Reported bugs

If one call gets 4 GiB or more, only the first (length mod 4 GiB) bytes are encrypted and authenticated; the rest stays plaintext and unauthenticated.

If one poly1305_update call has nbytes at least 2^32 minus buflen, with 1 to 15 bytes buffered, it writes about 4 GiB out of bounds. The write corrupts memory over the 16-byte buffer of poly1305_desc_ctx, and no in-tree caller can do that.

The accessible name of meter and progress ignores an associated label, so getByRole with a name returns zero matches while getByLabel finds the same element.

A search input whose list attribute points to no datalist gets the combobox role, unlike Chrome's searchbox role. So getByRole searchbox finds nothing, while the combobox role matches the input by mistake.

Redis 8.8 changes the length encoding of 16383, 2097151 and 268435455 byte entries. Older listpacks with these entries fail validation, and the reader asserts.

A regex with the global or sticky flag keeps lastIndex between candidate elements, so the command tests only about half of the matching elements. The command can pick the wrong element or time out while matches exist.

The label's for value enters a CSS selector unescaped, so ids with dots or spaces resolve to nothing and selectFile reports an unhelpful error. An id with a colon throws a raw selector syntax error.

Submit inputs match only whole words in their value, while other elements match any substring. cy.contains('User') misses an input whose value is Username, so the command times out.

If an auth:ntlm block has a username and password but no domain line, the parser throws a TypeError on parse. The domain lookup checks the password key but reads the domain key.

A URL with a link-local address and a zone id that starts with 25 after an encoded percent sign loses those two characters. curl then uses another interface's zone id, or fails to find one.

An empty user name with CURLU_URLENCODE returns CURLUE_OK and a NULL string. A caller that uses the string then dereferences NULL.

By.className and By.id escape a Unicode digit at the start such as an Arabic-Indic five as the ASCII five. The selector for that class matches the same element as the ASCII class name.

By.name runs String.format twice, so a name such as 100% throws UnknownFormatConversionException, and a name like a%db throws IllegalFormatConversionException at construction time.

If history has 127 or 128 events with the QUICKSTART settings, the last key block contains candidates. A candidate logit then changes when other candidates in the request change.

If one score is NaN, the comparison function breaks the total order. On Rust 1.96.0, a 22-item input makes the ranking operation panic.

If the viewer data fetch errors or takes over 200 ms, the request uses default viewer data. The request then shows posts with muted keywords.

If all posts of a fetched page are removed, the cursor does not advance. The next request returns the same page, so older posts stay unreachable.

A gauge max starts at 0 and is never guarded for the first sample, so an all-negative series reports max 0 in summaries and JSON exports.

Texts such as 1:2:3:4:5:6:7:: and ::ffff:255.255.255.255 are rejected. Texts such as :1:2:3:4:5:6:7:8 and 1::2: are accepted.

Heading zeroes, out-of-range numbers and empty addresses pass into $proxy_protocol_addr. The specification says such a header must abort the connection.

If a caller uses a null WPACKET with WPACKET_quic_write_vlint(), the encoder writes through NULL. The process crashes with a segmentation fault.

If code calls PACKET_get_quic_length_prefixed(), the sub-packet message start is not set. PACKET_msg_start() then returns NULL or an unrelated pointer.

Requests logged with response_time None, the documented async pattern, count in the percentile denominator but not in the histogram. This lowers every p50 to p99.9 toward the minimum, while median and average stay correct.

If a frame ends with an empty last block, the stream decoder accepts it with fewer bytes than declared. The one-shot decoder rejects the same frame.

A caller that asks a skippable frame for its dictionary ID gets its magic variant. The API documents 0 for a frame that is not Zstandard.

RFC 8878 allows up to 2^32 - 1 bytes of user data, but a 32-bit sum makes one-shot decoding refuse the last 8 sizes. Streaming decoding skips the frame.

Get, update and delete calls at the W3C spec path /sensor/{type} return not found. The server registers virtual sensor routes under the plural /sensors path, so spec-conformant clients cannot reach them.

Implicit wait, element find and async script timeouts answer with 408 Request Timeout. Keep-alive clients and proxies may replay a 408 by themselves, so the timed-out command can run twice.

If a string spells an allowed enum value with a unicode escape, such as \u0041 for A, the parser fails with an unexpected token error. The same value typed as plain text parses fine.

