langchain-core 1.6.11

Source: https://github.com/langchain-ai/langchain
Tag scanned: langchain-core==1.6.11
Directory: libs/core (only this part of the repository was scanned)
Compared with: langchain-core==1.6.10 (0 signals introduced since)
Files: 372 scanned, 27 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 19 info
Scan time: 11.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 19 of 19 warn and critical signals; 19 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-17 01:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/_api/__init__.py:77:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Module-level lazy attribute loader caching imported names in globals.
Reasoning
This is the standard lazy-import __getattr__ pattern: import_attr resolves a name from a fixed module and the result is cached in globals. No untrusted input or code execution is shown; the reach-by-name is ordinary Python lazy loading.
info ~~warn~~ → info by review frame-introspection libs/core/langchain_core/_api/internal.py:8:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        frame = inspect.currentframe()
    except AttributeError:
        return False
```
likely benign LLM, confidence 0.90 Checks for frame introspection support to determine caller context.
Reasoning
inspect.currentframe() is used with an AttributeError guard, a common idiom to detect whether the interpreter supports frame introspection. It is used to determine caller context, not to exfiltrate or hide behaviour.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/callbacks/__init__.py:127:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the callbacks package.
Reasoning
Same standard lazy-import __getattr__ pattern from langchain_core as the other package __init__ files; the module names come from a static mapping.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/document_loaders/__init__.py:34:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the document_loaders package.
Reasoning
Standard lazy-import __getattr__ pattern with a static module mapping; no sensitive or dynamic execution beyond normal imports.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/documents/__init__.py:50:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the documents package.
Reasoning
Standard lazy-import __getattr__ pattern used for deferred submodule loading; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/embeddings/__init__.py:26:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the embeddings package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/example_selectors/__init__.py:42:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the example_selectors package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/indexing/__init__.py:48:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the indexing package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/language_models/__init__.py:111:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the language_models package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/load/__init__.py:39:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the load package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/messages/__init__.py:193:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the messages package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/output_parsers/__init__.py:96:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the output_parsers package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/outputs/__init__.py:61:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the outputs package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/prompts/__init__.py:96:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the prompts package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/runnables/__init__.py:131:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the runnables package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/tools/__init__.py:90:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the tools package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/tracers/__init__.py:45:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader for the tracers package.
Reasoning
Standard lazy-import __getattr__ pattern with globals caching; benign.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/utils/__init__.py:106:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Module-level __getattr__ implementing lazy attribute import for the langchain_core utils package, caching results in globals().
Reasoning
This is the standard PEP 562 lazy-loading pattern: a module-level __getattr__ imports the requested attribute via a relative import helper and caches it in globals(). The attribute name comes from the caller's attribute access on the package, not from untrusted input, and the import target is fixed by the package's own mapping. No network, shell, or encoded payload is involved.
info ~~warn~~ → info by review dynamic-attribute libs/core/langchain_core/vectorstores/__init__.py:43:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Module-level __getattr__ performing lazy submodule attribute loading for langchain_core vectorstores, caching into globals().
Reasoning
Same PEP 562 lazy-import idiom as the utils package: import_attr resolves a name against a fixed module mapping inside the package and caches it via globals(). This is a common performance pattern in large libraries and carries no obfuscation or malicious behavior in the snippet.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/langchain-ai/langchain langchain && cd langchain
git checkout langchain-core==1.6.11
disclude scan --severity info --diff langchain-core==1.6.10 libs/core