We find bugs in your software’s software.

We use formal methods to find bugs in the libraries, compilers, and protocols that the world's software depends on.

Click a card in the background to explore our findings.

bugs found
312
bugs reported
201
bugs fixed
122
projects
102

View bugs

Why

Our clients’ software depends on open source. Strong guarantees for their code require strong guarantees about its dependencies.

Software breaks in unexpected ways. This causes costly failures and is often exploited by attackers wielding advanced AI tools. Formal methods offer a powerful defense: we can mathematically guarantee the absence of entire classes of bugs.

We find subtle failures in mature, widely used, complex codebases. These projects have gone through years of testing and real-world use, and still bugs persist.

Our goal is a growing base of formally verified open-source libraries. Each verified library helps us verify the software built on top of it.

We respect maintainers’ time. Each bug report we send gets reviewed by a member of our team.

Projects where we found bugs

  • Linux kernel (WireGuard): 3 found, 2 reported, 0 fixed, 1 not yet reported
  • Playwright: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • Redis: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • Cypress: 3 found, 3 reported, 0 fixed, 0 not yet reported
  • Bruno: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • curl: 11 found, 0 reported, 0 fixed, 11 not yet reported
  • stb_image: 10 found, 0 reported, 0 fixed, 10 not yet reported
  • Selenium: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • k6: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • nginx: 3 found, 0 reported, 0 fixed, 3 not yet reported
  • OpenSSL: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • Locust: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • zstd: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • libuv: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • Appium: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • Ajv: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • Pillow: 5 found, 0 reported, 0 fixed, 5 not yet reported
  • LZ4: 3 found, 3 reported, 0 fixed, 0 not yet reported
  • Robot Framework: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • F Prime: 4 found, 1 reported, 1 fixed, 3 not yet reported
  • Karate: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • WireMock: 2 found, 2 reported, 1 fixed, 0 not yet reported
  • zlib: 4 found, 3 reported, 0 fixed, 1 not yet reported
  • goja: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • REST Assured: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • Mbed TLS: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • Gatling: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • Scala 3: 8 found, 8 reported, 6 fixed, 0 not yet reported
  • Nanopb: 5 found, 5 reported, 0 fixed, 0 not yet reported
  • nghttp2: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • libjpeg-turbo: 3 found, 0 reported, 0 fixed, 3 not yet reported
  • 7-Zip: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • Verilator: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • Icarus Verilog: 4 found, 4 reported, 3 fixed, 0 not yet reported
  • protobuf-c: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • Circe: 3 found, 3 reported, 0 fixed, 0 not yet reported
  • fs2: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • FLAC: 5 found, 0 reported, 0 fixed, 5 not yet reported
  • libavif: 3 found, 0 reported, 0 fixed, 3 not yet reported
  • c-ares: 5 found, 0 reported, 0 fixed, 5 not yet reported
  • picohttpparser: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • LoRaMac-node: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • Monocle: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • liblzma (xz): 1 found, 1 reported, 0 fixed, 0 not yet reported
  • skunk: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • tiny-regex-c: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • sttp: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • Tapir: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • libsrtp: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • Caliban: 11 found, 11 reported, 11 fixed, 0 not yet reported
  • libfixmath: 8 found, 0 reported, 0 fixed, 8 not yet reported
  • quicklens: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • Laminar: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • Kyo: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • Magnolia: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • uPickle: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • Airframe: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • TinyCBOR: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • DeepGEMM-Ascend: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • Iron: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • Ox: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • tinycrypt: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • umm_malloc: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • MUnit: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • SymmetryBook: 7 found, 7 reported, 0 fixed, 0 not yet reported
  • CMP: 3 found, 0 reported, 0 fixed, 3 not yet reported
  • gguf-tools: 3 found, 2 reported, 0 fixed, 1 not yet reported
  • uzlib: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • libfdt: 5 found, 0 reported, 0 fixed, 5 not yet reported
  • Narya: 8 found, 8 reported, 7 fixed, 0 not yet reported
  • Gears: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • Hedgehog: 2 found, 2 reported, 1 fixed, 0 not yet reported
  • ScalaSQL: 7 found, 7 reported, 0 fixed, 0 not yet reported
  • PPrint: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • borer: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • fansi: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • dotty-cps-async: 7 found, 7 reported, 7 fixed, 0 not yet reported
  • Hearth: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • wvlet: 3 found, 3 reported, 3 fixed, 0 not yet reported
  • CWPack: 3 found, 0 reported, 0 fixed, 3 not yet reported
  • onnx-scala: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • yaes: 1 found, 1 reported, 1 fixed, 0 not yet reported
  • workflows4s: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • Soundness: 16 found, 16 reported, 16 fixed, 0 not yet reported
  • flink-scala-api: 3 found, 3 reported, 0 fixed, 0 not yet reported
  • quote4: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • ldbc: 13 found, 13 reported, 13 fixed, 0 not yet reported
  • Scalus: 2 found, 2 reported, 2 fixed, 0 not yet reported
  • geny: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • decisions4s: 3 found, 3 reported, 1 fixed, 0 not yet reported
  • etl4s: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • DRAT-trim: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • record4s: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • snapshot4s: 1 found, 1 reported, 0 fixed, 0 not yet reported
  • strymonas: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • Unwrapped: 2 found, 2 reported, 0 fixed, 0 not yet reported
  • Pillars: 7 found, 7 reported, 0 fixed, 0 not yet reported
  • Aerodrome MetaDEX03: 8 found, 0 reported, 0 fixed, 8 not yet reported
  • Fluid DEX v2: 5 found, 0 reported, 0 fixed, 5 not yet reported
  • dnsmasq: 2 found, 0 reported, 0 fixed, 2 not yet reported
  • BoringSSL: 1 found, 0 reported, 0 fixed, 1 not yet reported
  • musl libc: 2 found, 0 reported, 0 fixed, 2 not yet reported