A message whose last header is an empty Content-Length makes is_http read past the message end, before authentication. The bytes read change only a length that the callers then reject.

With padding on, a payload of 65501 to 65503 bytes passes the length check. The pad then writes one byte past the buffer.

A missing ! makes the builder return false after each successful USERNAME add. The message then fails its integrity check.

Byte-encoded Sun raster images with an odd scan-line byte count read the padding as the next row's first pixel. Every such file decodes to wrong pixels without an error.

The default name table has six entries, but the code handles more than six types. Zip truncates, so the INVALID HEADER type gets no name and rebuilds from parsed invalid headers fail with KeyError.

A directive queued before a CANCEL runs after the sequencer reports the cancel, so a command can reach its target. A stale stack directive can set an out-of-range stack size, and the window is narrow but deterministic once hit.

Numeric match compares values as doubles, so large Long or BigInteger values that differ by one look equal. Values such as snowflake ids or balances pass an EQUALS assertion and fail NOT_EQUALS.

On equal-length arrays with different duplicate counts, contains only deep passes where contains only fails. So a roles list with an extra admin entry can satisfy the assertion.

The not-contains-partial macro uses exact matching for list elements. So an array with an element that matches only in part still passes, while the positive form passes on the same data.

withName and withFileName write the same Content-Disposition key, so the second overwrites the first. A stub then accepts a part with the wrong form field name if the filename matches.

If a one-argument matchesXPath expression yields a boolean, such as count(//x) = 99 or 1 = 2, it always matches. Stubs then fire for documents that fail the condition.

A call to toSorted on a typed array view with a non-zero offset, such as subarray(3), sorts elements from the start of the underlying buffer. The result is wrong data on a common path, without an error.

An empty separator makes split count characters outside the BMP as one element instead of two UTF-16 code units. The split length then disagrees with the string's own length.

If level 0 gets Z_FINISH with more than 4 GiB of buffered and new input, a 32-bit sum wraps. The stream ends with most of the input unread.

With default settings JsonPath picks float for negative non-integers beyond Float.MAX_VALUE, so -1e40 returns -Infinity while +1e40 stays a correct double.

The Groovy-5 spread workaround only runs when the first array element has a properties key. So a GeoJSON feature list whose first feature lacks it returns null and drops every feature's data.

XmlPath with a hyphenated element name and a negative index, such as root.some-list[-1], throws a parameter list was not defined error. The hyphen is not escaped, and the error points at params() instead of that cause.

The version bits of generated random UUIDs hold 0, so every value fails a version-4 check. Values remain random, but code that validates UUID versions rejects them.

substring(pattern).find(n) with n of 1 or more never finds the match, while find(0) and findAll work. Checks that capture a later occurrence fail.

A negative index whose magnitude exceeds the length, such as x(-5) on three elements, throws IndexOutOfBoundsException for arrays, java.util.List and tuples. Scala Seq and List return a clean failure.

An inline match in a non-inline method has a quoted pattern with an unresolved import. Error recovery then calls tpd.singleton on an error type, so the compiler crashes with MatchError instead of reporting the unresolved import.

Malformed context bounds with intersection types and a quoted expression trigger an AssertionError in TypeOps.dominators. The compiler then aborts in the typer phase, without a clean error report.

A comment that hides the then keyword of an if inside a for generator within new arguments fails a position check. The compiler then aborts during parser error recovery.

The code declares enum E twice, once with a simple case K0 and once with a parametric case K0. This causes an AssertionError in typer instead of a duplicate definition error.

A recursive macro that splices itself compiles at depth 220 but raises StackOverflowError at depth 230 during the inlining phase, so valid code fails to compile.

A method with an erased `using` parameter followed by a normal context parameter gets wrong local slot numbers, so the JVM throws VerifyError at runtime. The reversed order works.

A generic trait method has an erased `using` clause before a type-parameter argument. An override of it triggers an AssertionError in erasure, so valid code fails to compile.

An export of members of an opaque type companion with a self-referential alias triggers an AssertionError in Namer after the cyclic type error. The compiler does not make a clean exit.

If the input ends inside a submessage, pb_decode() returns true and drops the rest. A buffer stream reports an error for the same input.

If a message has an extension type with its own decode function, the decoder dereferences NULL. The crash happens before the custom function runs.

When the enable of a bufif, notif, nmos or pmos gate is a plain identifier, Verilator rejects an undeclared data input. IEEE 1800 requires an implicit net there, as for and gates.

If a valid class sits inside a generate block, iverilog fails an internal assertion and aborts. The same class at module scope compiles fine.

If the same generate block declares and uses an enum, the compiler cannot resolve its value and segfaults. Declare the enum at module scope to avoid the crash.

If a buf, not or tran gate has outputs of different widths, an internal assertion fails and iverilog aborts without a normal width error.

If a wire drives itself through bufif1, or a real variable assigns itself, vvp recurses. vvp recurses until it segfaults at time 0, even though the value never changes.

If a namespace is declared in a where or let block, its qualified names do not resolve. The compiler reports an undefined name error, but the unqualified name works.

integralIsValidLong returns true for '-', '+' and 'a', and throws StringIndexOutOfBoundsException on an empty string. Its documented precondition is not checked.

If indent is empty and the brace padding is custom, the padding after the closing brace appears before it and the reverse. The indented output path produces the correct order, so only the no-indent path is incorrect.

If the indent is not empty and newline padding follows closing braces or brackets, the printer indents the next text one level too deep. The error affects only the whitespace of custom-printed JSON.

If a complete over-long line and its terminator arrive in one chunk, linesLimited skips the length check and passes the line. The same input split into single elements raises LineTooLongException, so the guard depends on chunking.

It reports an array as sorted when the first element is its minimum or maximum. numaInterpolateArbxInterval then skips its sort and gives wrong values.

numaAddSpecifiedBorder returns NULL for such a window, and the result is not checked. The process crashes; pixThresholdByHisto reaches it.

An empty or separator-only string gives a NULL first token. The process crashes; kernelCreateFromFile reaches it with a blank data line.

A 32 bpp pixel of 2^31 or more becomes a negative maximum. The log scale then reads before the 256-entry table, up to a crash.

pixScaleGray2xLIDither and pixScaleGray4xLIDither copy a second source row that does not exist. The overread grows with the image width.

It reads startx and binsize from the new array, not from the input. numaHistogramGetValFromRank then gives wrong values for the new histogram.

Wrong edge weights drop boundary samples, also for the identity case. For example, {1,2,3} becomes {0,0,-3}.

The string prism parses '-0' to 0 and reverseGet returns '0', so the round-trip law fails for '-0', '-00' and '-01'.

If several code paths call ByteBuffer.array, it throws for direct and read only buffers. For consumed buffers, it returns the whole array behind the buffer, so request or response bodies come out wrong.

If a request has a multipart body, the curl output omits filename, content type and per-part headers. For other body types, it prints a placeholder, so the debug command sends a different request.

If the server sends qop as auth,auth-int, the client compares the whole string against auth and auth-int. It then throws IllegalArgumentException with Unknown qop, so the request fails.

When a program logs the description of an enumeration validator, it prints an unbalanced string such as Some(in(A,B,C. Only the printed text is wrong, not the validation itself.

If two product fields are equal, they get different hash codes, so maps, sets and distinct() can miss or duplicate them. Only code that puts these schema types into hash-based collections has the problem.

If the default CORS interceptor runs, browser preflight for PATCH fails with no Access-Control-Allow-Methods header, so the request never reaches the route. Add PATCH to the allowed methods as a workaround.

Two response objects whose 32-bit hash codes collide compare equal even when their fields differ. Deduplication and deep merges can then drop or mix data.

If withExtension runs twice with the same key, the extensions hold two entries, which the spec does not allow. Serializers then disagree on which value wins.

The toString of StringValue escapes only quotes and newlines, and EnumValue only quotes. A backslash stays unescaped, so a JSON parser reads it as another value.

The page flags depend only on first or last, not on the after or before cursor. Clients that page forward from the middle see hasPreviousPage false and can miss earlier items.

The validator finds one subscription operation and checks only that one. A later subscription with several root fields passes validation.

The memo caches use hash codes as keys with no equality check. A collision can make invalid queries pass or valid queries fail.

When one argument of a directive changes, the check reports every other common argument as changed, because it runs per argument against the directive. Schema diffs get noisy.

parseRemoteSchema hardcodes subscriptionType to None, so any subscription in a remote schema definition is lost. Stitched schemas lose their subscriptions.

RemoteResolver.unwrap returns only the first root field of a remote response. The other fields are lost in stitch pipelines without an error.

SchemaTracer.wrapper calls head on request.field.fields without an emptiness check. An empty list throws NoSuchElementException instead of producing a response. The fix uses headOption.

On a SchemaError, ReportingDaemon logs the error and ends its loop, so later schema reports never run. The retry hint in the error is not used.

If atOrElse modifies a List at a missing index, it throws, and the default is not used. It computes the default value but writes it back with updated, which needs an existing index.

The Append branch sets the node count to one even when the DOM insert returns false. So each failed append shifts later insert indices, and the rendered children stop matching the model.

insertChildBefore and insertChildAfter set the parent after the raw DOM insert, whatever its result. So a failed insert leaves the child recorded under a parent it is not in.

The key argument is never used, so contains only checks whether the map has any entries. Lookups for keys that are not in the map return true.

initWith ignores its function argument and returns the new map, so the user's code never runs. Its signature also drops the result type parameter.

The linear schedule adds the base to itself at each step, so delays double: 1, 2, 4, 8 seconds. Retry waits grow much faster than the name promises.

If subtypesFromMirrorStep builds a Subtype, it passes the sealed trait's paramTypeAnns instead of the subtype's own annotations. A derived typeclass then sees the wrong annotations on a case class.

If point uses Future(value), each lift submits a task to the ExecutionContext. Unlike Future.successful, the Future does not complete at once, and a shut down or saturated pool delays or breaks it.

A 32-bit length of 2^31 or more wraps negative, so the array or map reads as empty and the reader ignores the payload that follows. Malformed input passes without any error.

The reader accepts escapes such as u00gZ, uXXXX or u0G00, does not reject them, and decodes them to arbitrary code points. Malformed JSON then produces wrong text without an error.

If pack receives a negative BigInt below Long.MinValue, the codec checks only the upper bound, so a different number gets stored without an error. The codec handles positive out-of-range values as intended.

The last m-block of each group does not truncate, so rows past the group's valid rows get computed. The error affects group sizes that are not multiples of BLOCK_M.

The documented C += A @ B does not happen, because the kernel adds the product to whatever D holds. A C that is not the same tensor as D gives a wrong result with no error.

The Not[C1] implies Not[C2] rule encodes the inverse instead of the contrapositive, so a value that is at most 5 passes as at most 3. The compiler accepts an invalid refinement, and the value breaks the bound at runtime.

Implications such as ForAll ==> Exists and Init ==> Head compile, but empty or one-element lists break the target constraint, so invalid values type-check.

Greater, Less and Multiple on Long values compare through Double, so the checks reject or accept values above 2^53 in error. For example, 2^53 + 1 fails Greater of 2^53.

If the step is negative, the loop continues while t is at most the end value. range(5, 1, -1) stops after 5, but range(1, 5, -1) does not stop until Int overflow.

If shouldPayFailureCost returns false for a retriable error, afterAttempt stops the retry sequence. The Right case continues for free, so the documented free retry never happens.

munitAppendToFailureMessage calls endsWith on a null exception message. So a test that throws an exception without a message reports munit's NPE, not the original failure.

If a reply has two JSON code blocks, the reader can return the later one without an error. A single JSON block with braces in the prose raises OutputSchemaError.

If a flow adds a hard output token limit to a turn, the cost limit becomes hard too. The turn stops with CostExceeded, although the cost limit is graceful.

If a model price is NaN, the cost total becomes NaN for the epic. Later turns then exceed the hard cost limit without an error.

The high-nibble weights of each Q4_K block use the scale and min of the earlier sub-block. The code dequantizes half of every Q4_K tensor with wrong values and gives no error.

Types q4_2 and q4_3 have zero items per block, so gguf_get_tensor divides by zero. The issue says this raises SIGFPE on x86 and gives a zero tensor size on arm64.

A compiled file with a match or let rec fails to load after a file number change, with anomaly Meta.Map.find_opt. The same files check fine from source.

Imports with a parent-directory path are not reduced, so one file loads twice under two names. Constants from the two copies differ, so a valid file gets rejected with an unequal-constants error.

Field projection from a transport in a three-dimensional degeneracy of a record type raises bug E0500 on valid HoTT code. The program is correct, but Narya cannot check it.

Without a type annotation, the .nyo file stores the synthesized type in normal form, which can grow as 3 to the power of the depth. One definition produced a 280 MB compiled file and slow imports.

