LangChain
Published reports for this stack, with severity, affected version, and a direct path into each diagnostic.
ChatGroq.bind_tools() does not consult the resolved model profile's tool_calling capability. For models like allam-2-7b that LangChain's own profile marks as tool_calling=False, bind_tools still formats and sends tool definitions to the Groq API, which returns HTTP 400 with "tool calling is not supported with this model".
BaseCumulativeTransformOutputParser converts incoming AIMessage to BaseMessageChunk using chunk.model_dump(), but BaseMessageChunk lacks tool_calls, causing tool calls to be dropped. This results in empty stream/astream output for non-streaming chat models (e.g., disable_streaming="tool_calling") even though invoke works correctly.
The ModelRouterMiddleware directly indexes self.models with classifier-provided choice, causing an opaque KeyError if the choice is not a configured route. This occurs for malformed or unexpected classifier responses, preventing clear error handling.
ChatAnthropic's message serialization for SystemMessage does not preserve additional_kwargs such as output_config and clear_at. This causes per-message effort changes to be silently ignored and turn-scoped instructions to become persistent across later turns. Claude Sonnet 5.5 is also not recognized by the message-level system message capability check.
A tool using `InjectedToolCallId` receives the wrong tool_call_id when the custom args_schema omits the injected field and the ToolCall args contain a key `tool_call_id`. The runtime ToolCall.id should always win, but currently the user-provided value from args is used, causing mismatch between tool body and ToolMessage.
The MarkdownListOutputParser in langchain-core uses a regex that only matches '-' and '*' as bullet markers, omitting '+'. As a result, parsing a Markdown list with '+' bullets returns an empty list instead of the expected items, causing silent data loss.
ChatOpenAI with use_responses_api=True sends temperature, top_p, and top_logprobs to the Responses API for gpt-6-astra, which does not support them, causing HTTP 400 errors. The issue is reproduced with langchain-openai==1.6.6.
When using langchain-openai with model o3 or o4-mini, passing a non-empty stop parameter results in a 400 error from OpenAI. The library does not validate unsupported parameters for these models.
Calling ChatPerplexity.stream() with a stop argument raises TypeError because the integration incorrectly forwards the stop parameter to the Perplexity API as an unsupported keyword or in an unexpected type, breaking streaming and likely all calls with stop.
When `from __future__ import annotations` is used, stringized type annotations are not resolved in the correct namespace for `RunnableLambda` and `RunnableGenerator`, causing `PydanticUserError` or empty tool argument schemas during `as_tool()` conversion, even though direct invocation works.
The QdrantVectorStore MMR retriever passes LangChain's lambda_mult as Qdrant's diversity parameter, but Qdrant interprets diversity as 1 - lambda, resulting in inverted behavior: lambda_mult=0.0 maximizes relevance instead of diversity.
The mustache renderer in langchain-core miscounts section nesting when an inverted section with the same key is nested inside a regular list section. This leads to silently wrong output (e.g., '[[]' instead of '[a][b]') or an IndexError. The depth counter used to handle nested regular sections only increments for 'section' tokens, not for 'inverted section' tokens, causing the inner closing tag to be misinterpreted as the outer section's end.
The SummarizationMiddleware uses a hardcoded check on model._llm_type to apply Claude-specific token calibration. For ChatBedrockConverse (and ChatBedrock), _llm_type is 'amazon_bedrock_converse_chat', which does not match the expected 'anthropic-chat' prefix. As a result, it falls back to the generic chars_per_token=4.0 instead of Claude's calibrated 3.3, underestimating token counts by ~20%. This leads to summarization triggering too late and can cause model calls to fail with 'Input is too long for requested model'.
The RunnableWithFallbacks methods mutate the caller-provided input dictionary by inserting the exception_key, violating expected immutability and causing unexpected side effects across all six entry points (invoke, ainvoke, batch, abatch, stream, astream).
When PIIMiddleware is configured with apply_to_output=True and the model streams tool call arguments in multiple chunks, the streaming redaction path treats each chunk's args fragment as complete JSON. Since each fragment is an invalid JSON string, the redactor returns an empty value, causing all tool call arguments to be erased. This leads to tool execution with no arguments and eventually a GraphRecursionError.
