langchain - 💡(How to fix) Fix Code quality: silent exception swallowing, unbounded caches, thread safety, and connection leaks [1 comments, 2 participants]

Summary

We ran HefestoAI (deterministic static analysis, no AI/LLM) against the LangChain monorepo (2,517 files) and found patterns across multiple categories that may warrant review. None are critical vulnerabilities — they are reliability and code quality observations.

Findings

1. Silent exception swallowing (12 instances)

Most notable — libs/core/langchain_core/tools/base.py:1345: except Exception: pass in the tools core. Errors during tool execution are silently swallowed.

libs/core/langchain_core/load/serializable.py:84: Silent swallow during serialization — could mask data corruption.

libs/partners/anthropic/langchain_anthropic/_client_utils.py:30,44 and libs/partners/openai/langchain_openai/chat_models/_client_utils.py:31,45: Both partner SDKs have identical silent swallow patterns in their client utils.

2. Unbounded cache — tokenizer (1 instance)

libs/core/langchain_core/language_models/base.py:76:

@lru_cache(maxsize=None)
def get_tokenizer()

In long-running LangChain agents this cache grows without bound. maxsize=128 would be equivalent in practice.

3. Unbounded global state (3 instances)

libs/core/langchain_core/tracers/langchain.py:36: Module-level mutable _LOGGED set is mutated inside a function — in long-running workers this grows without bound, consuming memory proportional to the number of unique trace messages.

4. Uncontrolled thread creation (5 instances)

agents/middleware/shell_tool.py:173,178: threading.Thread() inside function start — no thread pool, no limit. Under load this can exhaust system resources.

libs/partners/huggingface/langchain_huggingface/llms/huggingface_pipeline.py:414: Thread created per _stream() call without pooling.

5. Connection lifecycle (2 instances)

langchain_classic/indexes/_sql_record_manager.py:130: create_engine() assigned without context manager or explicit .close() — potential connection pool leak.

langchain_classic/memory/entity.py:387: connect() without lifecycle management.

6. Attribute name mismatch (4 instances)

libs/text-splitters/langchain_text_splitters/character.py:41,54: self._keep_separator read but never assigned — closest match is self._separator. May be a property or parent-class attribute (needs verification).

libs/partners/chroma/langchain_chroma/vectorstores.py:931,933: self._cosine_relevance_score_fn / self._euclidean_relevance_score_fn — may be parent-class attributes.

Note: The attribute mismatch findings need manual verification — they may be inherited attributes rather than typos.

Reproduction

pip install hefesto-ai
git clone --depth 1 https://github.com/langchain-ai/langchain.git
hefesto analyze langchain/ --severity LOW

About

HefestoAI is an open-source (MIT) deterministic code quality and security analyzer. All findings are from static, offline, reproducible rules — no AI/LLM was used.

Happy to discuss any of these findings or contribute PRs if helpful.