When the forward check of a calc step fails, calc still builds the complete error text for it before it tests the reverse. Large types take 7.3 seconds and 1.7 GB instead of about 2.6 seconds.

A reader can load a .nyo file while another process still writes it, and an interrupted write leaves a broken file. With the `-source-only` option, the tool still writes compiled files, which can break other runs.

calc's error handler accepts any diagnostic, even internal bugs, from the forward check. If the reverse check passes, the internal error is never shown to the user.

A .nyo file keeps the file identifiers of the run that compiled it. In a later run, a definition can point to a constant of another file, or the load stops with an anomaly.

Each level of diamonds in the import graph multiplies the load time of .nyo files. Sixteen levels take 212 s and 2.5 GiB of memory, for 49 small files.

The retry counter advances by two, but the stop check expects one. So an even maxRepetitions never stops, and an odd one stops at about half the requested count.

The formula max - min + 2 overflows for wide ranges, and the offset can give values below min. The retry guard catches these, so the cost is extra retries rather than wrong values.

A drop call with a count greater than the take count produces SQL with a negative LIMIT. PostgreSQL and MySQL reject that SQL, and SQLite reads it as no limit. Collections return an empty result.

An onConflictUpdate call with no assignments emits DO UPDATE SET with nothing after it, which is a syntax error. The API accepts the empty call without a compile error.

The base dialect calls setNull with the NULL type code instead of the column's real type. MS SQL routes around this, but other drivers such as Oracle may reject the statement.

camelToSnake merges consecutive capitals into one word, so the default mapping of XMLParser or HTTPSConnection misses snake_case columns such as xml_parser. The query then fails with column not found.

WithCte.filter swaps its arguments, so the WHERE clause lands in the CTE definition. Plain filters return the same rows, but filters applied after limits or aggregates on the CTE can change the result.

The LIKE pattern concatenates the value and does not escape it. A search for 50% matches any string that starts with 50, and a_b matches axb, so untrusted input widens the match.

Table and column names that hold the dialect's delimiter break out of the quoted identifier. If such names come from untrusted data, they can alter the generated SQL.

The truncation counts the carriage-return and newline pair as two breaks, because it resets the flags before the pair check runs. Line counts in truncated output for Windows-style text are off by one per break.

If longCompare compares a stored Long.MaxValue against Long.MinValue, the subtraction overflows and reports the reverse order.

If start is not less than end, the exception text repeats the end value instead of start, so the message shows wrong numbers. Only the message text is wrong, and only for invalid calls.

Multiple attribute values compare by reference in equals but by content in hashCode. Two equal values built in separate calls count as two members in a Set, so deduplication fails.

Inside an async block, forall on a Left value returns false, while scala.util.Either returns true. Code that depends on the vacuous result gets the opposite answer without an error.

When recover or recoverWith gets an exception the partial function does not handle, the async version throws MatchError and drops the original failure. The original error is lost.

The async version of `Using` releases the resource only on success. When the body fails, the resource is never closed, so each failure leaks a handle.

The IndexedSeq override accepts a from index but always starts the search at 0. A call like indexWhere(p, 3) can return an index before the requested start point.

When the predicate matches all elements in an async block, dropWhile returns a one-element array instead of an empty one. The slice bound is off by one.

The async breakable wrapper passes the monadic body to Breaks.breakable as a discarded value, so the body never runs. Effects inside the block do not happen and the call reports success.

Unlike the standard library, the async lastIndexWhere does not clamp end to the array size. If the caller sets an end larger than the array length, the call throws and does not search.

When two keys map to the same new key, map keeps both entries, so size reports 2. toListMap keeps only the last value without an error, so the first entry is lost.

doubleQuoteIfNecessary wraps non-plain identifiers in double quotes without escaping embedded quotes. A name with a quote yields malformed SQL.

TripleQuoteString.sqlExpr splits the literal on newlines and rejoins the parts with || without a newline. A multi-line string then becomes one run of text in the query output, with no error.

DuckDBSchemaAnalyzer creates a statement for schema analysis and never closes it, but it closes only the result set. In pooled setups, statements build up with each analysis until the connection closes.

The output-name filter compares a string with inner iterables, so it is always false. Model output reads return only None values for every model.

The tensor decoder handles only six ONNX data types and has no default case. A model whose initializers use another type fails to load with a scala.MatchError.

