langchain-core 1.7.0

Source: https://github.com/langchain-ai/langchain
Artifact scanned: langchain_core-1.7.0-py3-none-any.whl (wheel · 561.2 KB · SHA-256 e82b24d7ac51…)
Compared with: langchain_core-1.6.13-py3-none-any.whl (0 signals introduced since)
Files: 182 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 19 info
Scan time: 13.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 19 of 19 warn and critical signals; 19 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 12:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute langchain_core/_api/__init__.py:77:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the langchain_core API package that imports a named attribute and caches it in module globals.
Reasoning
The snippet is the standard PEP 562-style lazy-loading __getattr__ pattern: it resolves a public attribute name to a module-relative import via import_attr and caches it in globals. It does not execute decoded or remote content and reads only the module's own names, so it is a legitimate pattern.
info ~~warn~~ → info by review frame-introspection langchain_core/_api/internal.py:8:17

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    try:
        frame = inspect.currentframe()
    except AttributeError:
        return False
```
likely benign LLM, confidence 0.90 Call-stack frame inspection used to determine whether a caller is internal to the library.
Reasoning
inspect.currentframe() is used to check whether the calling code belongs to langchain_core, for internal-use warnings. Frame introspection in this way is a common, benign API-deprecation technique. The AttributeError guard handles interpreters without frame support.
info ~~warn~~ → info by review dynamic-attribute langchain_core/callbacks/__init__.py:127:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the callbacks package that imports and caches public names.
Reasoning
Standard lazy-import __getattr__ pattern that resolves a public name to a submodule attribute and caches it in globals. Nothing in the snippet is decoded, executed or sent over the network.
info ~~warn~~ → info by review dynamic-attribute langchain_core/document_loaders/__init__.py:34:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the document_loaders package.
Reasoning
Same standard lazy-loading __getattr__ pattern used across langchain_core packages. It only resolves module-relative names and caches them.
info ~~warn~~ → info by review dynamic-attribute langchain_core/documents/__init__.py:50:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the documents package.
Reasoning
Standard lazy-import __getattr__ pattern that imports a named attribute from a sibling module and caches it. No dynamic execution or suspicious data flow is present.
info ~~warn~~ → info by review dynamic-attribute langchain_core/embeddings/__init__.py:26:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the embeddings package.
Reasoning
Standard lazy-loading __getattr__ pattern. The code resolves an attribute by name from the package's own submodules and stores it in globals, which is an ordinary way to defer imports.
info ~~warn~~ → info by review dynamic-attribute langchain_core/example_selectors/__init__.py:42:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the example_selectors package.
Reasoning
Standard lazy-import __getattr__ pattern. It only maps public names to package submodules and caches the result.
info ~~warn~~ → info by review dynamic-attribute langchain_core/indexing/__init__.py:48:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the indexing package.
Reasoning
Standard lazy-loading __getattr__ pattern with module-relative import resolution and caching. No malicious behaviour is visible.
info ~~warn~~ → info by review dynamic-attribute langchain_core/language_models/__init__.py:111:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the language_models package.
Reasoning
Standard lazy-import __getattr__ pattern that resolves a named attribute and caches it in globals. This is a common, legitimate way to reduce import cost.
info ~~warn~~ → info by review dynamic-attribute langchain_core/load/__init__.py:39:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the load package.
Reasoning
Standard lazy-loading __getattr__ pattern. The snippet only resolves names within the package and performs no decoding, execution or network access.
info ~~warn~~ → info by review dynamic-attribute langchain_core/messages/__init__.py:193:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the messages package.
Reasoning
Standard lazy-import __getattr__ pattern used across the library. It resolves a public message class name from a submodule and caches it.
info ~~warn~~ → info by review dynamic-attribute langchain_core/output_parsers/__init__.py:96:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the output_parsers package.
Reasoning
Standard lazy-loading __getattr__ pattern that resolves names from the package's own submodules and caches them. Benign.
info ~~warn~~ → info by review dynamic-attribute langchain_core/outputs/__init__.py:61:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the outputs package.
Reasoning
Standard lazy-import __getattr__ pattern with module-relative resolution and caching. No suspicious behaviour.
info ~~warn~~ → info by review dynamic-attribute langchain_core/prompts/__init__.py:96:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the prompts package.
Reasoning
Standard lazy-loading __getattr__ pattern. It maps public names to submodule attributes and caches the result, which is an ordinary deferred-import design.
info ~~warn~~ → info by review dynamic-attribute langchain_core/runnables/__init__.py:131:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the runnables package.
Reasoning
Standard lazy-import __getattr__ pattern. The snippet performs only module-relative attribute resolution and caching.
info ~~warn~~ → info by review dynamic-attribute langchain_core/tools/__init__.py:90:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the tools package.
Reasoning
Standard lazy-loading __getattr__ pattern used across the library. It resolves names from sibling modules and caches them, with no execution of decoded data.
info ~~warn~~ → info by review dynamic-attribute langchain_core/tracers/__init__.py:45:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Lazy attribute loader in the tracers package.
Reasoning
Standard lazy-import __getattr__ pattern that resolves a public name from a submodule and caches it in globals. It is legitimate package plumbing.
info ~~warn~~ → info by review dynamic-attribute langchain_core/utils/__init__.py:106:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Module-level __getattr__ that lazily imports a named attribute and caches it in globals().
Reasoning
This is the standard lazy-import idiom in __getattr__: it resolves a public attribute name to a submodule symbol via import_attr and caches it in globals(). It does not decode data, spawn processes, or reach the network, and the pattern is widely used in legitimate packages.
info ~~warn~~ → info by review dynamic-attribute langchain_core/vectorstores/__init__.py:43:5

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    result = import_attr(attr_name, module_name, __spec__.parent)
    globals()[attr_name] = result
    return result
```
likely benign LLM, confidence 0.95 Module-level __getattr__ performing lazy attribute import and caching via globals() in langchain_core vectorstores.
Reasoning
Same lazy-loading __getattr__ pattern as the utils package: a name-to-import mapping resolved through import_attr and cached in globals(). The snippet shows no decoding, execution of arbitrary strings, or network or process activity, so it reads as ordinary lazy import machinery.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o langchain_core-1.7.0-py3-none-any.whl https://files.pythonhosted.org/packages/b3/d8/ed130e91cee0525cb47d185b98a5a6ffd6a8b660a100fbee43d887e745d6/langchain_core-1.7.0-py3-none-any.whl
printf '%s  %s\n' e82b24d7ac51fc74874baa29d6b3c0b8234880d4f3d897f8ff57fb80dfd9b07d langchain_core-1.7.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q langchain_core-1.7.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg