# GenProof public bug record We find bugs in your software’s software. We use formal methods to find bugs in the libraries, compilers, and protocols that the world's software depends on. Data generated: 2026-10-21T07:58:12+00:00 ## Totals 312 found; 201 reported; 122 fixed; 102 projects; 111 not yet reported; 186 individual public reports. 62 reported awaiting confirmation; 14 confirmed; 3 being fixed. Reported totals include fixed bugs. Individual public reports are a subset of all reported bugs. Unreported findings have project counts only; do not infer bug details. A proposed fix does not prove a bug is fixed. Project sent counts reported bugs not yet fixed; add fixed for the project’s total reported count. Download events, installs, stars and dependent packages are different measures, not unique users. Retain registry and period. ## Access without JavaScript https://bugs.genproof.com/ https://bugs.genproof.com/agents https://bugs.genproof.com/agents.txt https://bugs.genproof.com/AGENTS.md https://bugs.genproof.com/data.json https://bugs.genproof.com/llms.txt https://bugs.genproof.com/llms-full.txt https://bugs.genproof.com/sitemap.xml ## Alternate hosts Live HTML mirror: https://www.genproof.com/bugs Live readable record: https://www.genproof.com/agents Live plain text: https://www.genproof.com/agents.txt Live JSON: https://www.genproof.com/data.json Dated public fallback snapshot (check its generation timestamp): https://gist.github.com/pokraas/adb0bfc3ef7236ba8344c7f170af05a6 ## Projects ### Linux kernel (WireGuard) https://github.com/torvalds/linux Found: 3; reported: 2; fixed: 0; not yet reported: 1. GitHub stars: 252936 ### Playwright https://github.com/microsoft/playwright Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 98194 npm / playwright: 445668745 events / 30 days. https://www.npmjs.com/package/playwright the npm package names the repository microsoft/playwright ### Redis https://github.com/redis/redis Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 77026 Homebrew / redis: 23763 events / 30 days. https://formulae.brew.sh/formula/redis the Homebrew package names the repository redis/redis ### Cypress https://github.com/cypress-io/cypress Found: 3; reported: 3; fixed: 0; not yet reported: 0. GitHub stars: 51020 npm / cypress: 24598885 events / 30 days. https://www.npmjs.com/package/cypress the npm package names the repository cypress-io/cypress ### Bruno https://github.com/usebruno/bruno Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 47782 npm / @usebruno/cli: 1103451 events / 30 days. https://www.npmjs.com/package/@usebruno/cli the npm package names the repository usebruno/bruno ### curl https://github.com/curl/curl Found: 11; reported: 0; fixed: 0; not yet reported: 11. GitHub stars: 43193 Homebrew / curl: 75286 events / 30 days. https://formulae.brew.sh/formula/curl the Homebrew package names the repository curl/curl ### stb_image https://github.com/nothings/stb Found: 10; reported: 0; fixed: 0; not yet reported: 10. GitHub stars: 34867 ### Selenium https://github.com/SeleniumHQ/selenium Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 34564 PyPI / selenium: 28029613 events / 30 days. https://pypi.org/project/selenium/ set by hand: the Python binding of Selenium npm / selenium-webdriver: 7888291 events / 30 days. https://www.npmjs.com/package/selenium-webdriver the npm package names the repository seleniumhq/selenium ### k6 https://github.com/grafana/k6 Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 31994 Homebrew / k6: 6213 events / 30 days. https://formulae.brew.sh/formula/k6 the Homebrew package names the repository grafana/k6 ### nginx https://github.com/nginx/nginx Found: 3; reported: 0; fixed: 0; not yet reported: 3. GitHub stars: 31918 Homebrew / nginx: 7305 events / 30 days. https://formulae.brew.sh/formula/nginx the Homebrew package names the repository nginx/nginx ### OpenSSL https://github.com/openssl/openssl Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 31001 Homebrew / openssl@3: 437486 events / 30 days. https://formulae.brew.sh/formula/openssl@3 the Homebrew package names the repository openssl/openssl ### Locust https://github.com/locustio/locust Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 28227 PyPI / locust: 9365918 events / 30 days. https://pypi.org/project/locust/ the PyPI package names the repository locustio/locust ### zstd https://github.com/facebook/zstd Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 28070 Homebrew / zstd: 178024 events / 30 days. https://formulae.brew.sh/formula/zstd the Homebrew package names the repository facebook/zstd ### libuv https://github.com/libuv/libuv Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 27274 Homebrew / libuv: 104289 events / 30 days. https://formulae.brew.sh/formula/libuv the Homebrew package names the repository libuv/libuv ### Appium https://github.com/appium/appium Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 22117 npm / appium: 5433804 events / 30 days. https://www.npmjs.com/package/appium the npm package names the repository appium/appium Homebrew / appium: 533 events / 30 days. https://formulae.brew.sh/formula/appium the Homebrew package names the repository appium/appium ### Ajv https://github.com/ajv-validator/ajv Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 14863 npm / ajv: 1617934954 events / 30 days. https://www.npmjs.com/package/ajv the npm package names the repository ajv-validator/ajv ### Pillow https://github.com/python-pillow/Pillow Found: 5; reported: 0; fixed: 0; not yet reported: 5. GitHub stars: 13912 PyPI / pillow: 436470920 events / 30 days. https://pypi.org/project/pillow/ the PyPI package names the repository python-pillow/pillow Homebrew / pillow: 7813 events / 30 days. https://formulae.brew.sh/formula/pillow the Homebrew package names the repository python-pillow/pillow ### LZ4 https://github.com/lz4/lz4 Found: 3; reported: 3; fixed: 0; not yet reported: 0. GitHub stars: 12163 Homebrew / lz4: 159225 events / 30 days. https://formulae.brew.sh/formula/lz4 the Homebrew package names the repository lz4/lz4 ### Robot Framework https://github.com/robotframework/robotframework Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 11955 PyPI / robotframework: 3882078 events / 30 days. https://pypi.org/project/robotframework/ the PyPI package names the repository robotframework/robotframework ### F Prime https://github.com/nasa/fprime Found: 4; reported: 1; fixed: 1; not yet reported: 3. GitHub stars: 11832 PyPI / fprime: 44 events / 30 days. https://pypi.org/project/fprime/ the PyPI package names the repository nasa/fprime ### Karate https://github.com/karatelabs/karate Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 8992 ### WireMock https://github.com/wiremock/wiremock Found: 2; reported: 2; fixed: 1; not yet reported: 0. GitHub stars: 7404 ### zlib https://github.com/madler/zlib Found: 4; reported: 3; fixed: 0; not yet reported: 1. GitHub stars: 7159 Homebrew / zlib: 8434 events / 30 days. https://formulae.brew.sh/formula/zlib the Homebrew package names the repository madler/zlib ### goja https://github.com/dop251/goja Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 7152 ### REST Assured https://github.com/rest-assured/rest-assured Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 7145 ### Mbed TLS https://github.com/Mbed-TLS/mbedtls Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 7009 Homebrew / mbedtls: 2742 events / 30 days. https://formulae.brew.sh/formula/mbedtls the Homebrew package names the repository mbed-tls/mbedtls ### Gatling https://github.com/gatling/gatling Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 6955 ### Scala 3 https://github.com/scala/scala3 Found: 8; reported: 8; fixed: 6; not yet reported: 0. GitHub stars: 6324 Homebrew / scala: 724 events / 30 days. https://formulae.brew.sh/formula/scala the Homebrew package names the repository scala/scala3 ### Nanopb https://github.com/nanopb/nanopb Found: 5; reported: 5; fixed: 0; not yet reported: 0. GitHub stars: 5589 PyPI / nanopb: 419572 events / 30 days. https://pypi.org/project/nanopb/ the PyPI package names the repository nanopb/nanopb Homebrew / nanopb: 103 events / 30 days. https://formulae.brew.sh/formula/nanopb the Homebrew package names the repository nanopb/nanopb ### nghttp2 https://github.com/nghttp2/nghttp2 Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 5068 Homebrew / nghttp2: 2179 events / 30 days. https://formulae.brew.sh/formula/nghttp2 the Homebrew package names the repository nghttp2/nghttp2 ### libjpeg-turbo https://github.com/libjpeg-turbo/libjpeg-turbo Found: 3; reported: 0; fixed: 0; not yet reported: 3. GitHub stars: 4453 Homebrew / jpeg-turbo: 80886 events / 30 days. https://formulae.brew.sh/formula/jpeg-turbo the Homebrew package names the repository libjpeg-turbo/libjpeg-turbo ### 7-Zip https://github.com/ip7z/7zip Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 4213 Homebrew / sevenzip: 17615 events / 30 days. https://formulae.brew.sh/formula/sevenzip the Homebrew package names the repository ip7z/7zip ### Verilator https://github.com/verilator/verilator Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 4023 Homebrew / verilator: 866 events / 30 days. https://formulae.brew.sh/formula/verilator the Homebrew package names the repository verilator/verilator ### Icarus Verilog https://github.com/steveicarus/iverilog Found: 4; reported: 4; fixed: 3; not yet reported: 0. GitHub stars: 3687 Homebrew / icarus-verilog: 668 events / 30 days. https://formulae.brew.sh/formula/icarus-verilog the Homebrew package names the repository steveicarus/iverilog ### protobuf-c https://github.com/protobuf-c/protobuf-c Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 3002 Homebrew / protobuf-c: 3514 events / 30 days. https://formulae.brew.sh/formula/protobuf-c the Homebrew package names the repository protobuf-c/protobuf-c ### Circe https://github.com/circe/circe Found: 3; reported: 3; fixed: 0; not yet reported: 0. GitHub stars: 2541 ### fs2 https://github.com/typelevel/fs2 Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 2454 ### FLAC https://github.com/xiph/flac Found: 5; reported: 0; fixed: 0; not yet reported: 5. GitHub stars: 2449 Homebrew / flac: 14167 events / 30 days. https://formulae.brew.sh/formula/flac set by hand: homepage xiph.org/flac ### libavif https://github.com/AOMediaCodec/libavif Found: 3; reported: 0; fixed: 0; not yet reported: 3. GitHub stars: 2201 Homebrew / libavif: 19591 events / 30 days. https://formulae.brew.sh/formula/libavif the Homebrew package names the repository aomediacodec/libavif ### c-ares https://github.com/c-ares/c-ares Found: 5; reported: 0; fixed: 0; not yet reported: 5. GitHub stars: 2196 Homebrew / c-ares: 65015 events / 30 days. https://formulae.brew.sh/formula/c-ares the Homebrew package names the repository c-ares/c-ares ### picohttpparser https://github.com/h2o/picohttpparser Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 2108 ### LoRaMac-node https://github.com/Lora-net/LoRaMac-node Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 1997 ### Monocle https://github.com/optics-dev/Monocle Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 1700 ### liblzma (xz) https://github.com/tukaani-project/xz Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 1689 Homebrew / xz: 349944 events / 30 days. https://formulae.brew.sh/formula/xz the Homebrew package names the repository tukaani-project/xz ### skunk https://github.com/typelevel/skunk Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 1665 ### tiny-regex-c https://github.com/kokke/tiny-regex-c Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 1509 ### sttp https://github.com/softwaremill/sttp Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 1506 ### Tapir https://github.com/softwaremill/tapir Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 1475 ### libsrtp https://github.com/cisco/libsrtp Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 1402 Homebrew / srtp: 3292 events / 30 days. https://formulae.brew.sh/formula/srtp the Homebrew package names the repository cisco/libsrtp ### Caliban https://github.com/ghostdogpr/caliban Found: 11; reported: 11; fixed: 11; not yet reported: 0. GitHub stars: 993 ### libfixmath https://github.com/PetteriAimonen/libfixmath Found: 8; reported: 0; fixed: 0; not yet reported: 8. GitHub stars: 889 ### quicklens https://github.com/softwaremill/quicklens Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 851 ### Laminar https://github.com/raquo/Laminar Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 838 ### Kyo https://github.com/getkyo/kyo Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 821 ### Magnolia https://github.com/softwaremill/magnolia Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 800 ### uPickle https://github.com/com-lihaoyi/upickle Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 768 ### Airframe https://github.com/wvlet/airframe Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 665 ### TinyCBOR https://github.com/intel/tinycbor Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 640 Homebrew / tinycbor: 25 events / 30 days. https://formulae.brew.sh/formula/tinycbor the Homebrew package names the repository intel/tinycbor ### DeepGEMM-Ascend https://github.com/deepseek-ai/DeepGEMM-Ascend Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 601 ### Iron https://github.com/Iltotore/iron Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 561 ### Ox https://github.com/softwaremill/ox Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 527 ### tinycrypt https://github.com/intel/tinycrypt Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 522 ### umm_malloc https://github.com/rhempel/umm_malloc Found: 1; reported: 0; fixed: 0; not yet reported: 1. GitHub stars: 492 ### MUnit https://github.com/scalameta/munit Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 472 ### SymmetryBook https://github.com/UniMath/SymmetryBook Found: 7; reported: 7; fixed: 0; not yet reported: 0. GitHub stars: 453 ### CMP https://github.com/camgunz/cmp Found: 3; reported: 0; fixed: 0; not yet reported: 3. GitHub stars: 370 ### gguf-tools https://github.com/antirez/gguf-tools Found: 3; reported: 2; fixed: 0; not yet reported: 1. GitHub stars: 370 ### uzlib https://github.com/pfalcon/uzlib Found: 2; reported: 0; fixed: 0; not yet reported: 2. GitHub stars: 354 ### libfdt https://github.com/dgibson/dtc Found: 5; reported: 0; fixed: 0; not yet reported: 5. GitHub stars: 332 Homebrew / dtc: 4509 events / 30 days. https://formulae.brew.sh/formula/dtc set by hand: libfdt is a part of dtc, the device tree compiler ### Narya https://github.com/gwaithimirdain/narya Found: 8; reported: 8; fixed: 7; not yet reported: 0. GitHub stars: 310 ### Gears https://github.com/lampepfl/gears Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 305 ### Hedgehog https://github.com/hedgehogqa/scala-hedgehog Found: 2; reported: 2; fixed: 1; not yet reported: 0. GitHub stars: 268 ### ScalaSQL https://github.com/com-lihaoyi/scalasql Found: 7; reported: 7; fixed: 0; not yet reported: 0. GitHub stars: 260 ### PPrint https://github.com/com-lihaoyi/PPrint Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 248 ### borer https://github.com/sirthias/borer Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 242 ### fansi https://github.com/com-lihaoyi/fansi Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 237 ### dotty-cps-async https://github.com/dotty-cps-async/dotty-cps-async Found: 7; reported: 7; fixed: 7; not yet reported: 0. GitHub stars: 194 ### Hearth https://github.com/kubuszok/hearth Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 164 ### wvlet https://github.com/wvlet/wvlet Found: 3; reported: 3; fixed: 3; not yet reported: 0. GitHub stars: 158 PyPI / wvlet: 26 events / 30 days. https://pypi.org/project/wvlet/ the PyPI package names the repository wvlet/wvlet ### CWPack https://github.com/clwi/CWPack Found: 3; reported: 0; fixed: 0; not yet reported: 3. GitHub stars: 154 ### onnx-scala https://github.com/EmergentOrder/onnx-scala Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 151 ### yaes https://github.com/yaes-io/yaes Found: 1; reported: 1; fixed: 1; not yet reported: 0. GitHub stars: 140 ### workflows4s https://github.com/business4s/workflows4s Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 131 ### Soundness https://github.com/propensive/soundness Found: 16; reported: 16; fixed: 16; not yet reported: 0. GitHub stars: 114 ### flink-scala-api https://github.com/flink-extended/flink-scala-api Found: 3; reported: 3; fixed: 0; not yet reported: 0. GitHub stars: 113 ### quote4 https://github.com/leanprover-community/quote4 Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 111 ### ldbc https://github.com/takapi327/ldbc Found: 13; reported: 13; fixed: 13; not yet reported: 0. GitHub stars: 110 ### Scalus https://github.com/scalus3/scalus Found: 2; reported: 2; fixed: 2; not yet reported: 0. GitHub stars: 105 npm / scalus: 44884 events / 30 days. https://www.npmjs.com/package/scalus the npm package names the repository scalus3/scalus ### geny https://github.com/com-lihaoyi/geny Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 98 ### decisions4s https://github.com/business4s/decisions4s Found: 3; reported: 3; fixed: 1; not yet reported: 0. GitHub stars: 85 ### etl4s https://github.com/mattlianje/etl4s Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 79 ### DRAT-trim https://github.com/marijnheule/drat-trim Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 72 ### record4s https://github.com/tarao/record4s Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 68 ### snapshot4s https://github.com/siriusxm/snapshot4s Found: 1; reported: 1; fixed: 0; not yet reported: 0. GitHub stars: 67 ### strymonas https://github.com/strymonas/strymonas-scala Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 56 ### Unwrapped https://github.com/xebia-functional/Unwrapped Found: 2; reported: 2; fixed: 0; not yet reported: 0. GitHub stars: 40 ### Pillars https://github.com/FunktionalIO/pillars Found: 7; reported: 7; fixed: 0; not yet reported: 0. GitHub stars: 33 ### Aerodrome MetaDEX03 https://github.com/dromos-labs/metadex-public Found: 8; reported: 0; fixed: 0; not yet reported: 8. GitHub stars: 20 ### Fluid DEX v2 https://github.com/sherlock-audit/2026-01-fluid-dex-v2 Found: 5; reported: 0; fixed: 0; not yet reported: 5. GitHub stars: 6 ### dnsmasq https://thekelleys.org.uk/git/dnsmasq Found: 2; reported: 0; fixed: 0; not yet reported: 2. Homebrew / dnsmasq: 1823 events / 30 days. https://formulae.brew.sh/formula/dnsmasq set by hand: homepage thekelleys.org.uk/dnsmasq ### musl libc https://git.musl-libc.org/git/musl Found: 2; reported: 0; fixed: 0; not yet reported: 2. ### BoringSSL https://boringssl.googlesource.com/boringssl Found: 1; reported: 0; fixed: 0; not yet reported: 1. ## Public bug reports ### Playwright: getByRole name filter misses meter and progress elements labelled by a label tag ID: gh:microsoft/playwright#41891 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-22. The accessible name of meter and progress ignores an associated label, so getByRole with a name returns zero matches while getByLabel finds the same element. Report: https://github.com/microsoft/playwright/issues/41891 Fix or proposed fix (see status): https://github.com/microsoft/playwright/pull/41911 Reporter: Mike Murunov ### Playwright: Search input with a broken list attribute gets combobox role, not searchbox ID: gh:microsoft/playwright#41899 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-22. A search input whose list attribute points to no datalist gets the combobox role, unlike Chrome's searchbox role. So getByRole searchbox finds nothing, while the combobox role matches the input by mistake. Report: https://github.com/microsoft/playwright/issues/41899 Fix or proposed fix (see status): https://github.com/microsoft/playwright/pull/41913 Reporter: Mike Murunov ### Cypress: cy.contains with a g or y regex flag misses matching elements ID: gh:cypress-io/cypress#34303 Status: Reported; severity: high; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. A regex with the global or sticky flag keeps lastIndex between candidate elements, so the command tests only about half of the matching elements. The command can pick the wrong element or time out while matches exist. Report: https://github.com/cypress-io/cypress/issues/34303 Fix or proposed fix (see status): https://github.com/cypress-io/cypress/pull/34357 Reporter: Mike Murunov ### Cypress: selectFile on a label fails when its for id contains dots, spaces or colons ID: gh:cypress-io/cypress#34304 Status: Reported; severity: low; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. The label's for value enters a CSS selector unescaped, so ids with dots or spaces resolve to nothing and selectFile reports an unhelpful error. An id with a colon throws a raw selector syntax error. Report: https://github.com/cypress-io/cypress/issues/34304 Fix or proposed fix (see status): https://github.com/cypress-io/cypress/pull/34356 Reporter: Mike Murunov ### Cypress: cy.contains cannot find submit buttons by a partial word of their value ID: gh:cypress-io/cypress#34305 Status: Reported; severity: low; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. Submit inputs match only whole words in their value, while other elements match any substring. cy.contains('User') misses an input whose value is Username, so the command times out. Report: https://github.com/cypress-io/cypress/issues/34305 Fix or proposed fix (see status): https://github.com/cypress-io/cypress/pull/34358 Reporter: Mike Murunov ### Bruno: NTLM auth block without a domain line makes a valid file fail to parse ID: gh:usebruno/bruno#8695 Status: Fixed; severity: medium; class: Crash. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-26. If an auth:ntlm block has a username and password but no domain line, the parser throws a TypeError on parse. The domain lookup checks the password key but reads the domain key. Report: https://github.com/usebruno/bruno/issues/8695 Fix or proposed fix (see status): https://github.com/usebruno/bruno/pull/8707 Reporter: Mike Murunov Maintainer reply by sbalagan22 (contributor), 2026-07-21: Confirmed on main. … An auth:ntlm block with username/password and no domain makes passwordKey truthy while domainKey is undefined, so domainKey.value throws and the .bru fails to parse. Reply source: https://github.com/usebruno/bruno/issues/8695#issuecomment-5037664281 ### Selenium: CSS escape of a non-ASCII first digit picks the wrong ASCII code point ID: gh:SeleniumHQ/selenium#17805 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-06. By.className and By.id escape a Unicode digit at the start such as an Arabic-Indic five as the ASCII five. The selector for that class matches the same element as the ASCII class name. Report: https://github.com/SeleniumHQ/selenium/issues/17805 Fix or proposed fix (see status): https://github.com/SeleniumHQ/selenium/pull/17815 Reporter: Mike Murunov ### Selenium: By.name with % throws a format exception or builds a wrong selector ID: gh:SeleniumHQ/selenium#17807 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-07. By.name runs String.format twice, so a name such as 100% throws UnknownFormatConversionException, and a name like a%db throws IllegalFormatConversionException at construction time. Report: https://github.com/SeleniumHQ/selenium/issues/17807 Fix or proposed fix (see status): https://github.com/SeleniumHQ/selenium/pull/17883 Reporter: Mike Murunov ### k6: Gauge max reports 0 when every sample is negative ID: gh:grafana/k6#6181 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-27. A gauge max starts at 0 and is never guarded for the first sample, so an all-negative series reports max 0 in summaries and JSON exports. Report: https://github.com/grafana/k6/issues/6181 Fix or proposed fix (see status): https://github.com/grafana/k6/pull/6195 Reporter: Mike Murunov Maintainer reply by mstoykov (contributor), 2026-07-21: This does seem like a real issue, but also a very unlikely to be hit one. Reply source: https://github.com/grafana/k6/issues/6181#issuecomment-5031568182 ### Locust: Async requests logged as None lower all reported response-time percentiles ID: gh:locustio/locust#3472 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. Requests logged with response_time None, the documented async pattern, count in the percentile denominator but not in the histogram. This lowers every p50 to p99.9 toward the minimum, while median and average stay correct. Report: https://github.com/locustio/locust/issues/3472 Fix or proposed fix (see status): https://github.com/locustio/locust/pull/3473 Reporter: Mike Murunov Maintainer reply by cyberw (maintainer), 2026-07-21: Sounds like a proper bug! Reply source: https://github.com/locustio/locust/issues/3472#issuecomment-5032428244 ### Appium: Virtual sensor routes use /sensors, not the spec's /sensor path ID: gh:appium/appium#22523 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. Get, update and delete calls at the W3C spec path /sensor/{type} return not found. The server registers virtual sensor routes under the plural /sensors path, so spec-conformant clients cannot reach them. Report: https://github.com/appium/appium/issues/22523 Fix or proposed fix (see status): https://github.com/appium/appium/pull/22525 Reporter: Mike Murunov Maintainer reply by eglitise (maintainer), 2026-07-21: Thanks, this was indeed a typo. The fix will be included in the next release. Reply source: https://github.com/appium/appium/issues/22523#issuecomment-5031960984 ### Appium: Timeout errors return HTTP 408 instead of the spec's 500, so clients may retry ID: gh:appium/appium#22526 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-31. Implicit wait, element find and async script timeouts answer with 408 Request Timeout. Keep-alive clients and proxies may replay a 408 by themselves, so the timed-out command can run twice. Report: https://github.com/appium/appium/issues/22526 Fix or proposed fix (see status): https://github.com/appium/appium/pull/22548 Reporter: Mike Murunov Maintainer reply by eglitise (maintainer), 2026-07-21: Thanks, the issue seems to be valid. Reply source: https://github.com/appium/appium/issues/22526#issuecomment-5033640908 ### Ajv: JTD parser rejects valid JSON unicode escapes inside enum string values ID: gh:ajv-validator/ajv#2651 Status: Reported; severity: low; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. If a string spells an allowed enum value with a unicode escape, such as \u0041 for A, the parser fails with an unexpected token error. The same value typed as plain text parses fine. Report: https://github.com/ajv-validator/ajv/issues/2651 Fix or proposed fix (see status): https://github.com/ajv-validator/ajv/pull/2657 Reporter: Mike Murunov ### Robot Framework: SectionHeader.from_params raises KeyError for the invalid header type ID: gh:robotframework/robotframework#5723 Status: Fixed; severity: low; class: Crash. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-23. The default name table has six entries, but the code handles more than six types. Zip truncates, so the INVALID HEADER type gets no name and rebuilds from parsed invalid headers fail with KeyError. Report: https://github.com/robotframework/robotframework/issues/5723 Fix or proposed fix (see status): https://github.com/robotframework/robotframework/pull/5724 Reporter: Mike Murunov Maintainer reply by pekkaklarck (maintainer), 2026-07-23: Thanks for the report. Nobody should generate invalid headers, with or without a name, so this has very low priority. I guess fixing it still makes sense, especially when the fix is so simple. Reply source: https://github.com/robotframework/robotframework/issues/5723#issuecomment-5059483849 ### F Prime: Cancelled FPY sequence still runs its queued directive ID: gh:nasa/fprime#6110 Status: Fixed; severity: medium; class: Concurrency bug. Found: 2026-10-01; reported: 2026-10-01; status since: 2026-10-16. A directive queued before a CANCEL runs after the sequencer reports the cancel, so a command can reach its target. A stale stack directive can set an out-of-range stack size, and the window is narrow but deterministic once hit. Report: https://github.com/nasa/fprime/issues/6110 Fix or proposed fix (see status): https://github.com/nasa/fprime/pull/6115 Reporter: Maksim Borisov ### Karate: Equality match treats distinct integers above 2^53 as equal ID: gh:karatelabs/karate#2974 Status: Fixed; severity: medium; class: Soundness bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-14. Numeric match compares values as doubles, so large Long or BigInteger values that differ by one look equal. Values such as snowflake ids or balances pass an EQUALS assertion and fail NOT_EQUALS. Report: https://github.com/karatelabs/karate/issues/2974 Reporter: Mike Murunov Maintainer reply by ptrthomas (maintainer), 2026-08-14: v2.1.2 released Reply source: https://github.com/karatelabs/karate/issues/2974#issuecomment-5289476558 ### Karate: contains only deep ignores duplicate counts, so unequal multisets pass ID: gh:karatelabs/karate#2975 Status: Fixed; severity: medium; class: Soundness bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-14. On equal-length arrays with different duplicate counts, contains only deep passes where contains only fails. So a roles list with an extra admin entry can satisfy the assertion. Report: https://github.com/karatelabs/karate/issues/2975 Reporter: Mike Murunov Maintainer reply by ptrthomas (maintainer), 2026-08-14: v2.1.2 released Reply source: https://github.com/karatelabs/karate/issues/2975#issuecomment-5289476282 ### Karate: Negated partial schema macro passes on a list whose element contains the schema ID: gh:karatelabs/karate#2976 Status: Fixed; severity: medium; class: Soundness bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-08-14. The not-contains-partial macro uses exact matching for list elements. So an array with an element that matches only in part still passes, while the positive form passes on the same data. Report: https://github.com/karatelabs/karate/issues/2976 Reporter: Mike Murunov Maintainer reply by ptrthomas (maintainer), 2026-08-14: v2.1.2 released Reply source: https://github.com/karatelabs/karate/issues/2976#issuecomment-5289476075 ### WireMock: Multipart matcher with name and filename ignores the name constraint ID: gh:wiremock/wiremock#3509 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-09-28. withName and withFileName write the same Content-Disposition key, so the second overwrites the first. A stub then accepts a part with the wrong form field name if the filename matches. Report: https://github.com/wiremock/wiremock/issues/3509 Fix or proposed fix (see status): https://github.com/wiremock/wiremock/pull/3514 Reporter: Mike Murunov ### WireMock: XPath boolean expressions always match, so stubs fire on false conditions ID: gh:wiremock/wiremock#3510 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. If a one-argument matchesXPath expression yields a boolean, such as count(//x) = 99 or 1 = 2, it always matches. Stubs then fire for documents that fail the condition. Report: https://github.com/wiremock/wiremock/issues/3510 Fix or proposed fix (see status): https://github.com/wiremock/wiremock/pull/3522 Reporter: Mike Murunov ### goja: TypedArray toSorted on a subarray sorts from the start of the buffer ID: gh:dop251/goja#717 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. A call to toSorted on a typed array view with a non-zero offset, such as subarray(3), sorts elements from the start of the underlying buffer. The result is wrong data on a common path, without an error. Report: https://github.com/dop251/goja/issues/717 Fix or proposed fix (see status): https://github.com/dop251/goja/commit/c65cf2f023c829e725595752db4c896bd5cf4f7f Reporter: Mike Murunov ### goja: String split with an empty separator splits emoji into one piece instead of two ID: gh:dop251/goja#718 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-22. An empty separator makes split count characters outside the BMP as one element instead of two UTF-16 code units. The split length then disagrees with the string's own length. Report: https://github.com/dop251/goja/issues/718 Fix or proposed fix (see status): https://github.com/dop251/goja/commit/0768e0998ac0767f499ca81af04aa29c22cad55c Reporter: Mike Murunov ### REST Assured: Large negative decimal JSON numbers become -Infinity when read as float ID: gh:rest-assured/rest-assured#1874 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-10-07. With default settings JsonPath picks float for negative non-integers beyond Float.MAX_VALUE, so -1e40 returns -Infinity while +1e40 stays a correct double. Report: https://github.com/rest-assured/rest-assured/issues/1874 Fix or proposed fix (see status): https://github.com/rest-assured/rest-assured/pull/1877 Reporter: Mike Murunov ### REST Assured: array.properties returns null for all elements when the first lacks properties ID: gh:rest-assured/rest-assured#1875 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-10-07. The Groovy-5 spread workaround only runs when the first array element has a properties key. So a GeoJSON feature list whose first feature lacks it returns null and drops every feature's data. Report: https://github.com/rest-assured/rest-assured/issues/1875 Fix or proposed fix (see status): https://github.com/rest-assured/rest-assured/pull/1878 Reporter: Mike Murunov ### REST Assured: XmlPath negative index on a hyphenated element name fails with an unclear error ID: gh:rest-assured/rest-assured#1876 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-10-08. XmlPath with a hyphenated element name and a negative index, such as root.some-list[-1], throws a parameter list was not defined error. The hyphen is not escaped, and the error points at params() instead of that cause. Report: https://github.com/rest-assured/rest-assured/issues/1876 Fix or proposed fix (see status): https://github.com/rest-assured/rest-assured/pull/1882 Reporter: Mike Murunov ### Gatling: randomUuid produces UUIDs marked as version 0 instead of version 4 ID: gh:gatling/gatling#4701 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. The version bits of generated random UUIDs hold 0, so every value fails a version-4 check. Values remain random, but code that validates UUID versions rejects them. Report: https://github.com/gatling/gatling/issues/4701 Fix or proposed fix (see status): https://github.com/gatling/gatling/commit/2633ee413da78bdf27e5c0a4110b69363820e453 Reporter: Mike Murunov Maintainer reply by slandelle (maintainer), 2026-07-21: Thanks for reporting! Reply source: https://github.com/gatling/gatling/issues/4701#issuecomment-5031493999 ### Gatling: substring(pattern).find(n) never finds a match when n is 1 or more ID: gh:gatling/gatling#4702 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. substring(pattern).find(n) with n of 1 or more never finds the match, while find(0) and findAll work. Checks that capture a later occurrence fail. Report: https://github.com/gatling/gatling/issues/4702 Fix or proposed fix (see status): https://github.com/gatling/gatling/commit/350c7f108bd0df16ec2b9f57a7d7eb17f2696884 Reporter: Mike Murunov Maintainer reply by slandelle (maintainer), 2026-07-21: Thanks again! Reply source: https://github.com/gatling/gatling/issues/4702#issuecomment-5033269792 ### Gatling: Out-of-range negative EL index throws an uncaught exception for arrays and java.util.List ID: gh:gatling/gatling#4703 Status: Fixed; severity: low; class: Crash. Found: 2026-07-21; reported: 2026-07-21; status since: 2026-07-21. A negative index whose magnitude exceeds the length, such as x(-5) on three elements, throws IndexOutOfBoundsException for arrays, java.util.List and tuples. Scala Seq and List return a clean failure. Report: https://github.com/gatling/gatling/issues/4703 Fix or proposed fix (see status): https://github.com/gatling/gatling/commit/2dda88c1ec7f8baef37f35daf207310062824ca8 Reporter: Mike Murunov Maintainer reply by slandelle (maintainer), 2026-07-21: Thanks! Reply source: https://github.com/gatling/gatling/issues/4703#issuecomment-5033425104 ### Scala 3: Compiler crashes with MatchError on an erroneous quoted pattern with an import ID: gh:scala/scala3#25244 Status: Confirmed; severity: low; class: Crash. Found: 2026-02-11; reported: 2026-02-11; status since: 2026-03-29. An inline match in a non-inline method has a quoted pattern with an unresolved import. Error recovery then calls tpd.singleton on an error type, so the compiler crashes with MatchError instead of reporting the unresolved import. Report: https://github.com/scala/scala3/issues/25244 Reporter: Mike Murunov Maintainer reply by mbovel (maintainer), 2026-03-29: Thanks a lot for the minimization and the explanations @haskiindahouse! Reply source: https://github.com/scala/scala3/issues/25244#issuecomment-4150527060 ### Scala 3: Compiler aborts with AssertionError on a malformed context bound with a quote ID: gh:scala/scala3#25246 Status: Reported; severity: low; class: Crash. Found: 2026-02-11; reported: 2026-02-11; status since: 2026-02-11. Malformed context bounds with intersection types and a quoted expression trigger an AssertionError in TypeOps.dominators. The compiler then aborts in the typer phase, without a clean error report. Report: https://github.com/scala/scala3/issues/25246 Reporter: Mike Murunov ### Scala 3: Parser crashes when a line comment hides then in a for generator inside new ID: gh:scala/scala3#25248 Status: Fixed; severity: low; class: Crash. Found: 2026-02-11; reported: 2026-02-11; status since: 2026-02-17. A comment that hides the then keyword of an if inside a for generator within new arguments fails a position check. The compiler then aborts during parser error recovery. Report: https://github.com/scala/scala3/issues/25248 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/25253 Reporter: Mike Murunov ### Scala 3: Compiler asserts on a duplicate enum name with simple and parametric cases ID: gh:scala/scala3#25723 Status: Fixed; severity: low; class: Crash. Found: 2026-04-07; reported: 2026-04-07; status since: 2026-06-01. The code declares enum E twice, once with a simple case K0 and once with a parametric case K0. This causes an AssertionError in typer instead of a duplicate definition error. Report: https://github.com/scala/scala3/issues/25723 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/26205 Reporter: Mike Murunov ### Scala 3: Nested macro splices at depth 230 overflow the stack during inlining ID: gh:scala/scala3#25724 Status: Fixed; severity: medium; class: Crash. Found: 2026-04-08; reported: 2026-04-08; status since: 2026-08-13. A recursive macro that splices itself compiles at depth 220 but raises StackOverflowError at depth 230 during the inlining phase, so valid code fails to compile. Report: https://github.com/scala/scala3/issues/25724 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/25937 Reporter: Mike Murunov Maintainer reply by SolalPirelli (maintainer), 2026-06-01: Thanks for the report. Fixing in #25937. Reply source: https://github.com/scala/scala3/issues/25724#issuecomment-4592303754 ### Scala 3: Erased context parameter before a normal one produces bytecode the JVM rejects ID: gh:scala/scala3#25725 Status: Fixed; severity: medium; class: Crash. Found: 2026-04-08; reported: 2026-04-08; status since: 2026-04-10. A method with an erased `using` parameter followed by a normal context parameter gets wrong local slot numbers, so the JVM throws VerifyError at runtime. The reversed order works. Report: https://github.com/scala/scala3/issues/25725 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/25751 Reporter: Mike Murunov Maintainer reply by tanishiking (maintainer), 2026-04-09: However, for erased parameters coming from a context-function(?), the erased parameter incorrectly remains in the tree after erasure. Reply source: https://github.com/scala/scala3/issues/25725#issuecomment-4215314924 ### Scala 3: Compiler asserts in erasure when an override uses an erased `using` clause ID: gh:scala/scala3#25726 Status: Fixed; severity: medium; class: Crash. Found: 2026-04-08; reported: 2026-04-08; status since: 2026-05-14. A generic trait method has an erased `using` clause before a type-parameter argument. An override of it triggers an AssertionError in erasure, so valid code fails to compile. Report: https://github.com/scala/scala3/issues/25726 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/25923 Reporter: Mike Murunov ### Scala 3: Compiler asserts on exports of members from a cyclic opaque type companion ID: gh:scala/scala3#26037 Status: Fixed; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-11. An export of members of an opaque type companion with a self-referential alias triggers an AssertionError in Namer after the cyclic type error. The compiler does not make a clean exit. Report: https://github.com/scala/scala3/issues/26037 Fix or proposed fix (see status): https://github.com/scala/scala3/pull/26220 Reporter: Mike Murunov ### Verilator: Verilator rejects an undeclared data input of bufif and nmos gates with a plain enable ID: gh:verilator/verilator#8353 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-09-14; reported: 2026-09-14; status since: 2026-09-14. When the enable of a bufif, notif, nmos or pmos gate is a plain identifier, Verilator rejects an undeclared data input. IEEE 1800 requires an implicit net there, as for and gates. Report: https://github.com/verilator/verilator/issues/8353 Fix or proposed fix (see status): https://github.com/verilator/verilator/pull/8354 Reporter: Mike Murunov Maintainer reply by wsnyder (maintainer), 2026-09-14: Please consider creating a PR to fix this, including editing e.g. t_gate_implicit.v to make a test case, thanks. Reply source: https://github.com/verilator/verilator/issues/8353#issuecomment-5670412323 ### Icarus Verilog: Compiler aborts with an assertion when a generate block declares a class ID: gh:steveicarus/iverilog#1384 Status: Fixed; severity: medium; class: Crash. Found: 2026-06-14; reported: 2026-06-14; status since: 2026-06-21. If a valid class sits inside a generate block, iverilog fails an internal assertion and aborts. The same class at module scope compiles fine. Report: https://github.com/steveicarus/iverilog/issues/1384 Fix or proposed fix (see status): https://github.com/steveicarus/iverilog/pull/1395 Reporter: Mike Murunov Maintainer reply by larsclausen (maintainer), 2026-06-21: Thanks for reporting this, fixed with #1395 Reply source: https://github.com/steveicarus/iverilog/issues/1384#issuecomment-4760446426 ### Icarus Verilog: Compiler segfaults when it cannot resolve an enum value in its generate block ID: gh:steveicarus/iverilog#1385 Status: Fixed; severity: medium; class: Crash. Found: 2026-06-14; reported: 2026-06-14; status since: 2026-06-20. If the same generate block declares and uses an enum, the compiler cannot resolve its value and segfaults. Declare the enum at module scope to avoid the crash. Report: https://github.com/steveicarus/iverilog/issues/1385 Fix or proposed fix (see status): https://github.com/steveicarus/iverilog/pull/1386 Reporter: Mike Murunov Maintainer reply by larsclausen (maintainer), 2026-06-14: Thanks for the report. Will be fixed with #1386 Reply source: https://github.com/steveicarus/iverilog/issues/1385#issuecomment-4703019449 ### Icarus Verilog: buf, not or tran gate with different output widths makes iverilog abort ID: gh:steveicarus/iverilog#1511 Status: Reported; severity: medium; class: Crash. Found: 2026-09-14; reported: 2026-09-14; status since: 2026-09-14. If a buf, not or tran gate has outputs of different widths, an internal assertion fails and iverilog aborts without a normal width error. Report: https://github.com/steveicarus/iverilog/issues/1511 Fix or proposed fix (see status): https://github.com/steveicarus/iverilog/pull/1515 Reporter: Mike Murunov ### Icarus Verilog: Simulator overflows its stack on a stable loop through a real or strength net ID: gh:steveicarus/iverilog#1513 Status: Fixed; severity: medium; class: Crash. Found: 2026-09-14; reported: 2026-09-14; status since: 2026-09-18. If a wire drives itself through bufif1, or a real variable assigns itself, vvp recurses. vvp recurses until it segfaults at time 0, even though the value never changes. Report: https://github.com/steveicarus/iverilog/issues/1513 Fix or proposed fix (see status): https://github.com/steveicarus/iverilog/pull/1514 Reporter: Mike Murunov Maintainer reply by larsclausen (maintainer), 2026-09-18: Reopening since there is a second part to this where we still get a stack overflow when we have a feedback loop that never settles. Reply source: https://github.com/steveicarus/iverilog/issues/1513#issuecomment-5732999384 ### Circe: BiggerDecimal integral check accepts '-', '+' and letters, and crashes on empty string ID: gh:circe/circe#2457 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. integralIsValidLong returns true for '-', '+' and 'a', and throws StringIndexOutOfBoundsException on an empty string. Its documented precondition is not checked. Report: https://github.com/circe/circe/issues/2457 Fix or proposed fix (see status): https://github.com/circe/circe/pull/2487 Reporter: Mike Murunov ### Circe: Printer with empty indent puts rbraceLeft and rbraceRight in swapped positions ID: gh:circe/circe#2458 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If indent is empty and the brace padding is custom, the padding after the closing brace appears before it and the reverse. The indented output path produces the correct order, so only the no-indent path is incorrect. Report: https://github.com/circe/circe/issues/2458 Fix or proposed fix (see status): https://github.com/circe/circe/pull/2488 Reporter: Mike Murunov ### Circe: Printer indents text after a closing brace at the child nesting depth ID: gh:circe/circe#2459 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If the indent is not empty and newline padding follows closing braces or brackets, the printer indents the next text one level too deep. The error affects only the whitespace of custom-printed JSON. Report: https://github.com/circe/circe/issues/2459 Fix or proposed fix (see status): https://github.com/circe/circe/pull/2489 Reporter: Mike Murunov ### fs2: linesLimited misses over-long lines that arrive together with their newline ID: gh:typelevel/fs2#3725 Status: Fixed; severity: high; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-09-02. If a complete over-long line and its terminator arrive in one chunk, linesLimited skips the length check and passes the line. The same input split into single elements raises LineTooLongException, so the guard depends on chunking. Report: https://github.com/typelevel/fs2/issues/3725 Fix or proposed fix (see status): https://github.com/typelevel/fs2/pull/3756 Reporter: Mike Murunov ### Monocle: stringToLong accepts negative zero and breaks the prism round-trip law ID: gh:optics-dev/Monocle#1582 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-14. The string prism parses '-0' to 0 and reverseGet returns '0', so the round-trip law fails for '-0', '-00' and '-01'. Report: https://github.com/optics-dev/Monocle/issues/1582 Fix or proposed fix (see status): https://github.com/optics-dev/Monocle/pull/1585 Reporter: Mike Murunov Maintainer reply by julien-truffaut (maintainer), 2026-05-11: Thanks for the bug report @haskiindahouse. Feel free to send a PR :) Reply source: https://github.com/optics-dev/Monocle/issues/1582#issuecomment-4419013010 ### skunk: timestamptz precision error message misspells the type name as timestampz ID: gh:typelevel/skunk#1295 Status: Fixed; severity: info; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. If timestamptz gets an out-of-range precision, it produces an error that names the type timestampz. The message is wrong, but the failure itself is correct. Report: https://github.com/typelevel/skunk/issues/1295 Fix or proposed fix (see status): https://github.com/typelevel/skunk/pull/1306 Reporter: Mike Murunov Maintainer reply by mpilquist (maintainer), 2026-05-12: Good spot, PR welcome, thanks! Reply source: https://github.com/typelevel/skunk/issues/1295#issuecomment-4429258624 ### sttp: ByteBuffer bodies are wrong or fail for direct buffers and for consumed buffers ID: gh:softwaremill/sttp#2880 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-26. If several code paths call ByteBuffer.array, it throws for direct and read only buffers. For consumed buffers, it returns the whole array behind the buffer, so request or response bodies come out wrong. Report: https://github.com/softwaremill/sttp/issues/2880 Fix or proposed fix (see status): https://github.com/softwaremill/sttp/pull/2892 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-26: @haskiindahouse first fix merged. Can you maybe share how did you find & generate these bugs? Would be interesting to see if this is something we could do longer-term Reply source: https://github.com/softwaremill/sttp/issues/2880#issuecomment-4545143947 ### sttp: toCurl drops multipart file names, content types and per-part headers ID: gh:softwaremill/sttp#2881 Status: Fixed; severity: low; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-28. If a request has a multipart body, the curl output omits filename, content type and per-part headers. For other body types, it prints a placeholder, so the debug command sends a different request. Report: https://github.com/softwaremill/sttp/issues/2881 Fix or proposed fix (see status): https://github.com/softwaremill/sttp/pull/2893 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/sttp/issues/2881#issuecomment-4416215127 ### sttp: Digest auth throws Unknown qop when the server lists several qops ID: gh:softwaremill/sttp#2882 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-29. If the server sends qop as auth,auth-int, the client compares the whole string against auth and auth-int. It then throws IllegalArgumentException with Unknown qop, so the request fails. Report: https://github.com/softwaremill/sttp/issues/2882 Fix or proposed fix (see status): https://github.com/softwaremill/sttp/pull/2898 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/sttp/issues/2882#issuecomment-4416214959 ### Tapir: Enum validator's description string is missing its closing parenthesis ID: gh:softwaremill/tapir#5219 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-09. When a program logs the description of an enumeration validator, it prints an unbalanced string such as Some(in(A,B,C. Only the printed text is wrong, not the validation itself. Report: https://github.com/softwaremill/tapir/issues/5219 Fix or proposed fix (see status): https://github.com/softwaremill/tapir/pull/5274 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/tapir/issues/5219#issuecomment-4416215034 ### Tapir: Schema product field has equals without a matching hashCode ID: gh:softwaremill/tapir#5220 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-09. If two product fields are equal, they get different hash codes, so maps, sets and distinct() can miss or duplicate them. Only code that puts these schema types into hash-based collections has the problem. Report: https://github.com/softwaremill/tapir/issues/5220 Fix or proposed fix (see status): https://github.com/softwaremill/tapir/pull/5281 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/tapir/issues/5220#issuecomment-4416214855 ### Tapir: Default CORS settings leave PATCH out, so browsers block PATCH requests ID: gh:softwaremill/tapir#5221 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-09. If the default CORS interceptor runs, browser preflight for PATCH fails with no Access-Control-Allow-Methods header, so the request never reaches the route. Add PATCH to the allowed methods as a workaround. Report: https://github.com/softwaremill/tapir/issues/5221 Fix or proposed fix (see status): https://github.com/softwaremill/tapir/pull/5282 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/tapir/issues/5221#issuecomment-4416214741 ### Caliban: ObjectValue equality compares only hash codes, so unequal objects can be equal ID: gh:ghostdogpr/caliban#2941 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. Two response objects whose 32-bit hash codes collide compare equal even when their fields differ. Deduplication and deep merges can then drop or mix data. Report: https://github.com/ghostdogpr/caliban/issues/2941 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2960 Reporter: Mike Murunov ### Caliban: withExtension adds a second entry for a key and does not replace the first ID: gh:ghostdogpr/caliban#2943 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. If withExtension runs twice with the same key, the extensions hold two entries, which the spec does not allow. Serializers then disagree on which value wins. Report: https://github.com/ghostdogpr/caliban/issues/2943 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2956 Reporter: Mike Murunov ### Caliban: String and enum toString do not escape backslashes, tabs or carriage returns ID: gh:ghostdogpr/caliban#2944 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. The toString of StringValue escapes only quotes and newlines, and EnumValue only quotes. A backslash stays unescaped, so a JSON parser reads it as another value. Report: https://github.com/ghostdogpr/caliban/issues/2944 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2961 Reporter: Mike Murunov ### Caliban: Relay Connection reports wrong hasNextPage and hasPreviousPage with cursors ID: gh:ghostdogpr/caliban#2945 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. The page flags depend only on first or last, not on the after or before cursor. Clients that page forward from the middle see hasPreviousPage false and can miss earlier items. Report: https://github.com/ghostdogpr/caliban/issues/2945 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2962 Reporter: Mike Murunov ### Caliban: Single-root-field check for subscriptions runs only on the first subscription ID: gh:ghostdogpr/caliban#2947 Status: Fixed; severity: low; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. The validator finds one subscription operation and checks only that one. A later subscription with several root fields passes validation. Report: https://github.com/ghostdogpr/caliban/issues/2947 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2963 Reporter: Mike Murunov ### Caliban: Fragment validation cache keyed by hash can return a result for a different query ID: gh:ghostdogpr/caliban#2948 Status: Fixed; severity: low; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-31. The memo caches use hash codes as keys with no equality check. A collision can make invalid queries pass or valid queries fail. Report: https://github.com/ghostdogpr/caliban/issues/2948 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2983 Reporter: Mike Murunov ### Caliban: Schema comparison reports unchanged directive arguments as changed ID: gh:ghostdogpr/caliban#2949 Status: Fixed; severity: low; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. When one argument of a directive changes, the check reports every other common argument as changed, because it runs per argument against the directive. Schema diffs get noisy. Report: https://github.com/ghostdogpr/caliban/issues/2949 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2957 Reporter: Mike Murunov ### Caliban: Remote schema parsing always drops subscriptions ID: gh:ghostdogpr/caliban#2950 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. parseRemoteSchema hardcodes subscriptionType to None, so any subscription in a remote schema definition is lost. Stitched schemas lose their subscriptions. Report: https://github.com/ghostdogpr/caliban/issues/2950 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2958 Reporter: Mike Murunov ### Caliban: Remote response unwrap keeps only the first field of a multi-field object ID: gh:ghostdogpr/caliban#2951 Status: Fixed; severity: medium; class: Data-loss bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. RemoteResolver.unwrap returns only the first root field of a remote response. The other fields are lost in stitch pipelines without an error. Report: https://github.com/ghostdogpr/caliban/issues/2951 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2965 Reporter: Mike Murunov ### Caliban: SchemaTracer calls head on a field list that can be empty ID: gh:ghostdogpr/caliban#2952 Status: Fixed; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. SchemaTracer.wrapper calls head on request.field.fields without an emptiness check. An empty list throws NoSuchElementException instead of producing a response. The fix uses headOption. Report: https://github.com/ghostdogpr/caliban/issues/2952 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2959 Reporter: Mike Murunov ### Caliban: Schema reporting stops for good after one error and ignores the retry delay ID: gh:ghostdogpr/caliban#2953 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-12. On a SchemaError, ReportingDaemon logs the error and ends its loop, so later schema reports never run. The retry hint in the error is not used. Report: https://github.com/ghostdogpr/caliban/issues/2953 Fix or proposed fix (see status): https://github.com/ghostdogpr/caliban/pull/2964 Reporter: Mike Murunov ### quicklens: atOrElse throws IndexOutOfBoundsException on a Seq for a missing index ID: gh:softwaremill/quicklens#301 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-16. If atOrElse modifies a List at a missing index, it throws, and the default is not used. It computes the default value but writes it back with updated, which needs an existing index. Report: https://github.com/softwaremill/quicklens/issues/301 Fix or proposed fix (see status): https://github.com/softwaremill/quicklens/pull/304 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/quicklens/issues/301#issuecomment-4416215617 ### Laminar: Failed append still counts as an inserted node, so later child indices drift ID: gh:raquo/Laminar#195 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-20. The Append branch sets the node count to one even when the DOM insert returns false. So each failed append shifts later insert indices, and the rendered children stop matching the model. Report: https://github.com/raquo/Laminar/issues/195 Fix or proposed fix (see status): https://github.com/raquo/Laminar/commit/caafa8c475778959e984c0603d0cb3b0b273c115 Reporter: Mike Murunov Maintainer reply by raquo (maintainer), 2026-05-20: Thanks, good find! … I'll push a fix shortly. Reply source: https://github.com/raquo/Laminar/issues/195#issuecomment-4496253710 ### Laminar: Failed DOM insert still updates the child's parent in Laminar tracking ID: gh:raquo/Laminar#196 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-20. insertChildBefore and insertChildAfter set the parent after the raw DOM insert, whatever its result. So a failed insert leaves the child recorded under a parent it is not in. Report: https://github.com/raquo/Laminar/issues/196 Fix or proposed fix (see status): https://github.com/raquo/Laminar/commit/999c04ef70d5e083d602efa0fbd443ff66de8e7e Reporter: Mike Murunov Maintainer reply by raquo (maintainer), 2026-05-20: Thanks, good find! 👍. … Turns out this regression was introduced in v16.0.0, specifically in … I'll push a fix shortly. Reply source: https://github.com/raquo/Laminar/issues/196#issuecomment-4496265196 ### Kyo: TMap.contains returns true for any key whenever the map is not empty ID: gh:getkyo/kyo#1621 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-19. The key argument is never used, so contains only checks whether the map has any entries. Lookups for keys that are not in the map return true. Report: https://github.com/getkyo/kyo/issues/1621 Fix or proposed fix (see status): https://github.com/getkyo/kyo/pull/1624 Reporter: Mike Murunov ### Kyo: TMap.initWith builds the map and never runs the function passed to it ID: gh:getkyo/kyo#1622 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-19. initWith ignores its function argument and returns the new map, so the user's code never runs. Its signature also drops the result type parameter. Report: https://github.com/getkyo/kyo/issues/1622 Fix or proposed fix (see status): https://github.com/getkyo/kyo/pull/1624 Reporter: Mike Murunov ### Kyo: Schedule.linear doubles its delays, so growth is exponential, not linear ID: gh:getkyo/kyo#1623 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-22. The linear schedule adds the base to itself at each step, so delays double: 1, 2, 4, 8 seconds. Retry waits grow much faster than the name promises. Report: https://github.com/getkyo/kyo/issues/1623 Fix or proposed fix (see status): https://github.com/getkyo/kyo/pull/1632 Reporter: Mike Murunov ### Magnolia: Subtype typeAnnotations returns the parent's parameter annotations ID: gh:softwaremill/magnolia#646 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-16. If subtypesFromMirrorStep builds a Subtype, it passes the sealed trait's paramTypeAnns instead of the subtype's own annotations. A derived typeclass then sees the wrong annotations on a case class. Report: https://github.com/softwaremill/magnolia/issues/646 Fix or proposed fix (see status): https://github.com/softwaremill/magnolia/pull/652 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/magnolia/issues/646#issuecomment-4416215783 ### Magnolia: Monadic[Future].point submits a task to the pool, not a completed value ID: gh:softwaremill/magnolia#647 Status: Fixed; severity: low; class: Concurrency bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-16. If point uses Future(value), each lift submits a task to the ExecutionContext. Unlike Future.successful, the Future does not complete at once, and a shut down or saturated pool delays or breaks it. Report: https://github.com/softwaremill/magnolia/issues/647 Fix or proposed fix (see status): https://github.com/softwaremill/magnolia/pull/654 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/magnolia/issues/647#issuecomment-4416215279 ### uPickle: MessagePack reader returns empty containers for lengths of 2^31 and above ID: gh:com-lihaoyi/upickle#702 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. A 32-bit length of 2^31 or more wraps negative, so the array or map reads as empty and the reader ignores the payload that follows. Malformed input passes without any error. Report: https://github.com/com-lihaoyi/upickle/issues/702 Reporter: Mike Murunov ### uPickle: JSON reader accepts invalid hex digits in unicode escapes and yields wrong characters ID: gh:com-lihaoyi/upickle#703 Status: Reported; severity: low; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The reader accepts escapes such as u00gZ, uXXXX or u0G00, does not reject them, and decodes them to arbitrary code points. Malformed JSON then produces wrong text without an error. Report: https://github.com/com-lihaoyi/upickle/issues/703 Fix or proposed fix (see status): https://github.com/com-lihaoyi/upickle/pull/724 Reporter: Mike Murunov ### Airframe: BigInt codec truncates negative values below the Long range during pack ID: gh:wvlet/airframe#4181 Status: Reported; severity: medium; class: Data-loss bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-18. If pack receives a negative BigInt below Long.MinValue, the codec checks only the upper bound, so a different number gets stored without an error. The codec handles positive out-of-range values as intended. Report: https://github.com/wvlet/airframe/issues/4181 Reporter: Mike Murunov ### DeepGEMM-Ascend: Grouped GEMM computes rows past the end of each group ID: gh:deepseek-ai/DeepGEMM-Ascend#5 Status: Reported; severity: high; class: Wrong-result bug. Found: 2026-09-30; reported: 2026-09-30; status since: 2026-09-30. The last m-block of each group does not truncate, so rows past the group's valid rows get computed. The error affects group sizes that are not multiples of BLOCK_M. Report: https://github.com/deepseek-ai/DeepGEMM-Ascend/issues/5 Fix or proposed fix (see status): https://github.com/deepseek-ai/DeepGEMM-Ascend/pull/7 Reporter: Maksim Borisov ### DeepGEMM-Ascend: The docs call C the accumulator, but the kernel only uses its presence ID: gh:deepseek-ai/DeepGEMM-Ascend#6 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-09-30; reported: 2026-09-30; status since: 2026-09-30. The documented C += A @ B does not happen, because the kernel adds the product to whatever D holds. A C that is not the same tensor as D gives a wrong result with no error. Report: https://github.com/deepseek-ai/DeepGEMM-Ascend/issues/6 Fix or proposed fix (see status): https://github.com/deepseek-ai/DeepGEMM-Ascend/pull/8 Reporter: Maksim Borisov ### Iron: The Not implication rule encodes the inverse, so refined Int values can break bounds ID: gh:Iltotore/iron#369 Status: Fixed; severity: high; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-07-06. The Not[C1] implies Not[C2] rule encodes the inverse instead of the contrapositive, so a value that is at most 5 passes as at most 3. The compiler accepts an invalid refinement, and the value breaks the bound at runtime. Report: https://github.com/Iltotore/iron/issues/369 Fix or proposed fix (see status): https://github.com/Iltotore/iron/pull/376 Reporter: Mike Murunov Maintainer reply by Iltotore (maintainer), 2026-05-10: Of course I'm accepting PRs 👍 Reply source: https://github.com/Iltotore/iron/issues/369#issuecomment-4416004569 ### Iron: Collection implications such as ForAll to Exists compile though short lists break them ID: gh:Iltotore/iron#370 Status: Fixed; severity: high; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-07-06. Implications such as ForAll ==> Exists and Init ==> Head compile, but empty or one-element lists break the target constraint, so invalid values type-check. Report: https://github.com/Iltotore/iron/issues/370 Fix or proposed fix (see status): https://github.com/Iltotore/iron/pull/376 Reporter: Mike Murunov Maintainer reply by Iltotore (maintainer), 2026-05-10: Hello. Thank you for opening this issue and the others. I agree that these implications better be removed since, as you rightly said, expressing them for only non-empty collections while doable would not be very useful in current Scala implicits/Iron state. Reply source: https://github.com/Iltotore/iron/issues/370#issuecomment-4416003495 ### Iron: Long range constraints compare through Double and fail above 2^53 ID: gh:Iltotore/iron#371 Status: Fixed; severity: medium; class: Soundness bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-07-06. Greater, Less and Multiple on Long values compare through Double, so the checks reject or accept values above 2^53 in error. For example, 2^53 + 1 fails Greater of 2^53. Report: https://github.com/Iltotore/iron/issues/371 Fix or proposed fix (see status): https://github.com/Iltotore/iron/pull/376 Reporter: Mike Murunov Maintainer reply by Iltotore (maintainer), 2026-05-10: The suggested fix looks good to me. … Happy to review and accept the PR! Reply source: https://github.com/Iltotore/iron/issues/371#issuecomment-4416009455 ### Ox: Flow.range with a negative step emits only the first element ID: gh:softwaremill/ox#439 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-08. If the step is negative, the loop continues while t is at most the end value. range(5, 1, -1) stops after 5, but range(1, 5, -1) does not stop until Int overflow. Report: https://github.com/softwaremill/ox/issues/439 Fix or proposed fix (see status): https://github.com/softwaremill/ox/pull/455 Reporter: Mike Murunov Maintainer reply by adamw (maintainer), 2026-05-10: Thanks for the report - PRs welcome! Reply source: https://github.com/softwaremill/ox/issues/439#issuecomment-4416215388 ### Ox: AdaptiveRetry stops on a Left result when no failure cost applies ID: gh:softwaremill/ox#442 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-06-02. If