If E is RuntimeException, the catch compares exception classes with ==, so an ArithmeticException escapes as a raw exception. The catch works when the exception class is E itself.

A diagram of a three-step interruption sequence omits the final step, because an off-by-one threshold keeps only the second step. The step still runs at execution time.

If a loop has only its unstarted body in its history, RenderUtils.hasStarted returns true. Diagrams then show the loop that has not run with the executed style, and other renderers inherit the wrong answer.

The addS family tests only positive overflow, so Long.MinValue plus -1 wraps to Long.MaxValue with no OverflowError, while unsigned add functions are correct.

The Short ** Double operator casts its Double result to Short, so (200: Short) ** 2.0 returns -25536 instead of 40000 and fractional results lose their fraction.

A negative Byte or Short converts to hex, octal or binary through an Int. So 0xFF as a Byte prints ffffffff instead of ff, and binary output has 32 digits.

The %% operator on Float and Double only corrects negative remainders for positive divisors, so 7.0 %% -3.0 returns 1.0 instead of -2.0, while the integer versions are correct.

A Rankine quantity converts with 9/5 instead of 5/9 when added or subtracted. So 9 R added to 273.15 K gives 289.35 K instead of 278.15 K.

The edit distance loop never runs for an empty left string. So the distance between an empty string and abc is 0 instead of 3, and the normalized distance reports a perfect match.

Compass.points8 ends with Southwest instead of Northwest, so lookups in the northwest quadrant around 315 degrees return Southwest.

Dsv quotes only cells that hold a quote character. A cell with a comma or newline goes out raw, so the output splits into extra columns or rows when read back.

crop(top = 10) keeps the wrong rows because the pixel mapping offsets Y by bottom instead of top. The crop comes out flipped, and no error appears.

The id formula on the Signal enum returns -1 for Hup. For other signals, it is two below the POSIX number, so an OS call that uses it targets the wrong signal or fails.

Context keeps per-session values in a plain HashMap that concurrent HTTP threads access, so parallel requests can lose updates, throw ConcurrentModificationException or corrupt the map.

The Long Digestible uses shifts 52 down to 4 instead of 56 down to 0, so it hashes only seven misaligned bytes, and the Double instance inherits the loss.

subsequent builds an interval one longer than size, so the Foreground and Background ANSI style bit fields in escapade overlap by one bit each.

SpecifacationVendor and SpecifacationVersion contain a typo, while SpecificationTitle is correct, so Scala code cannot refer to them by the expected names. The JAR manifest keys themselves are correct.

Dag does not check for cycles when it adds edges. Sort calls get on the search result, so a cyclic graph fails with an unexplained NoSuchElementException, not a cycle error.

The comparator returns true for 1.0.0 against 1.0.0 and ranks 1.0.0 below 1.0.0-alpha, which breaks sorting and comparisons under the SemVer 2.0 precedence rules.

Writes and reads of the subtype index use a signed byte, so index 128 and up becomes negative. Deserialization then throws ArrayIndexOutOfBoundsException.

A partial def that matches a Qq pattern and recurses fails at kernel check with 'declaration has metavariables', on code the reporter expects to compile. The report gives no minimal reproducer.

If validation fails or times out for a pooled connection, no debug message appears. The log effect gets created and then discarded, so pool problems leave no trace in the logs.

If a clause uses lowercase values, MySQL rejects the combined statement with a syntax error, because the builder splits on uppercase VALUES only. Uppercase VALUES works.

Statement.execute treats only SELECT as a query. If SHOW, DESCRIBE, EXPLAIN or a similar statement returns rows, it throws MatchError and gives no results.

If a schema contains mediumblob, the parser builds a TINYBLOB type. Generated DDL and Scala mappings then allow only 255 bytes for columns meant to hold up to 16 MB.

isFirst checks that the cursor position is greater than zero. If the cursor is on row two or later, it returns true, so code that branches on isFirst misbehaves.

The text-protocol escape handles only quotes and backslashes, in the wrong order, so NUL, CR, LF and Ctrl-Z stay raw. If an attacker controls a string on that path, it can break out of the literal.

The schema parser has no DOUBLE type, so DOUBLE and REAL columns become FLOAT. Generated Scala code then uses 32-bit Float for 64-bit values, and the precision loss gives no error.

