langchain - 💡(How to fix) Fix Code quality scan: 22 findings (B+, 81/100)

Hi @langchain-ai, an automated scan of this repository surfaced 22 code-quality findings that may be worth a look. Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

Full interactive report

https://repobility.com/scan/cff7a5c6-b915-422d-8426-534920da719d/

At a glance

• Score: 81/100 • Grade: B+
• Scanned: 2026-05-17 20:12 UTC
• Lines of code: 98,327
• Total findings: 22
• Security-tagged: 1
• Credential / secret patterns: 0

Top issues, with file & line

These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree.

1. [high] [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — .github/scripts/get_min_versions.py:51 Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400)…
2. [low] Duplicated implementation block across source files — libs/core/langchain_core/_api/deprecation.py:159 Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
3. [low] Duplicated implementation block across source files — libs/core/langchain_core/messages/base.py:99 Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
4. [low] Duplicated implementation block across source files — libs/core/langchain_core/messages/block_translators/bedrock_converse.py:9 Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
5. [low] Duplicated implementation block across source files — libs/core/langchain_core/messages/block_translators/groq.py:8 Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

See all 22 findings, with severity filters and AI fix prompts: https://repobility.com/scan/cff7a5c6-b915-422d-8426-534920da719d/

What is this? Repobility is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is not a sales pitch — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

To re-run after fixes land: paste your repo URL at repobility.com — fresh scan, free.

Issue filed via the public Repobility report at https://repobility.com/scan/cff7a5c6-b915-422d-8426-534920da719d/.