError or ImportError when copied. The correct modules are 'langchain_core.output_parsers', 'langchain_core.runnables', and 'langchain_core.documents.base'.
Next.js metadata routes such as sitemap and robots are prerendered and respect revalidate, but their Cache-Control header is hardcoded to 'public, max-age=0, must-revalidate' instead of using s-maxage like other ISR routes. This prevents CDNs from caching these routes efficiently, especially in self-hosted environments.
The SSL Configuration documentation page lacks clear navigation to find SSL settings in the dashboard, causing user confusion.
When cacheComponents is enabled in Next.js 16.1.0-canary.16, dynamic routes that receive an already decoded percent sign (%) from a URL-encoded %25 trigger a 500 Internal Server Error due to invalid URI decoding during cache key generation.
Studio's default-privileges state query uses an inner join to pg_roles, excluding PUBLIC grants (grantee OID 0) from aclexplode, causing grants TO PUBLIC to be invisible and grant_count to be 0.
When importing a moved agent (e.g., create_csv_agent) from langchain_classic.agents.agent_toolkits, the __getattr__ helper incorrectly calls as_import_path without specifying relative_to, causing a ValueError from langchain_core instead of the intended ImportError with migration guidance.
ChatOpenAI with extra_body={"enable_thinking": true} and bind_tools(..., tool_choice="get_weather") sends a named tool-choice object to Alibaba DashScope, which rejects it with InternalError.Algo.InvalidParameter. LangChain should validate this incompatible combination before sending the request.
When using create-next-app without an example (i.e., built-in template), the CLI does not print the 'Inside that directory...' instructions because the hasPackageJson flag is never set to true in the template branch.
The @wrap_tool_call decorator does not accept or propagate a context_schema parameter, so the returned AgentMiddleware always types ContextT as None. When used with create_agent(context_schema=AgentContext), the invariant ContextT generic causes a type error, even though the runtime behavior may be correct.
langchain-mcp-adapters does not pass the MCP `_meta` field from tool arguments to the MCP SDK's `call_tool()`, preventing per-request metadata like session IDs, routing tags, or tenant context from reaching MCP servers.
The `limit` parameter is treated as falsy when `0`, causing all keys to be returned instead of an empty list for both `list_keys` and `alist_keys`.
Under Bun 1.4.2, Next.js 16.4.0 logs false 'unhandledRejection' errors for CLIENT_HOOK_DYNAMIC because the rejection filter relies solely on workUnitAsyncStorage.getStore(), which Bun does not restore in unhandledRejection listeners. This produces hundreds of build log errors despite successful builds and can hide real failures.
When both [local_smtp].enabled and [auth.email.smtp].enabled are true in config.toml, the Supabase CLI configures the auth service to use the real SMTP server instead of the local test SMTP server.
The issue requests adding documentation for integrating DeadendCallbackHandler, a third-party runtime circuit breaker, into LangChain agents to block prompt injection and RCE payloads at the on_tool_start phase before tool execution.
在 next start 使用文件系统缓存时，revalidateTag 立即过期标签后，由于写入过期时间使用 Date.now()（墙上时钟），而读取判断使用 performance.timeOrigin + performance.now()（单调时钟），两者存在进程启动时的几毫秒偏移，导致过期标签在短时间内仍被视为未过期，从而继续提供旧缓存页面。
Feature request to integrate SiaMesh as a LangChain tool for secure web scraping with x402 micro-payments. The proposed solution adds a new SiaMeshTool class that wraps the public endpoint, enabling agents to scrape URLs while handling payment and anti-prompt-injection sanitization.
Supabase Studio Table Editor's updateTable compares primary key column names in display order with the server's key order, causing false positives for renaming or composite PK ordering, leading to unnecessary PK drop/re-add and failures when foreign keys depend on the PK.
The feature request proposes adding a SiaMeshTool to LangChain for secure scraping via the x402 payment protocol. While it addresses prompt injection and bot protection, the integration as described relies on a centralized external service with no local fallback, lacks input validation, and couples the tool to Solana payments.
Fireworks integration lacks parsing of the X-LangSmith-Gateway-Metadata header on successful responses when using LANGSMITH_GATEWAY, causing missing gateway info and incorrect model/provider in traces.
ChatFireworks does not parse the X-LangSmith-Gateway-Metadata header on successful responses when routed through the LangSmith LLM Gateway, unlike ChatOpenAI and ChatAnthropic. This causes traces to miss gateway info such as the actually resolved model and provider, leading to incorrect cost tracking and inconsistent behavior across integrations.
Next.js 16.x with Turbopack and pnpm emits a false 'Module not found' warning for styled-jsx/style.js during Pages Router builds, even though the build succeeds and the file is traced.
Using styled-jsx in a Pages Router application with pnpm triggers a false 'Module not found' warning during Turbopack builds. The warning occurs because Turbopack's external tracing attempts to resolve styled-jsx/style.js from the project root, but pnpm's strict node_modules layout does not hoist styled-jsx to the root. The build still succeeds and the file is correctly traced via Next.js's own require hooks.
Supabase dashboard prevents users on the free plan from creating a second project in an organization that already has one active project, despite the free tier historically allowing two active projects. The UI does not display any project limit or quota error, leaving the user unable to determine whether the block is intentional.
The reported Supabase project restore remains stuck indefinitely. Given the sparse issue details, the most probable root cause is a restore transaction blocked by long-running queries or lock contention, with no configured timeout or progress tracking.
ChatFireworks does not capture the X-LangSmith-Gateway-Metadata header from successful gateway-routed responses, causing missing or incorrect model/provider information in LangSmith traces. This fix adds gateway metadata capture conditioned on the lsv2_ API key prefix, mirroring OpenAI and Anthropic integrations.