If a builder chains withTLSParameters with withFallback in either order, it resets the setting applied first without an error. The connection then uses default TLS parameters or the wrong fallback policy.

isOkayForVersion reverses the version comparison, so on MySQL 8 it drops gb18030, eucjpms and cp932 and offers them to servers that lack them. Only apps that rely on these charsets see the fault.

The VARCHAR check uses the CHAR limit, so VARCHAR(500) fails to compile, although MySQL allows up to 65,535 bytes.

If several concurrent calls enter the half-open state after the reset timeout, they can all run the test action. A success can then close the breaker, even though a concurrent test has failed.

If resetConnection turns autocommit on before it rolls back, MySQL commits the pending transaction at that point. Half-written data from an unhandled error gets persisted instead of discarded.

The charset table gives cp850 a maximum length of 2 bytes per character, but cp850 is single-byte. Buffer size and the single-byte fallback branch then take the wrong path.

equals compares reduced fractions but hashCode uses the raw fields, so 2/4 equals 1/2 yet they have different hashes, and HashSet or HashMap lookups miss equivalent intervals.

G1Element, G2Element and MLResult override equals by curve point but keep the identity hashCode. Equal points get different hashes, so HashSet and HashMap lookups miss them.

Two Bytes objects built from the same array compare equal but have different hash codes. Map keys or set members give lookup misses for values that are equal.

Unlike min and max, maxBy and minBy return null for reference types and zero for numeric types on an empty generator. The caller gets a placeholder with no error.

When at least one rule has an annotation, rules without one produce rows with fewer cells than the header. Downstream tools may corrupt the malformed Markdown table, but the HTML renderer is fine.

The Distinct hit policy deduplicates outputs with a Set, and Double equality treats positive and negative zero as equal. A table with +0.0 and -0.0 outputs returns a result instead of reporting a conflict.

A constant decision table with zero input columns makes DiagnosticsPrinter throw on max of an empty collection during construction. The crash happens before the printer outputs any diagnostic.

The JSON helper wraps strings in quotes without escaping them. A name or description with a double quote or backslash, or an input with a newline, makes the lineage JSON unparseable.

chain and combine have identical bodies, but their doc comments describe sequential and parallel use. The maintainer says the shared accumulating design is intended, and the docs confuse users.

On a satisfiable formula, the checker accepts the one-line proof 2 0 0 and prints VERIFIED with exit code 0, a regression from an earlier commit. A second proof also segfaults the checker.

If InlineRepr.printChar maps the ESC character to an empty string, strings with colour codes snapshot as bracketed plain text. Two strings that differ only by ESC compare equal.

If a record has more than four fields, the circe encoder builds a hash Map, so JSON fields come out in hash order, not declaration order. The order can also differ between Scala versions.

If a known divisor is zero at staging time, int_div and long_div fold the division at once and the macro crashes with ArithmeticException. int_mod already has a guard for a related case.

If collect runs on a stream, it builds the list with each new element at the front. The elements come back in reverse, so every result has the wrong order, and one reverse call fixes it.

The index variable sits outside the stream body. If a second run consumes the same stream, the index continues from the first run instead of at zero.

If code compares this object with another type or with null, equals throws and does not return false, because it casts without checking canEqual. Sibling classes do the canEqual check.

The config conversion does not copy automaticTopologyRecovery to the client config. The client still recovers topology when the user disables the setting.

The server-side recorder builds the metric effect inside Option.foreach, so the effect never runs. The response body size histogram stays empty.

The encoder writes OptIn in mixed case, while every other value is lowercase and the decoder lowercases input. The decode error for an unknown value also names an SSL mode.

The client metrics middleware declares request and response body size histograms but never records them. Dashboards show empty panels, and nothing warns at startup.

The SSL encoder covers three cases, so a custom SSL context fails with scala.MatchError, for example in a config dump. The decoder also cannot read it back.

toHikariConfig ignores systemSchema, appSchema and debug, so queries use the default schema and debug logging stays off. Users who set these values get different behaviour without any warning.

The deploy step runs lake update, which fails on local refs. The public site then shows data from October 14.

When creating a cross-tier pool, LpMigrator looks up the source price using the destination tick spacing. Manipulating that unrelated pool can make the migration lose principal; the report demonstrates a 1.817% loss.

CLGauge reads the current referral configuration when rewards are claimed and applies it to the entire unclaimed amount. Creating a referral therefore takes a share of rewards that accrued before it existed.