When streaming a chat completion, a tool-call delta chunk that includes a null `function` field causes an `AttributeError` inside `_convert_delta_to_message_chunk`. The public `ChatOpenAI.stream()` API terminates unexpectedly instead of ignoring the empty field or preserving the partial tool call.
An injected tool argument declared with a Pydantic alias (e.g., Field(alias="private_token")) is not stripped from the inputs and input_str passed to on_tool_start callbacks, leaking internal sentinel values to tracing backends.
LangChain agent using Anthropic's web_search_20260209 tool intermittently fails with a 400 error because the request payload includes a code_execution tool_use without a corresponding code_execution_tool_result. This occurs when web_search triggers automatic code_execution and LangChain's message handling drops the tool result.
When a step inside RunnableSequence raises an exception during astream(), the exception is caught internally and the stream closes without surfacing the error to the caller. Sync stream() and async ainvoke() propagate correctly; only the async streaming path is affected.
An edit decision can change a tool call from tool A to tool B, but the resulting call is evaluated only against tool A's InterruptOnConfig. If tool B has its own interrupt_on policy, it is silently skipped, allowing execution without the required human approval.
A malformed tool call entry (missing 'function' or 'index') in a streaming OpenAI response causes _convert_delta_to_message_chunk to silently discard all tool call chunks due to a broad except KeyError: pass around a list comprehension.
When an MCP tool defines an input parameter named 'config' (or 'run_manager' or 'callbacks'), LangChain's StructuredTool invocation overwrites the user-supplied value with the internal RunnableConfig dict, causing silent data corruption and incorrect tool behavior.
The v2 implementation of astream_events fails to emit terminal error events (on_chain_error, on_llm_error, on_chat_model_error, on_retriever_error) when a tracked run raises an exception. Only the corresponding start event is emitted, leaving consumers unable to reliably determine that a run terminated unsuccessfully.
SummarizationMiddleware silently deletes conversation history and inserts the placeholder 'Previous conversation was too long to summarize.' when the only HumanMessage is outside the trimmed token window. The summary model is never called, and with a checkpointer the data loss is persisted.
When using ChatDeepSeek with default thinking mode enabled, bind_tools(tool_choice='any') (or True) gets normalized to tool_choice='required', which DeepSeek API rejects with HTTP 400. This is due to lack of validation in ChatDeepSeek for thinking mode constraints.
SSRFSafeTransport and SSRFSafeSyncTransport reconstruct pinned requests using request.content and hostname.encode('ascii'). This raises httpx.RequestNotRead for streaming bodies (generators, async generators, files, multipart) and UnicodeEncodeError for internationalized domain names, causing silent failures or crashes in URL-based utilities such as HTMLHeaderTextSplitter and ChatOpenAI token counting.
`InMemoryVectorStore` does not override `_select_relevance_score_fn`, so `similarity_search_with_relevance_scores` and the `similarity_score_threshold` retriever raise `NotImplementedError` even though the store computes cosine similarity internally.
SummarizationMiddleware invokes the summary model directly inside its before_model hook, bypassing the agent middleware pipeline. This means PIIMiddleware (including strategy='block') never inspects or redacts the summary prompt, allowing PII such as email addresses to be sent to an external summarization provider silently. The issue occurs regardless of middleware ordering in the affected versions unless external sanitization is added.
The langchain.mcp MCPAdapter lacks a supported path for externally managed bearer credentials to recover from HTTP 401 by re-reading tokens and retrying the same operation. The existing FastMCP/httpx2.Auth injection seam is undocumented and untested for this scenario, and terminal 401 errors are often swallowed or converted to generic errors by the MCP SDK, blocking classification. This issue requests a bounded, request-local retry mechanism and proper error propagation.
The v1 message converters in langchain-groq and langchain-mistralai do not filter out invalid_tool_call blocks, causing them to be passed to Groq and Mistral APIs. These providers may reject such blocks when replaying partial or malformed tool-call history, leading to runtime errors. Other providers (OpenAI, Anthropic, Fireworks) already filter these blocks.