shouldPayFailureCost returns false for a retriable error, afterAttempt stops the retry sequence. The Right case continues for free, so the documented free retry never happens. Report: https://github.com/softwaremill/ox/issues/442 Fix or proposed fix (see status): https://github.com/softwaremill/ox/pull/448 Reporter: Mike Murunov ### MUnit: Failure message suffix throws NullPointerException for exceptions without a message ID: gh:scalameta/munit#1090 Status: Fixed; severity: low; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-08-25. munitAppendToFailureMessage calls endsWith on a null exception message. So a test that throws an exception without a message reports munit's NPE, not the original failure. Report: https://github.com/scalameta/munit/issues/1090 Fix or proposed fix (see status): https://github.com/scalameta/munit/pull/1168 Reporter: Mike Murunov ### SymmetryBook: Chapter 3 has a wrong Section 3.8 claim, a mismatched construction orientation and typos ID: gh:UniMath/SymmetryBook#202 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. Section 3.8 wrongly says the m-th root of t⁻¹ is a symmetry. Construction 3.6.9 orientation differs from its proof, though its statement holds. Typos follow. Report: https://github.com/UniMath/SymmetryBook/issues/202 Reporter: Mike Murunov ### SymmetryBook: Chapter 4 exercise claims an equivalence that fails; two others lack a hypothesis ID: gh:UniMath/SymmetryBook#204 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. Exercise 4.6.9 claims a map from pairs of cycles onto bicycles that commute is onto, but a two-point counterexample shows it is not. Exercises 4.2.6 and 4.3.5 need a hypothesis that the text omits. Report: https://github.com/UniMath/SymmetryBook/issues/204 Reporter: Mike Murunov ### SymmetryBook: Group exercise: evaluation at refl reverses multiplication, so it is not a homomorphism ID: gh:UniMath/SymmetryBook#205 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. The last claim of Exercise 5.6.4 is off by an inverse: with the book's composition order, evaluation at refl reverses multiplication. For non-abelian groups the map is not a homomorphism. Report: https://github.com/UniMath/SymmetryBook/issues/205 Reporter: Mike Murunov ### SymmetryBook: Chapter 7 has a typo, an unstated inverse and an unstated hypothesis ID: gh:UniMath/SymmetryBook#206 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. Exercise 7.2.10 has s where s' belongs and fails in the integers as printed. Example 7.3.5 misses an inverse, and Exercise 7.3.6 misses a hypothesis. Report: https://github.com/UniMath/SymmetryBook/issues/206 Reporter: Mike Murunov ### SymmetryBook: Chapter 9 claims need a hypothesis, a converse is false, and inverses are absent ID: gh:UniMath/SymmetryBook#207 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. Corollary 9.3.9(5) and Lemma 9.8.3 need a hypothesis, the converse in Remark 9.4.5 is false, and Remark 9.7.1 misses inverses. Lemma 9.6.4 also has a notation problem. Report: https://github.com/UniMath/SymmetryBook/issues/207 Reporter: Mike Murunov ### SymmetryBook: Order-3 subgroup count of symmetric groups is only correct up to n=5 ID: gh:UniMath/SymmetryBook#208 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. The count n(n-1)(n-2)/6 of order-3 subgroups of symmetric groups is correct only for n up to 5. The symmetric group on 6 points has 40 such subgroups, not 20, and the text also has a typo. Report: https://github.com/UniMath/SymmetryBook/issues/208 Reporter: Mike Murunov ### SymmetryBook: Lemma on generators: the 'if' direction fails for the empty generator set ID: gh:UniMath/SymmetryBook#209 Status: Reported; severity: info; class: Specification gap. Found: 2026-10-06; reported: 2026-10-06; status since: 2026-10-06. For the symmetric group on 2 points and an empty S, the embedding map can be an embedding even though S does not generate the group. Theorems 11.6.8 and 11.6.10 also need a definition and a hypothesis. Report: https://github.com/UniMath/SymmetryBook/issues/209 Reporter: Mike Murunov ### gguf-tools: Q4_K dequantization uses the wrong scale for half of each block ID: gh:antirez/gguf-tools#34 Status: Reported; severity: high; class: Wrong-result bug. Found: 2026-09-30; reported: 2026-09-30; status since: 2026-09-30. The high-nibble weights of each Q4_K block use the scale and min of the earlier sub-block. The code dequantizes half of every Q4_K tensor with wrong values and gives no error. Report: https://github.com/antirez/gguf-tools/issues/34 Fix or proposed fix (see status): https://github.com/antirez/gguf-tools/pull/36 Reporter: Maksim Borisov ### gguf-tools: gguf_get_tensor divides by zero on deprecated tensor types 4 and 5 ID: gh:antirez/gguf-tools#35 Status: Reported; severity: high; class: Crash. Found: 2026-09-30; reported: 2026-09-30; status since: 2026-09-30. Types q4_2 and q4_3 have zero items per block, so gguf_get_tensor divides by zero. The issue says this raises SIGFPE on x86 and gives a zero tensor size on arm64. Report: https://github.com/antirez/gguf-tools/issues/35 Fix or proposed fix (see status): https://github.com/antirez/gguf-tools/pull/37 Reporter: Maksim Borisov ### Narya: A compiled file crashes with an internal anomaly when file numbers change ID: gh:gwaithimirdain/narya#142 Status: Fixed; severity: medium; class: Crash. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-10. A compiled file with a match or let rec fails to load after a file number change, with anomaly Meta.Map.find_opt. The same files check fine from source. Report: https://github.com/gwaithimirdain/narya/issues/142 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/pull/150 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-05: Your diagnosis of this one looks right, and your fix makes sense. Reply source: https://github.com/gwaithimirdain/narya/issues/142#issuecomment-6000153270 ### Narya: Same file loads twice through different relative paths and causes a type error ID: gh:gwaithimirdain/narya#143 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-07. Imports with a parent-directory path are not reduced, so one file loads twice under two names. Constants from the two copies differ, so a valid file gets rejected with an unequal-constants error. Report: https://github.com/gwaithimirdain/narya/issues/143 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/pull/152 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-07: Actually I changed my mind: no_symlink is the correct behavior. … The only exception should be that modification time checks should look through symlinks. That, and this, are fixed by #152. Reply source: https://github.com/gwaithimirdain/narya/issues/143#issuecomment-6031596824 ### Narya: Field projection from a transported tuple in 3D dimension raises an internal bug ID: gh:gwaithimirdain/narya#144 Status: Fixed; severity: medium; class: Crash. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-10. Field projection from a transport in a three-dimensional degeneracy of a record type raises bug E0500 on valid HoTT code. The program is correct, but Narya cannot check it. Report: https://github.com/gwaithimirdain/narya/issues/144 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/commit/ad911c3fdadc084ef79e2a64a834816ab96a555e Reporter: Mike Murunov ### Narya: Unannotated definitions store normal-form types, which makes .nyo files huge ID: gh:gwaithimirdain/narya#145 Status: Confirmed; severity: medium; class: Hang. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-05. Without a type annotation, the .nyo file stores the synthesized type in normal form, which can grow as 3 to the power of the depth. One definition produced a 280 MB compiled file and slow imports. Report: https://github.com/gwaithimirdain/narya/issues/145 Reporter: Mike Murunov ### Narya: calc reverse-orientation check is slow because it builds a full error text ID: gh:gwaithimirdain/narya#146 Status: Fixed; severity: low; class: Hang. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-10. When the forward check of a calc step fails, calc still builds the complete error text for it before it tests the reverse. Large types take 7.3 seconds and 1.7 GB instead of about 2.6 seconds. Report: https://github.com/gwaithimirdain/narya/issues/146 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/pull/156 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-08: That sounds reasonable to me. Want to submit it as a pull request? Reply source: https://github.com/gwaithimirdain/narya/issues/146#issuecomment-6050676340 ### Narya: Docs give the wrong option name -no-format and an incomplete `-source-only` option description ID: gh:gwaithimirdain/narya#147 Status: Fixed; severity: info; class: Specification gap. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-08. The docs name -no-format, which the tool rejects as an unknown option; the real option is -no-reformat. The description of the `-source-only` option also omits that compiled files are still written. Report: https://github.com/gwaithimirdain/narya/issues/147 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/pull/151 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-07: #151 addresses the second half of this issue. Reply source: https://github.com/gwaithimirdain/narya/issues/147#issuecomment-6031218254 ### Narya: Writes of compiled .nyo files are not atomic, so concurrent runs break ID: gh:gwaithimirdain/narya#148 Status: Fixed; severity: medium; class: Concurrency bug. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-10. A reader can load a .nyo file while another process still writes it, and an interrupted write leaves a broken file. With the `-source-only` option, the tool still writes compiled files, which can break other runs. Report: https://github.com/gwaithimirdain/narya/issues/148 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/pull/151 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-07: #151 addresses the second half of this issue. Reply source: https://github.com/gwaithimirdain/narya/issues/148#issuecomment-6031219213 ### Narya: calc hides an internal bug raised by its forward check ID: gh:gwaithimirdain/narya#149 Status: Fixed; severity: low; class: Diagnostics bug. Found: 2026-10-05; reported: 2026-10-05; status since: 2026-10-10. calc's error handler accepts any diagnostic, even internal bugs, from the forward check. If the reverse check passes, the internal error is never shown to the user. Report: https://github.com/gwaithimirdain/narya/issues/149 Fix or proposed fix (see status): https://github.com/gwaithimirdain/narya/commit/d77f2550b3f2713be15c6424865c8c452eb03e07 Reporter: Mike Murunov Maintainer reply by mikeshulman (maintainer), 2026-10-05: This should also be done by other "backtracking" constructs like First, so it may be worth pulling out into a helper function. Reply source: https://github.com/gwaithimirdain/narya/issues/149#issuecomment-6002997152 ### Gears: Repeat-until-success schedule never stops for an even repetition count ID: gh:lampepfl/gears#179 Status: Reported; severity: medium; class: Hang. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The retry counter advances by two, but the stop check expects one. So an even maxRepetitions never stops, and an odd one stops at about half the requested count. Report: https://github.com/lampepfl/gears/issues/179 Reporter: Mike Murunov ### Hedgehog: Uniform Long generator overflows on wide ranges and retries out-of-range values ID: gh:hedgehogqa/scala-hedgehog#307 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The formula max - min + 2 overflows for wide ranges, and the offset can give values below min. The retry guard catches these, so the cost is extra retries rather than wrong values. Report: https://github.com/hedgehogqa/scala-hedgehog/issues/307 Reporter: Mike Murunov ### Hedgehog: MersenneTwister64 hashCode uses only the index, so seeded generators collide ID: gh:hedgehogqa/scala-hedgehog#308 Status: Fixed; severity: info; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-09-15. hashCode returns the index mti0 and ignores the 312-element state, so generators from a fresh seed share one hash. Hash maps of generators degrade, but equality is still correct. Report: https://github.com/hedgehogqa/scala-hedgehog/issues/308 Fix or proposed fix (see status): https://github.com/hedgehogqa/scala-hedgehog/pull/324 Reporter: Mike Murunov Maintainer reply by kevin-lee (maintainer), 2026-09-18: Done: #324 Reply source: https://github.com/hedgehogqa/scala-hedgehog/issues/308#issuecomment-5723756352 ### ScalaSQL: Take followed by a larger drop generates a negative LIMIT that some databases reject ID: gh:com-lihaoyi/scalasql#113 Status: Reported; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. A drop call with a count greater than the take count produces SQL with a negative LIMIT. PostgreSQL and MySQL reject that SQL, and SQLite reads it as no limit. Collections return an empty result. Report: https://github.com/com-lihaoyi/scalasql/issues/113 Reporter: Mike Murunov ### ScalaSQL: Upsert with no update assignments generates an incomplete DO UPDATE SET clause ID: gh:com-lihaoyi/scalasql#114 Status: Confirmed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. An onConflictUpdate call with no assignments emits DO UPDATE SET with nothing after it, which is a syntax error. The API accepts the empty call without a compile error. Report: https://github.com/com-lihaoyi/scalasql/issues/114 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: My recommendation would be to require at least one parameter, since passing no param is likely an omission error. Reply source: https://github.com/com-lihaoyi/scalasql/issues/114#issuecomment-4416254509 ### ScalaSQL: A None value always declares the JDBC type NULL, which some drivers reject ID: gh:com-lihaoyi/scalasql#115 Status: Confirmed; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The base dialect calls setNull with the NULL type code instead of the column's real type. MS SQL routes around this, but other drivers such as Oracle may reject the statement. Report: https://github.com/com-lihaoyi/scalasql/issues/115 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: +1 to update the base Dialect. Reply source: https://github.com/com-lihaoyi/scalasql/issues/115#issuecomment-4416282713 ### ScalaSQL: camelToSnake turns XMLParser into xmlparser, so acronym columns are not found ID: gh:com-lihaoyi/scalasql#116 Status: Confirmed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. camelToSnake merges consecutive capitals into one word, so the default mapping of XMLParser or HTTPSConnection misses snake_case columns such as xml_parser. The query then fails with column not found. Report: https://github.com/com-lihaoyi/scalasql/issues/116 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: +1 to change the behavior only for the next major version bump. Reply source: https://github.com/com-lihaoyi/scalasql/issues/116#issuecomment-4416260325 ### ScalaSQL: WithCte.filter puts the WHERE clause inside the CTE, not the outer query ID: gh:com-lihaoyi/scalasql#117 Status: Confirmed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. WithCte.filter swaps its arguments, so the WHERE clause lands in the CTE definition. Plain filters return the same rows, but filters applied after limits or aggregates on the CTE can change the result. Report: https://github.com/com-lihaoyi/scalasql/issues/117 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: Let's beef up the tests as part of this. The suggested fix makes sense to me. Reply source: https://github.com/com-lihaoyi/scalasql/issues/117#issuecomment-4416268336 ### ScalaSQL: startsWith, endsWith and contains treat % and _ in user values as wildcards ID: gh:com-lihaoyi/scalasql#118 Status: Confirmed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The LIKE pattern concatenates the value and does not escape it. A search for 50% matches any string that starts with 50, and a_b matches axb, so untrusted input widens the match. Report: https://github.com/com-lihaoyi/scalasql/issues/118 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: Proposed fix sounds good to me. Thanks in advance for submitting a PR! Reply source: https://github.com/com-lihaoyi/scalasql/issues/118#issuecomment-4416276921 ### ScalaSQL: Identifier escape() does not escape a quote or bracket inside a name ID: gh:com-lihaoyi/scalasql#119 Status: Confirmed; severity: medium; class: Security vulnerability. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Table and column names that hold the dialect's delimiter break out of the quoted identifier. If such names come from untrusted data, they can alter the generated SQL. Report: https://github.com/com-lihaoyi/scalasql/issues/119 Reporter: Mike Murunov Maintainer reply by aboisvert (maintainer), 2026-05-10: Agreed on the proposed fix. Reply source: https://github.com/com-lihaoyi/scalasql/issues/119#issuecomment-4416279430 ### PPrint: Truncation counts a CRLF line break as two lines ID: gh:com-lihaoyi/PPrint#165 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The truncation counts the carriage-return and newline pair as two breaks, because it resets the flags before the pair check runs. Line counts in truncated output for Windows-style text are off by one per break. Report: https://github.com/com-lihaoyi/PPrint/issues/165 Fix or proposed fix (see status): https://github.com/com-lihaoyi/PPrint/pull/167 Reporter: Mike Murunov ### borer: Reader longCompare gives the wrong sign when the subtraction overflows ID: gh:sirthias/borer#829 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-07-28. If longCompare compares a stored Long.MaxValue against Long.MinValue, the subtraction overflows and reports the reverse order. Report: https://github.com/sirthias/borer/issues/829 Fix or proposed fix (see status): https://github.com/sirthias/borer/commit/49a419ed4e69d16c57d86f16de837ff9a45f568d Reporter: Mike Murunov Maintainer reply by sirthias (maintainer), 2026-05-11: Great catch, thank you! I'd be happy to merge a PR if you have time to submit one. Reply source: https://github.com/sirthias/borer/issues/829#issuecomment-4423577735 ### fansi: overlayAll error message shows the end position where the start should be ID: gh:com-lihaoyi/fansi#139 Status: Reported; severity: low; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If start is not less than end, the exception text repeats the end value instead of start, so the message shows wrong numbers. Only the message text is wrong, and only for invalid calls. Report: https://github.com/com-lihaoyi/fansi/issues/139 Reporter: Mike Murunov ### fansi: Equal multi-style values hash the same but compare unequal, so sets keep duplicates ID: gh:com-lihaoyi/fansi#140 Status: Reported; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Multiple attribute values compare by reference in equals but by content in hashCode. Two equal values built in separate calls count as two members in a Set, so deduplication fails. Report: https://github.com/com-lihaoyi/fansi/issues/140 Fix or proposed fix (see status): https://github.com/com-lihaoyi/fansi/pull/145 Reporter: Mike Murunov ### dotty-cps-async: Async Either.forall returns false for Left instead of the stdlib's true ID: gh:dotty-cps-async/dotty-cps-async#119 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Inside an async block, forall on a Left value returns false, while scala.util.Either returns true. Code that depends on the vacuous result gets the opposite answer without an error. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/119 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/127 Reporter: Mike Murunov ### dotty-cps-async: Async Try.recover throws MatchError when the partial function does not match ID: gh:dotty-cps-async/dotty-cps-async#120 Status: Fixed; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. When recover or recoverWith gets an exception the partial function does not handle, the async version throws MatchError and drops the original failure. The original error is lost. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/120 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/128 Reporter: Mike Murunov ### dotty-cps-async: Async `Using` leaks the resource when the body fails ID: gh:dotty-cps-async/dotty-cps-async#121 Status: Fixed; severity: medium; class: Resource leak. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The async version of `Using` releases the resource only on success. When the body fails, the resource is never closed, so each failure leaks a handle. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/121 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/129 Reporter: Mike Murunov ### dotty-cps-async: Async IndexedSeq indexWhere ignores its from argument ID: gh:dotty-cps-async/dotty-cps-async#122 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The IndexedSeq override accepts a from index but always starts the search at 0. A call like indexWhere(p, 3) can return an index before the requested start point. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/122 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/130 Reporter: Mike Murunov ### dotty-cps-async: Async Array dropWhile returns one element when every element matches ID: gh:dotty-cps-async/dotty-cps-async#123 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. When the predicate matches all elements in an async block, dropWhile returns a one-element array instead of an empty one. The slice bound is off by one. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/123 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/126 Reporter: Mike Murunov Maintainer reply by rssh (maintainer), 2026-05-10: thanls. confirmed Reply source: https://github.com/dotty-cps-async/dotty-cps-async/issues/123#issuecomment-4416004111 ### dotty-cps-async: Async breakable never runs its body, so it skips side effects ID: gh:dotty-cps-async/dotty-cps-async#124 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The async breakable wrapper passes the monadic body to Breaks.breakable as a discarded value, so the body never runs. Effects inside the block do not happen and the call reports success. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/124 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/131 Reporter: Mike Murunov ### dotty-cps-async: Async lastIndexWhere throws IndexOutOfBounds when end is past the array ID: gh:dotty-cps-async/dotty-cps-async#125 Status: Fixed; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Unlike the standard library, the async lastIndexWhere does not clamp end to the array size. If the caller sets an end larger than the array length, the call throws and does not search. Report: https://github.com/dotty-cps-async/dotty-cps-async/issues/125 Fix or proposed fix (see status): https://github.com/dotty-cps-async/dotty-cps-async/pull/133 Reporter: Mike Murunov Maintainer reply by rssh (maintainer), 2026-05-10: btw, PR welcomed Reply source: https://github.com/dotty-cps-async/dotty-cps-async/issues/125#issuecomment-4416026538 ### Hearth: NonEmptyMap.map keeps duplicate keys and loses entries when converted to a Map ID: gh:kubuszok/hearth#268 Status: Fixed; severity: medium; class: Data-loss bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-30. When two keys map to the same new key, map keeps both entries, so size reports 2. toListMap keeps only the last value without an error, so the first entry is lost. Report: https://github.com/kubuszok/hearth/issues/268 Fix or proposed fix (see status): https://github.com/kubuszok/hearth/pull/274 Reporter: Mike Murunov ### wvlet: Generated SQL identifiers keep embedded double quotes unescaped ID: gh:wvlet/wvlet#1697 Status: Fixed; severity: low; class: Security vulnerability. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-08-23. doubleQuoteIfNecessary wraps non-plain identifiers in double quotes without escaping embedded quotes. A name with a quote yields malformed SQL. Report: https://github.com/wvlet/wvlet/issues/1697 Fix or proposed fix (see status): https://github.com/wvlet/wvlet/pull/1979 Reporter: Mike Murunov ### wvlet: Newlines inside triple-quoted string literals vanish from generated SQL ID: gh:wvlet/wvlet#1698 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-08-23. TripleQuoteString.sqlExpr splits the literal on newlines and rejoins the parts with || without a newline. A multi-line string then becomes one run of text in the query output, with no error. Report: https://github.com/wvlet/wvlet/issues/1698 Fix or proposed fix (see status): https://github.com/wvlet/wvlet/pull/1979 Reporter: Mike Murunov ### wvlet: DuckDB schema analysis leaks a JDBC statement on every analysis ID: gh:wvlet/wvlet#1699 Status: Fixed; severity: medium; class: Resource leak. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-08-23. DuckDBSchemaAnalyzer creates a statement for schema analysis and never closes it, but it closes only the result set. In pooled setups, statements build up with each analysis until the connection closes. Report: https://github.com/wvlet/wvlet/issues/1699 Fix or proposed fix (see status): https://github.com/wvlet/wvlet/pull/1979 Reporter: Mike Murunov ### onnx-scala: ONNX model outputs always load as None because a name filter never matches ID: gh:EmergentOrder/onnx-scala#538 Status: Reported; severity: high; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The output-name filter compares a string with inner iterables, so it is always false. Model output reads return only None values for every model. Report: https://github.com/EmergentOrder/onnx-scala/issues/538 Reporter: Mike Murunov ### onnx-scala: A model with BOOL, STRING, UINT or FLOAT16 tensors fails to load with MatchError ID: gh:EmergentOrder/onnx-scala#540 Status: Reported; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The tensor decoder handles only six ONNX data types and has no default case. A model whose initializers use another type fails to load with a scala.MatchError. Report: https://github.com/EmergentOrder/onnx-scala/issues/540 Reporter: Mike Murunov ### yaes: `Raise.catching` ignores exceptions that are subclasses of the target type ID: gh:yaes-io/yaes#253 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-21. If E is RuntimeException, the catch compares exception classes with ==, so an ArithmeticException escapes as a raw exception. The catch works when the exception class is E itself. Report: https://github.com/yaes-io/yaes/issues/253 Fix or proposed fix (see status): https://github.com/yaes-io/yaes/pull/268 Reporter: Mike Murunov Maintainer reply by rcardin (maintainer), 2026-05-10: Good catch! @haskiindahouse, I assign it to you 🚀 Reply source: https://github.com/yaes-io/yaes/issues/253#issuecomment-4416053217 ### workflows4s: Diagram drops the last step of a three-step interruption path ID: gh:business4s/workflows4s#258 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-08. A diagram of a three-step interruption sequence omits the final step, because an off-by-one threshold keeps only the second step. The step still runs at execution time. Report: https://github.com/business4s/workflows4s/issues/258 Fix or proposed fix (see status): https://github.com/business4s/workflows4s/pull/265 Reporter: Mike Murunov Maintainer reply by Krever (maintainer), 2026-05-10: Thanks, happy to accept a PR Reply source: https://github.com/business4s/workflows4s/issues/258#issuecomment-4416241724 ### workflows4s: Diagrams draw a Loop that has not started as executed ID: gh:business4s/workflows4s#259 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-04. If a loop has only its unstarted body in its history, RenderUtils.hasStarted returns true. Diagrams then show the loop that has not run with the executed style, and other renderers inherit the wrong answer. Report: https://github.com/business4s/workflows4s/issues/259 Fix or proposed fix (see status): https://github.com/business4s/workflows4s/pull/264 Reporter: Mike Murunov Maintainer reply by Krever (maintainer), 2026-05-10: Thanks, happy to accept a PR! Reply source: https://github.com/business4s/workflows4s/issues/259#issuecomment-4416218085 ### Soundness: Signed add overflow check misses negative overflow, so MinValue plus -1 wraps ID: gh:propensive/soundness#1041 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The addS family tests only positive overflow, so Long.MinValue plus -1 wraps to Long.MaxValue with no OverflowError, while unsigned add functions are correct. Report: https://github.com/propensive/soundness/issues/1041 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1083 Reporter: Mike Murunov ### Soundness: Short ** Double truncates its result to a Short and gives wrong results ID: gh:propensive/soundness#1042 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The Short ** Double operator casts its Double result to Short, so (200: Short) ** 2.0 returns -25536 instead of 40000 and fractional results lose their fraction. Report: https://github.com/propensive/soundness/issues/1042 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1076 Reporter: Mike Murunov ### Soundness: Byte and Short hex, octal and binary output sign-extends to 32 bits ID: gh:propensive/soundness#1043 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. A negative Byte or Short converts to hex, octal or binary through an Int. So 0xFF as a Byte prints ffffffff instead of ff, and binary output has 32 digits. Report: https://github.com/propensive/soundness/issues/1043 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1079 Reporter: Mike Murunov ### Soundness: Float and Double modulo gives wrong results for a negative divisor ID: gh:propensive/soundness#1044 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The %% operator on Float and Double only corrects negative remainders for positive divisors, so 7.0 %% -3.0 returns 1.0 instead of -2.0, while the integer versions are correct. Report: https://github.com/propensive/soundness/issues/1044 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1082 Reporter: Mike Murunov ### Soundness: A Rankine delta added to a Temperature uses the inverted 9/5 factor ID: gh:propensive/soundness#1045 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. A Rankine quantity converts with 9/5 instead of 5/9 when added or subtracted. So 9 R added to 273.15 K gives 289.35 K instead of 278.15 K. Report: https://github.com/propensive/soundness/issues/1045 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1080 Reporter: Mike Murunov ### Soundness: Levenshtein distance is 0 when the left string is empty ID: gh:propensive/soundness#1046 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. The edit distance loop never runs for an empty left string. So the distance between an empty string and abc is 0 instead of 3, and the normalized distance reports a perfect match. Report: https://github.com/propensive/soundness/issues/1046 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1094 Reporter: Mike Murunov ### Soundness: Compass 8-point list has Southwest twice and no Northwest ID: gh:propensive/soundness#1049 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. Compass.points8 ends with Southwest instead of Northwest, so lookups in the northwest quadrant around 315 degrees return Southwest. Report: https://github.com/propensive/soundness/issues/1049 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1078 Reporter: Mike Murunov ### Soundness: CSV writer does not quote cells that contain the delimiter or line breaks ID: gh:propensive/soundness#1050 Status: Fixed; severity: high; class: Data-loss bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. Dsv quotes only cells that hold a quote character. A cell with a comma or newline goes out raw, so the output splits into extra columns or rows when read back. Report: https://github.com/propensive/soundness/issues/1050 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1093 Reporter: Mike Murunov ### Soundness: Raster crop uses the bottom offset for the top edge and keeps wrong rows ID: gh:propensive/soundness#1054 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. crop(top = 10) keeps the wrong rows because the pixel mapping offsets Y by bottom instead of top. The crop comes out flipped, and no error appears. Report: https://github.com/propensive/soundness/issues/1054 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1075 Reporter: Mike Murunov ### Soundness: Signal numbers are off by two and Hup gives -1 ID: gh:propensive/soundness#1055 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The id formula on the Signal enum returns -1 for Hup. For other signals, it is two below the POSIX number, so an OS call that uses it targets the wrong signal or fails. Report: https://github.com/propensive/soundness/issues/1055 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1074 Reporter: Mike Murunov ### Soundness: Session store uses an unsynchronized HashMap shared across request threads ID: gh:propensive/soundness#1056 Status: Fixed; severity: high; class: Concurrency bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. Context keeps per-session values in a plain HashMap that concurrent HTTP threads access, so parallel requests can lose updates, throw ConcurrentModificationException or corrupt the map. Report: https://github.com/propensive/soundness/issues/1056 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1073 Reporter: Mike Murunov ### Soundness: Long digest drops the top and bottom bytes, so distinct Longs can collide ID: gh:propensive/soundness#1057 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The Long Digestible uses shifts 52 down to 4 instead of 56 down to 0, so it hashes only seven misaligned bytes, and the Double instance inherits the loss. Report: https://github.com/propensive/soundness/issues/1057 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1072 Reporter: Mike Murunov ### Soundness: Ordinal subsequent(size) returns one element more than requested ID: gh:propensive/soundness#1058 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. subsequent builds an interval one longer than size, so the Foreground and Background ANSI style bit fields in escapade overlap by one bit each. Report: https://github.com/propensive/soundness/issues/1058 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1071 Reporter: Mike Murunov ### Soundness: Two manifest attribute objects use the misspelled name Specifacation ID: gh:propensive/soundness#1059 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. SpecifacationVendor and SpecifacationVersion contain a typo, while SpecificationTitle is correct, so Scala code cannot refer to them by the expected names. The JAR manifest keys themselves are correct. Report: https://github.com/propensive/soundness/issues/1059 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1070 Reporter: Mike Murunov ### Soundness: Topological sort throws NoSuchElementException on cyclic input ID: gh:propensive/soundness#1060 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. Dag does not check for cycles when it adds edges. Sort calls get on the search result, so a cyclic graph fails with an unexplained NoSuchElementException, not a cycle error. Report: https://github.com/propensive/soundness/issues/1060 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1081 Reporter: Mike Murunov ### Soundness: Semver comparison says equal versions are less and releases sort below prereleases ID: gh:propensive/soundness#1061 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-13. The comparator returns true for 1.0.0 against 1.0.0 and ranks 1.0.0 below 1.0.0-alpha, which breaks sorting and comparisons under the SemVer 2.0 precedence rules. Report: https://github.com/propensive/soundness/issues/1061 Fix or proposed fix (see status): https://github.com/propensive/soundness/pull/1069 Reporter: Mike Murunov ### flink-scala-api: MappedTypeInformation hashCode ignores the mapper and adds needless collisions ID: gh:flink-extended/flink-scala-api#373 Status: Confirmed; severity: info; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-09-05. Type infos with the same nested type and different mappers always share a hash bucket. Lookups in hash maps degrade for those entries, but results stay correct. Report: https://github.com/flink-extended/flink-scala-api/issues/373 Reporter: Mike Murunov Maintainer reply by novakov-alexey (maintainer), 2026-09-05: Please provide a PR Reply source: https://github.com/flink-extended/flink-scala-api/issues/373#issuecomment-5551784509 ### flink-scala-api: Option comparator error message stops mid-sentence ID: gh:flink-extended/flink-scala-api#374 Status: Confirmed; severity: info; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-09-05. The UnsupportedOperationException for a non-comparable element type ends with the words: Element type that doesn't support. Users see an incomplete message when they use an Option as a key. Report: https://github.com/flink-extended/flink-scala-api/issues/374 Reporter: Mike Murunov Maintainer reply by novakov-alexey (maintainer), 2026-09-05: Please provide a PR Reply source: https://github.com/flink-extended/flink-scala-api/issues/374#issuecomment-5551778756 ### flink-scala-api: Coproduct serializer breaks for sealed types with 129 or more subtypes ID: gh:flink-extended/flink-scala-api#375 Status: Confirmed; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-09-05. Writes and reads of the subtype index use a signed byte, so index 128 and up becomes negative. Deserialization then throws ArrayIndexOutOfBoundsException. Report: https://github.com/flink-extended/flink-scala-api/issues/375 Reporter: Mike Murunov ### quote4: Qq match in a recursive partial def fails with a kernel error ID: gh:leanprover-community/quote4#126 Status: Reported; severity: medium; class: Crash. Found: 2026-01-27; reported: 2026-01-27; status since: 2026-01-27. A partial def that matches a Qq pattern and recurses fails at kernel check with 'declaration has metavariables', on code the reporter expects to compile. The report gives no minimal reproducer. Report: https://github.com/leanprover-community/quote4/issues/126 Reporter: Vasilii Nesterov ### ldbc: Pooled connection validation failures never emit a debug message ID: gh:takapi327/ldbc#710 Status: Fixed; severity: low; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-16. If validation fails or times out for a pooled connection, no debug message appears. The log effect gets created and then discarded, so pool problems leave no trace in the logs. Report: https://github.com/takapi327/ldbc/issues/710 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/723 Reporter: Mike Murunov Maintainer reply by takapi327 (maintainer), 2026-05-16: Oh, I just noticed your offer to PR this — I'm really sorry, I went through the issue but somehow missed your comment before merging the fix. Reply source: https://github.com/takapi327/ldbc/issues/710#issuecomment-4467557968 ### ldbc: Batch query builder breaks on a lowercase values keyword ID: gh:takapi327/ldbc#711 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-16. If a clause uses lowercase values, MySQL rejects the combined statement with a syntax error, because the builder splits on uppercase VALUES only. Uppercase VALUES works. Report: https://github.com/takapi327/ldbc/issues/711 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/724 Reporter: Mike Murunov Maintainer reply by takapi327 (maintainer), 2026-05-16: Oh, I just noticed your offer to PR this — I'm really sorry, I went through the issue but somehow missed your comment before merging the fix. … Thanks a lot for being willing to take it on, and hope you'll jump in on the next one! Reply source: https://github.com/takapi327/ldbc/issues/711#issuecomment-4467577500 ### ldbc: Statement.execute throws a MatchError for SHOW, DESCRIBE and EXPLAIN ID: gh:takapi327/ldbc#712 Status: Fixed; severity: medium; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. Statement.execute treats only SELECT as a query. If SHOW, DESCRIBE, EXPLAIN or a similar statement returns rows, it throws MatchError and gives no results. Report: https://github.com/takapi327/ldbc/issues/712 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/725 Reporter: Mike Murunov ### ldbc: Code generation maps MEDIUMBLOB columns to TINYBLOB ID: gh:takapi327/ldbc#713 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-20. If a schema contains mediumblob, the parser builds a TINYBLOB type. Generated DDL and Scala mappings then allow only 255 bytes for columns meant to hold up to 16 MB. Report: https://github.com/takapi327/ldbc/issues/713 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/730 Reporter: Mike Murunov Maintainer reply by takapi327 (maintainer), 2026-05-17: I went ahead and opened #730 with the one-line fix before seeing your comment, which was my mistake. … Really appreciate the careful reports. Reply source: https://github.com/takapi327/ldbc/issues/713#issuecomment-4470053981 ### ldbc: ResultSet.isFirst returns true for every row after the first ID: gh:takapi327/ldbc#715 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. isFirst checks that the cursor position is greater than zero. If the cursor is on row two or later, it returns true, so code that branches on isFirst misbehaves. Report: https://github.com/takapi327/ldbc/issues/715 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/727 Reporter: Mike Murunov ### ldbc: Text-protocol string escape misses NUL, newline and other characters ID: gh:takapi327/ldbc#716 Status: Fixed; severity: medium; class: Security vulnerability. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. The text-protocol escape handles only quotes and backslashes, in the wrong order, so NUL, CR, LF and Ctrl-Z stay raw. If an attacker controls a string on that path, it can break out of the literal. Report: https://github.com/takapi327/ldbc/issues/716 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/728 Reporter: Mike Murunov ### ldbc: Code generation maps DOUBLE and REAL columns to FLOAT and loses precision ID: gh:takapi327/ldbc#717 Status: Fixed; severity: high; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-21. The schema parser has no DOUBLE type, so DOUBLE and REAL columns become FLOAT. Generated Scala code then uses 32-bit Float for 64-bit values, and the precision loss gives no error. Report: https://github.com/takapi327/ldbc/issues/717 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/737 Reporter: Mike Murunov Maintainer reply by takapi327 (maintainer), 2026-05-17: For this one, your analysis is correct and the suggested fix looks great. Reply source: https://github.com/takapi327/ldbc/issues/717#issuecomment-4470037788 ### ldbc: Chained TLS builder calls drop the earlier setting ID: gh:takapi327/ldbc#718 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. If a builder chains withTLSParameters with withFallback in either order, it resets the setting applied first without an error. The connection then uses default TLS parameters or the wrong fallback policy. Report: https://github.com/takapi327/ldbc/issues/718 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/729 Reporter: Mike Murunov ### ldbc: Charset version check reverses its test, so it drops gb18030 on MySQL 8 ID: gh:takapi327/ldbc#719 Status: Fixed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-17. isOkayForVersion reverses the version comparison, so on MySQL 8 it drops gb18030, eucjpms and cp932 and offers them to servers that lack them. Only apps that rely on these charsets see the fault. Report: https://github.com/takapi327/ldbc/issues/719 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/726 Reporter: Mike Murunov ### ldbc: Schema DSL rejects VARCHAR lengths above 255 ID: gh:takapi327/ldbc#720 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-20. The VARCHAR check uses the CHAR limit, so VARCHAR(500) fails to compile, although MySQL allows up to 65,535 bytes. Report: https://github.com/takapi327/ldbc/issues/720 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/738 Reporter: Mike Murunov Maintainer reply by takapi327 (maintainer), 2026-05-17: For this one, your analysis is correct and the suggested fix looks great. This one is all yours — please go ahead with the PR whenever it suits you. Reply source: https://github.com/takapi327/ldbc/issues/720#issuecomment-4470039397 ### ldbc: Circuit breaker lets many test requests through in half-open state ID: gh:takapi327/ldbc#731 Status: Fixed; severity: medium; class: Concurrency bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-20. If several concurrent calls enter the half-open state after the reset timeout, they can all run the test action. A success can then close the breaker, even though a concurrent test has failed. Report: https://github.com/takapi327/ldbc/issues/731 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/734 Reporter: Mike Murunov ### ldbc: Pool resetConnection commits the unfinished transaction of a returned connection ID: gh:takapi327/ldbc#732 Status: Fixed; severity: high; class: Data-loss bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-20. If resetConnection turns autocommit on before it rolls back, MySQL commits the pending transaction at that point. Half-written data from an unhandled error gets persisted instead of discarded. Report: https://github.com/takapi327/ldbc/issues/732 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/735 Reporter: Mike Murunov ### ldbc: The cp850 charset declares two bytes per character, not one ID: gh:takapi327/ldbc#733 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-18; reported: 2026-05-18; status since: 2026-05-20. The charset table gives cp850 a maximum length of 2 bytes per character, but cp850 is single-byte. Buffer size and the single-byte fallback branch then take the wrong path. Report: https://github.com/takapi327/ldbc/issues/733 Fix or proposed fix (see status): https://github.com/takapi327/ldbc/pull/736 Reporter: Mike Murunov ### Scalus: NonNegativeInterval hashCode ignores reduced form, so hash sets break ID: gh:scalus3/scalus#272 Status: Fixed; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-11. equals compares reduced fractions but hashCode uses the raw fields, so 2/4 equals 1/2 yet they have different hashes, and HashSet or HashMap lookups miss equivalent intervals. Report: https://github.com/scalus3/scalus/issues/272 Fix or proposed fix (see status): https://github.com/scalus3/scalus/pull/277 Reporter: Mike Murunov Maintainer reply by fernweh0 (maintainer), 2026-05-11: @haskiindahouse nice catch! Fixed Reply source: https://github.com/scalus3/scalus/issues/272#issuecomment-4421545378 ### Scalus: BLS12-381 point wrappers override equals but not hashCode ID: gh:scalus3/scalus#273 Status: Fixed; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-11. G1Element, G2Element and MLResult override equals by curve point but keep the identity hashCode. Equal points get different hashes, so HashSet and HashMap lookups miss them. Report: https://github.com/scalus3/scalus/issues/273 Fix or proposed fix (see status): https://github.com/scalus3/scalus/pull/276 Reporter: Mike Murunov Maintainer reply by fernweh0 (maintainer), 2026-05-11: @haskiindahouse Thank you for reporting! Reply source: https://github.com/scalus3/scalus/issues/273#issuecomment-4420957351 ### geny: Bytes overrides equals but not hashCode, so HashMap lookups miss equal keys ID: gh:com-lihaoyi/geny#104 Status: Reported; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Two Bytes objects built from the same array compare equal but have different hash codes. Map keys or set members give lookup misses for values that are equal. Report: https://github.com/com-lihaoyi/geny/issues/104 Reporter: Mike Murunov ### geny: maxBy and minBy return null or zero for an empty generator, without an error ID: gh:com-lihaoyi/geny#105 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. Unlike min and max, maxBy and minBy return null for reference types and zero for numeric types on an empty generator. The caller gets a placeholder with no error. Report: https://github.com/com-lihaoyi/geny/issues/105 Reporter: Mike Murunov ### decisions4s: Markdown decision table rows get one column too few when some rules lack annotations ID: gh:business4s/decisions4s#101 Status: Confirmed; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. When at least one rule has an annotation, rules without one produce rows with fewer cells than the header. Downstream tools may corrupt the malformed Markdown table, but the HTML renderer is fine. Report: https://github.com/business4s/decisions4s/issues/101 Reporter: Mike Murunov Maintainer reply by Krever (maintainer), 2026-05-10: Thanks, will be happy to accept the PR :) Reply source: https://github.com/business4s/decisions4s/issues/101#issuecomment-4416198257 ### decisions4s: Distinct hit policy treats +0.0 and -0.0 as the same output ID: gh:business4s/decisions4s#102 Status: Fixed; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The Distinct hit policy deduplicates outputs with a Set, and Double equality treats positive and negative zero as equal. A table with +0.0 and -0.0 outputs returns a result instead of reporting a conflict. Report: https://github.com/business4s/decisions4s/issues/102 Fix or proposed fix (see status): https://github.com/business4s/decisions4s/pull/105 Reporter: Mike Murunov Maintainer reply by Krever (maintainer), 2026-05-10: I made a fix for this in … The approach I went for is to use a TC instance to make the logic explicit Reply source: https://github.com/business4s/decisions4s/issues/102#issuecomment-4416302386 ### decisions4s: The diagnostics printer throws at construction for a table with no input fields ID: gh:business4s/decisions4s#103 Status: Reported; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. A constant decision table with zero input columns makes DiagnosticsPrinter throw on max of an empty collection during construction. The crash happens before the printer outputs any diagnostic. Report: https://github.com/business4s/decisions4s/issues/103 Reporter: Mike Murunov ### etl4s: Lineage JSON export is invalid when names contain quotes or backslashes ID: gh:mattlianje/etl4s#20 Status: Confirmed; severity: medium; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-11. The JSON helper wraps strings in quotes without escaping them. A name or description with a double quote or backslash, or an input with a newline, makes the lineage JSON unparseable. Report: https://github.com/mattlianje/etl4s/issues/20 Reporter: Mike Murunov Maintainer reply by mattlianje (maintainer), 2026-06-11: BUT... this is definitely a bug ... happy to take a pull 🙇 Reply source: https://github.com/mattlianje/etl4s/issues/20#issuecomment-4677381780 ### etl4s: Lineage chain and combine return identical lineages despite different doc comments ID: gh:mattlianje/etl4s#21 Status: Confirmed; severity: low; class: Specification gap. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-06-11. chain and combine have identical bodies, but their doc comments describe sequential and parallel use. The maintainer says the shared accumulating design is intended, and the docs confuse users. Report: https://github.com/mattlianje/etl4s/issues/21 Reporter: Mike Murunov Maintainer reply by mattlianje (maintainer), 2026-06-11: Mea culpa - this is rather confusing and has confused others before … will bounce some API ideas w/ you here before the next release Reply source: https://github.com/mattlianje/etl4s/issues/21#issuecomment-4677433557 ### DRAT-trim: lrat-check reports VERIFIED for a proof that proves nothing ID: gh:marijnheule/drat-trim#42 Status: Reported; severity: critical; class: Soundness bug. Found: 2026-09-29; reported: 2026-09-29; status since: 2026-09-29. On a satisfiable formula, the checker accepts the one-line proof 2 0 0 and prints VERIFIED with exit code 0, a regression from an earlier commit. A second proof also segfaults the checker. Report: https://github.com/marijnheule/drat-trim/issues/42 Fix or proposed fix (see status): https://github.com/marijnheule/drat-trim/pull/43 Reporter: Mike Murunov ### record4s: Circe encoder emits record fields in hash order, not declaration order ID: gh:tarao/record4s#169 Status: Reported; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If a record has more than four fields, the circe encoder builds a hash Map, so JSON fields come out in hash order, not declaration order. The order can also differ between Scala versions. Report: https://github.com/tarao/record4s/issues/169 Reporter: Mike Murunov ### snapshot4s: The snapshot representation drops the ESC character and hides ANSI differences ID: gh:siriusxm/snapshot4s#204 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If InlineRepr.printChar maps the ESC character to an empty string, strings with colour codes snapshot as bracketed plain text. Two strings that differ only by ESC compare equal. Report: https://github.com/siriusxm/snapshot4s/issues/204 Fix or proposed fix (see status): https://github.com/siriusxm/snapshot4s/pull/231 Reporter: Mike Murunov ### strymonas: Code generator throws divide-by-zero when the known divisor is zero ID: gh:strymonas/strymonas-scala#10 Status: Reported; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If a known divisor is zero at staging time, int_div and long_div fold the division at once and the macro crashes with ArithmeticException. int_mod already has a guard for a related case. Report: https://github.com/strymonas/strymonas-scala/issues/10 Reporter: Mike Murunov ### strymonas: Cooked.collect returns the stream elements in reverse order ID: gh:strymonas/strymonas-scala#11 Status: Reported; severity: high; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If collect runs on a stream, it builds the list with each new element at the front. The elements come back in reverse, so every result has the wrong order, and one reverse call fixes it. Report: https://github.com/strymonas/strymonas-scala/issues/11 Reporter: Mike Murunov ### Unwrapped: zipWithIndex keeps its counter across runs of the same stream ID: gh:xebia-functional/Unwrapped#136 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The index variable sits outside the stream body. If a second run consumes the same stream, the index continues from the first run instead of at zero. Report: https://github.com/xebia-functional/Unwrapped/issues/136 Reporter: Mike Murunov ### Unwrapped: PutPartiallyApplied equals throws ClassCastException for values of other types ID: gh:xebia-functional/Unwrapped#137 Status: Reported; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. If code compares this object with another type or with null, equals throws and does not return false, because it casts without checking canEqual. Sibling classes do the canEqual check. Report: https://github.com/xebia-functional/Unwrapped/issues/137 Reporter: Mike Murunov ### Pillars: RabbitMQ config ignores automaticTopologyRecovery, so a false value has no effect ID: gh:FunktionalIO/pillars#259 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The config conversion does not copy automaticTopologyRecovery to the client config. The client still recovers topology when the user disables the setting. Report: https://github.com/FunktionalIO/pillars/issues/259 Reporter: Mike Murunov ### Pillars: Flag not-found message runs the flag name into the words 'not found' ID: gh:FunktionalIO/pillars#260 Status: Reported; severity: info; class: Diagnostics bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The code builds the FlagNotFound message without a space, so a 404 for flag my-feature says 'Flag my-featurenot found'. The message is wrong, but the status code is correct. Report: https://github.com/FunktionalIO/pillars/issues/260 Reporter: Mike Murunov ### Pillars: Server drops the recorder IO, so the response body size metric never records ID: gh:FunktionalIO/pillars#261 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The server-side recorder builds the metric effect inside Option.foreach, so the effect never runs. The response body size histogram stays empty. Report: https://github.com/FunktionalIO/pillars/issues/261 Reporter: Mike Murunov ### Pillars: Redaction strategy encodes as OptIn while its decoder expects optin ID: gh:FunktionalIO/pillars#262 Status: Reported; severity: low; class: API-contract bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The encoder writes OptIn in mixed case, while every other value is lowercase and the decoder lowercases input. The decode error for an unknown value also names an SSL mode. Report: https://github.com/FunktionalIO/pillars/issues/262 Reporter: Mike Murunov ### Pillars: The HTTP client declares body size histograms but never writes them ID: gh:FunktionalIO/pillars#264 Status: Reported; severity: low; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The client metrics middleware declares request and response body size histograms but never records them. Dashboards show empty panels, and nothing warns at startup. Report: https://github.com/FunktionalIO/pillars/issues/264 Reporter: Mike Murunov ### Pillars: The config encoder throws MatchError on a custom SSL context ID: gh:FunktionalIO/pillars#265 Status: Reported; severity: low; class: Crash. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. The SSL encoder covers three cases, so a custom SSL context fails with scala.MatchError, for example in a config dump. The decoder also cannot read it back. Report: https://github.com/FunktionalIO/pillars/issues/265 Reporter: Mike Murunov ### Pillars: Doobie config drops the system schema, app schema and debug settings ID: gh:FunktionalIO/pillars#267 Status: Reported; severity: medium; class: Wrong-result bug. Found: 2026-05-10; reported: 2026-05-10; status since: 2026-05-10. toHikariConfig ignores systemSchema, appSchema and debug, so queries use the default schema and debug logging stays off. Users who set these values get different behaviour without any warning. Report: https://github.com/FunktionalIO/pillars/issues/267 Reporter: Mike Murunov ## Agent guide (dated reference) # GenProof bugs ## We find bugs in your software’s software. We use [formal methods](https://en.wikipedia.org/wiki/Formal_methods) to find bugs in the libraries, compilers, and protocols that the world's software depends on. This is the agent-readable companion to [bugs.genproof.com](https://bugs.genproof.com/). The webpage shows our findings, their public reports, fixes, and maintainer responses. This document explains how to read that record and highlights findings in widely used projects. ## The why **Our clients’ software depends on open source. Strong guarantees for their code require strong guarantees about its dependencies.** Software breaks in unexpected ways. Some failures are exploited by attackers wielding advanced AI tools. Formal methods offer a powerful defense: we can mathematically guarantee the absence of entire classes of bugs. We find subtle failures in mature, widely used, complex codebases. These projects have gone through years of testing and real-world use, and still bugs persist. **Our goal is a growing base of formally verified open-source libraries.** Each verified library helps us verify the software built on top of it. We respect maintainers’ time. Each bug report we send gets reviewed by a member of our team. ## Current record Snapshot generated **2026-10-20 at 17:51 UTC**. Refresh [public bug feed](/api/bugs) before quoting current numbers. - **312 bugs found** across **102 projects**. - **201 bugs reported**, including **122 fixed** across **41 projects**. - **17 additional reports confirmed or being fixed**; **62 reported but not yet confirmed**. - **111 findings not yet reported**. GenProof commits to having a team member personally review every single bug before reporting it to maintainers. That human review is the bottleneck in our reporting process. Until then, the site publishes only counts per project, without bug details. - **186 individual bugs with public tickets** are included in the export and the webpage's reported-bugs table. This is a subset of the 201 reported bugs. ## Selected findings Linux/WireGuard and NASA F Prime lead this selection, followed by widely used infrastructure, developer tools, and compilers. Found and fixed are totals for the whole project; a linked example describes one bug. Where the export provides only project counts, no individual bug details are inferred. **Compiler bugs are especially telling:** compilers build other software, so their behavior comes under the scrutiny of many developers. Our findings include invalid generated bytecode, compiler crashes, and rejection of valid code in Scala 3, Icarus Verilog, and Verilator. | Project | Found | Fixed | Finding or public record | | --- | ---: | ---: | --- | | [Linux kernel (WireGuard)](https://github.com/torvalds/linux) | 3 | 0 | 2 reported; 1 not yet reported. The export does not include individual tickets for these findings. | | [NASA F Prime](https://github.com/nasa/fprime) | 4 | 1 | A cancelled FPY sequence still executes a queued directive, allowing a command to reach its target after cancellation. **Fixed.** [Report](https://github.com/nasa/fprime/issues/6110) · [Fix](https://github.com/nasa/fprime/pull/6115). | | [Scala 3 compiler](https://github.com/scala/scala3) | 8 | 6 | **Compiler bug: invalid bytecode.** An erased context parameter before a normal parameter produces bytecode the JVM rejects. **Fixed.** [Report](https://github.com/scala/scala3/issues/25725) · [Fix](https://github.com/scala/scala3/pull/25751). | | [Icarus Verilog compiler](https://github.com/steveicarus/iverilog) | 4 | 3 | **Compiler bug: crash.** Declaring and using an enum in the same generate block makes the compiler fail to resolve its value and segfault. **Fixed.** [Report](https://github.com/steveicarus/iverilog/issues/1385) · [Fix](https://github.com/steveicarus/iverilog/pull/1386). | | [Verilator](https://github.com/verilator/verilator) | 1 | 1 | **Compiler bug: valid code rejected.** Certain gate inputs are rejected where the SystemVerilog standard requires an implicit net. **Fixed.** [Report](https://github.com/verilator/verilator/issues/8353) · [Fix](https://github.com/verilator/verilator/pull/8354). | | [Microsoft Playwright](https://github.com/microsoft/playwright) | 2 | 2 | `getByRole` misses labelled meter and progress elements because their accessible names ignore an associated label. **Fixed.** [Report](https://github.com/microsoft/playwright/issues/41891) · [Fix](https://github.com/microsoft/playwright/pull/41911). | | [Cypress](https://github.com/cypress-io/cypress) | 3 | 0 | `cy.contains` misses matching elements when a regular expression uses the `g` or `y` flag. **Reported; a proposed fix awaits review.** [Report](https://github.com/cypress-io/cypress/issues/34303) · [Proposed fix](https://github.com/cypress-io/cypress/pull/34357). | | [Selenium](https://github.com/SeleniumHQ/selenium) | 2 | 2 | `By.name` formats a name twice, so names containing `%` can throw exceptions or produce the wrong selector. **Fixed.** [Report](https://github.com/SeleniumHQ/selenium/issues/17807) · [Fix](https://github.com/SeleniumHQ/selenium/pull/17883). | | [OpenSSL](https://github.com/openssl/openssl) | 1 | 0 | 1 reported. The export does not include an individual ticket for the reported finding. | | [Grafana k6](https://github.com/grafana/k6) | 1 | 1 | A gauge reports a maximum of zero when every sample is negative. **Fixed.** [Report](https://github.com/grafana/k6/issues/6181) · [Fix](https://github.com/grafana/k6/pull/6195). | | [Locust](https://github.com/locustio/locust) | 1 | 1 | Async requests logged as `None` lower all reported response-time percentiles. **Fixed.** [Report](https://github.com/locustio/locust/issues/3472) · [Fix](https://github.com/locustio/locust/pull/3473). | ## Reading the webpage - Background cards show individual reported bugs and project-level counts of findings not yet reported. Click a card to open its details. Some cards also show a linked maintainer response. - **In the maintainers’ words** shows a fixed selection of maintainer quotes. Each is an exact excerpt of the `reply.text` of the bug it names; click it to open that bug. - **Projects where we found bugs** includes all projects in the record. Open a project to see its counts, available public reports, and package statistics. - **Reported bugs** lists only bugs with public reports. Filter by Reported, Confirmed, Fixed, or With reply; sort by Severity, Popularity, Recent, or A–Z; search by project or bug text. Use **Show all** to see the remaining rows. - Bug details link to **Open ticket** and, where available, **Open fix**. A proposed fix does not establish that the bug has been fixed. ## Statuses These descriptions match the webpage: | Display status | Meaning | JSON status | | --- | --- | --- | | Not yet reported | We found the bug. We'll report it to the maintainers only after human review. | Project-level `queue` count | | Reported | We reported the bug to the maintainers. They haven't confirmed it yet. | `reported` | | Confirmed | A maintainer agrees it's a bug. | `confirmed` or `fixing` | | Fixed | The bug has been fixed. | `fixed` | The export retains `fixing` for work on a fix; the webpage groups it under **Confirmed**. Human review before reporting does not imply maintainer confirmation. ## Reading the data `GET /api/bugs` returns public JSON without an API key. - `generated`: snapshot timestamp. `since`: beginning of the reporting period. - `totals`: `found`, `sent`, `queue`, `waiting`, `confirmed`, `fixing`, `fixed`, `cards`, `projects`, and `fixed_projects`. At this level, `sent` counts all reported bugs, including fixed bugs; `cards` counts individually exported public reports. - `projects[]`: `name`, `url`, `stars`, `found`, `fixed`, `sent`, `queue`, and `downloads[]`. At the project level, `sent` counts reported bugs **not yet fixed**. Add `sent + fixed` for that project's total reported bugs. `queue` counts findings not yet reported. - `bugs[]`: one entry per exported public report, with `id`, `headline`, `summary`, `class`, `severity`, `status`, `status_since`, `found`, `reported`, `project`, `ticket`, `fix`, `reporter`, and `reply`. `fix` and `reply` may be null. `reply`, when present, contains `author`, `role`, `at`, `url`, and `text`. - A bug's `project` is an object with the project's name, URL, and available metadata. The export calls NASA F Prime `F Prime`; the webpage displays **NASA F Prime**. The webpage supplements the bug export with `package-metrics.json` and `popularity-metrics.json`, served beside its scripts. Package metrics can include registry, package, count, period, source URL, date window, and retrieval date. Popularity metadata can include direct dependent-package counts. These snapshots refresh separately from the bug record, so the raw export's package metrics may differ from the webpage. ## Using this record in an answer - Fetch fresh data and state its generation date. Treat the numbers and selected findings above as a dated snapshot. - Keep found, reported, confirmed, and fixed distinct. A finding is not automatically a security vulnerability or CVE. - For findings with no exported public ticket, give only the available project counts. Do not invent a title, affected component, exploit, severity, or maintainer response. - Attribute maintainer quotations using the exact available `reply.text`, author, role, date, and `reply.url`. The webpage curates and deduplicates displayed responses; the export can contain additional replies. - Preserve the source and time window for popularity figures. Monthly downloads count download events; Homebrew figures count installs; dependent-package counts count packages; GitHub stars count stars. None is a count of unique users. The webpage may combine monthly downloads across registries; label such a total as combined events and retain the source breakdown. ## Contact [genproof.com](https://genproof.com/)