PyPI / langchain-core / 1.6.12

langchain-core 1.6.12

Source

https://github.com/langchain-ai/langchain

Tag scanned

langchain-core==1.6.12

Directory

libs/core (only this part of the repository was scanned)

Compared with

langchain-core==1.6.11 (0 signals introduced since)

Files

372 scanned, 27 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 19 info

Scan time

11.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 19 of 19 warn and critical signals; 19 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-17 01:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-attribute libs/core/langchain_core/_api/__init__.py:77:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-loading __getattr__ pattern: resolves a named attribute via import_attr and caches it in globals. Legitimate module-level lazy import idiom, consistent with the other __init__ files.

2. info warn → info by review frame-introspection libs/core/langchain_core/_api/internal.py:8:17

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       try:
           frame = inspect.currentframe()
       except AttributeError:
           return False

   likely benign LLM, confidence 0.90 Call-stack frame introspection guarded for platforms lacking currentframe.

   Reasoning

   inspect.currentframe() is used with an AttributeError guard, typical for detecting caller context in a utility (e.g., whether a function is called from within a module). No exfiltration or evasion evident.

3. info warn → info by review dynamic-attribute libs/core/langchain_core/callbacks/__init__.py:127:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Same standard lazy-import __getattr__ idiom as the other package __init__ files in langchain_core.

4. info warn → info by review dynamic-attribute libs/core/langchain_core/document_loaders/__init__.py:34:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern with no dynamic code execution or encoded payload.

5. info warn → info by review dynamic-attribute libs/core/langchain_core/documents/__init__.py:50:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern; the import target is a module path resolved through import_attr, not attacker-controlled input.

6. info warn → info by review dynamic-attribute libs/core/langchain_core/embeddings/__init__.py:26:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

7. info warn → info by review dynamic-attribute libs/core/langchain_core/example_selectors/__init__.py:42:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

8. info warn → info by review dynamic-attribute libs/core/langchain_core/indexing/__init__.py:48:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

9. info warn → info by review dynamic-attribute libs/core/langchain_core/language_models/__init__.py:111:5

   reach-by-name through `globals` (ast pass, confidence 0.60)

       result = import_attr(attr_name, module_name, __spec__.parent)
       globals()[attr_name] = result
       return result

   likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

   Reasoning

   Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

10. info warn → info by review dynamic-attribute libs/core/langchain_core/load/__init__.py:39:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

11. info warn → info by review dynamic-attribute libs/core/langchain_core/messages/__init__.py:193:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

12. info warn → info by review dynamic-attribute libs/core/langchain_core/output_parsers/__init__.py:96:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

13. info warn → info by review dynamic-attribute libs/core/langchain_core/outputs/__init__.py:61:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

14. info warn → info by review dynamic-attribute libs/core/langchain_core/prompts/__init__.py:96:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

15. info warn → info by review dynamic-attribute libs/core/langchain_core/runnables/__init__.py:131:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

16. info warn → info by review dynamic-attribute libs/core/langchain_core/tools/__init__.py:90:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

17. info warn → info by review dynamic-attribute libs/core/langchain_core/tracers/__init__.py:45:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy module attribute loader caching imported names in globals().

    Reasoning

    Standard lazy-import __getattr__ pattern used across langchain_core package initializers.

18. info warn → info by review dynamic-attribute libs/core/langchain_core/utils/__init__.py:106:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Module-level __getattr__ in langchain_core utils that lazily imports and caches a named attribute in globals().

    Reasoning

    This is the standard lazy-import pattern used in __getattr__ module hooks: it resolves a named attribute via import_attr relative to the package's own __spec__.parent, caches it in globals(), and returns it. No network, shell, decoding, or dynamic code execution is involved; the flagged behavior is an ordinary idiom for deferring imports in a large library.

19. info warn → info by review dynamic-attribute libs/core/langchain_core/vectorstores/__init__.py:43:5

    reach-by-name through `globals` (ast pass, confidence 0.60)

        result = import_attr(attr_name, module_name, __spec__.parent)
        globals()[attr_name] = result
        return result

    likely benign LLM, confidence 0.95 Lazy attribute loader in langchain_core vectorstores __init__ that imports and caches attributes via globals().

    Reasoning

    Same lazy-loading __getattr__ idiom as the utils package: it imports a named attribute from the package's own module path and caches it in globals(). The snippet shows no encoded payloads, shell calls, or external fetches, so this is a legitimate lazy-import mechanism flagged only by the reach-by-name heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/langchain-ai/langchain langchain && cd langchain
git checkout langchain-core==1.6.12
disclude scan --severity info --diff langchain-core==1.6.11 libs/core