LangChain
Published reports for this stack, with severity, affected version, and a direct path into each diagnostic.
Streaming with XMLOutputParser silently loses data when the root XML element uses a valid Unicode name (e.g., Chinese tags). The parser's start-tag detection regex only matches ASCII letters, colon, and underscore, causing it to skip Unicode roots and either return empty output or omit the root hierarchy.
langchain_mcp_adapters.sessions._create_stdio_session constructs an MCP ClientSession without a default read_timeout_seconds, so any request to a non-responsive stdio server (e.g., during initialize()/call_tool()/list_tools()) blocks indefinitely. The MCP SDK already supports per-request timeouts via read_timeout_seconds; this library simply fails to set a default.
The merge_message_runs utility attempts to merge consecutive ChatMessage or FunctionMessage objects based solely on message class, leading to ValueError when their identifying fields (role or name) differ. This violates expected behavior and breaks common message processing pipelines.
RunnableParallel's async execution paths (ainvoke and _atransform) do not read the `max_concurrency` configuration key, causing all branches to run concurrently and potentially violating downstream rate limits. The sync path correctly uses a thread pool with the configured limit.
The OpenAI and ChatOpenAI classes in langchain-openai default to gpt-3.5-turbo-instruct and gpt-3.5-turbo respectively. OpenAI shut down gpt-3.5-turbo-instruct on September 28, 2026, and gpt-3.5-turbo will be shut down on October 23, 2026. Users who do not explicitly pass a model will encounter API errors. The recommended replacement gpt-5.6-terra is a reasoning model and does not support the legacy completions endpoint, requiring a strategic change to defaults.
Calling stream() or astream() on ChatPerplexity with a stop argument raises TypeError because the streaming implementation incorrectly sends stop_sequences (an Anthropic parameter) to Perplexity's Chat Completions API, which only accepts stop. The bug breaks streaming for any user passing stop sequences.
The Tee context manager in langchain-core does not close the underlying source generator if one or more child iterators are never started, causing resource leaks.
ShellToolMiddleware.aafter_agent synchronously executes shutdown commands on the event loop, starving unrelated async tasks; delegate to run_in_executor like abefore_agent.
InMemoryRecordManager treats an explicitly provided empty list for group_ids as if it were None because of truthiness checks. This causes update() to skip length validation and store records with group_id=None, and list_keys() to return all keys instead of an empty result when group_ids=[] is passed. The async methods have the same issue.
The on_tool_error callback does not receive the arbitrary keyword arguments (e.g., tenant, trace_id) that were passed to tool.invoke, while on_tool_start and on_tool_end do. This inconsistency causes loss of critical context during error handling.
In langchain's retry middleware, `should_retry_exception` checks `callable(retry_on)` before `isinstance`, treating exception classes as callables. Passing a single exception class (e.g. `TimeoutError`) invokes the class with the exception, returning a truthy exception instance, causing every exception to be retried regardless of the intended filter.
The helper function _get_data_content_block_types() reconstructs its result from get_args and get_type_hints on every call, even though the result is immutable at runtime. This is called repeatedly by is_data_content_block, leading to ~23ms CPU per ChatOpenAI payload for a 204-message history, blocking the event loop in async applications.
langchain-core 1.6.6 contains two type contract inconsistencies: import_attr accepts package=None but raises TypeError due to always using relative imports, and AIMessage/AIMessageChunk.content_blocks return list[str] when content is a list of strings, violating the declared return type list[ContentBlock].
The bare URL pattern in detect_url incorrectly matches patterns like 'Node.js/Express', '1.5/2.0', and 'python3.12/site-packages', leading to redaction or blocking of non-URL content.
NomicEmbeddings.embed_image passes self.vision_model=None unconditionally to nomic.embed.image, overriding the SDK's default 'nomic-embed-vision-v1.5'; the SDK's response model assertion then fails with an empty AssertionError. The constructor overloads also omit vision_model, causing mypy call-overload errors.
In langchain-core v3 streaming, tool-call argument deltas are emitted as full snapshots of accumulated state, leading to O(n^2) event sizes for large arguments. This causes severe performance degradation and memory overhead in LangGraph Server and any consumer of the event stream.
Constructing ChatOllama, Ollama, or OllamaEmbeddings with a non-empty `client_kwargs` dict mutates that dict and its nested `headers` dict by injecting an `Authorization` header derived from base_url credentials. This leaks credentials into caller-owned objects and causes credentials from one URL to be sent to other hosts when the same dict is reused.
When using ChatOllama with tool calling, ToolMessages are sent without the required tool_name field, so Ollama renders them as coming from an unknown tool. This breaks tool result matching for models that rely on the name, like Gemma 4.
ShellToolMiddleware currently defaults to HostExecutionPolicy, allowing arbitrary shell commands with only LLM guardrails. This feature request proposes an allow_list parameter to restrict executable commands, mitigating the risk of dangerous operations.
Feature request to add SiaMeshTool that scrapes web content via a third-party endpoint using x402 Solana USDC micro-payments. The endpoint is not officially vetted and could expose users to prompt injection, SSRF, or financial loss if compromised.
The feature request proposes adding a SiaMeshTool that uses x402 micropayments and sanitized scraping. Without proper validation, error handling, and security review, this could expose agents to malicious endpoints, prompt injection, and payment interception.
The feature request proposes adding a SiaMeshTool that scrapes URLs via a hardcoded third-party endpoint with x402 micro-payments. If implemented naively, it exposes LangChain agents to SSRF attacks aimed at internal services and allows unauthorized micro-payments.
The grep_search method in FilesystemFileSearchMiddleware fails to fall back to the Python search when ripgrep exits with an error (return code 2), because _ripgrep_search returns an empty dict instead of None when ripgrep rejects the regex pattern. This leads to a false 'No matches found' response for valid Python regexes like look-ahead/look-behind. Additionally, the max_file_size_mb parameter is not applied to the ripgrep command, causing inconsistent results between ripgrep and Python fallback paths.
The default `text_format='string'` path in `convert_to_openai_messages` directly accesses `block["type"]` while collapsing content blocks, causing a `KeyError` for legitimate Bedrock Converse content blocks that lack a `type` key. The same blocks pass through correctly when `text_format='block'` is used, violating the promise of `pass_through_unknown_blocks=True`.
In langchain-core, `merge_configs` calls `ensure_config` on each input, which injects `DEFAULT_RECURSION_LIMIT = 25` when absent. This makes an explicitly provided `recursion_limit=25` indistinguishable from the injected default, causing it to be silently removed from the merged config.
On Windows, FilesystemFileSearchMiddleware returns virtual paths containing native backslashes (e.g., '/src\\nested\\example.py') instead of the contract's forward-slash format, causing inconsistent and non-portable tool outputs.
On Windows, path validation in FilesystemClaudeTextEditorMiddleware and FilesystemClaudeMemoryMiddleware rejects valid nested virtual paths due to backslash vs forward slash mismatch in allowed_prefixes comparison.
Three security regression tests in langchain-core's prompt loading tests unconditionally create symlinks, causing OSError [WinError 1314] on default Windows environments. This makes the core test suite fail for contributors without elevated privileges or Developer Mode, and the suite has no Windows CI to catch it.
The max_length parameter is not applied when using the lightweight 'sentencizer' pipeline, causing spaCy's default limit of 1,000,000 characters to be used instead of the user-specified limit.
ChatDeepSeek only overrides sync `_generate` and `_stream` to translate `JSONDecodeError` from the OpenAI SDK into a DeepSeek-specific message. The inherited async `_agenerate` and `_astream` are not wrapped, so async callers still receive the opaque `json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)`.