Reported bugs

Only bugs with public reports appear in this table.

Not yet reported
We found the bug. We'll report it to the maintainers only after human review.
Reported
We reported the bug to the maintainers. They haven't confirmed it yet.
Confirmed
A maintainer agrees it's a bug.
Fixed
The bug has been fixed.

Data of 2026-10-21. Complete readable record · Plain text · JSON

Filter
Sort
SeverityBugProjectStatusReported
mediumgetByRole name filter misses meter and progress elements labelled by a label tagPlaywright · Wrong-result bug↓ 446M / mo★ 98,190 stars

The accessible name of meter and progress ignores an associated label, so getByRole with a name returns zero matches while getByLabel finds the same element.

Full details and maintainer reply
PlaywrightFixed2026-07-21
lowSearch input with a broken list attribute gets combobox role, not searchboxPlaywright · Wrong-result bug↓ 446M / mo★ 98,190 stars

A search input whose list attribute points to no datalist gets the combobox role, unlike Chrome's searchbox role. So getByRole searchbox finds nothing, while the combobox role matches the input by mistake.

Full details and maintainer reply
PlaywrightFixed2026-07-21
highcy.contains with a g or y regex flag misses matching elementsCypress · Wrong-result bug↓ 25M / mo★ 51,020 stars

A regex with the global or sticky flag keeps lastIndex between candidate elements, so the command tests only about half of the matching elements. The command can pick the wrong element or time out while matches exist.

Full details and maintainer reply
CypressReported2026-07-21
lowselectFile on a label fails when its for id contains dots, spaces or colonsCypress · API-contract bug↓ 25M / mo★ 51,020 stars

The label's for value enters a CSS selector unescaped, so ids with dots or spaces resolve to nothing and selectFile reports an unhelpful error. An id with a colon throws a raw selector syntax error.

Full details and maintainer reply
CypressReported2026-07-21
lowcy.contains cannot find submit buttons by a partial word of their valueCypress · API-contract bug↓ 25M / mo★ 51,020 stars

Submit inputs match only whole words in their value, while other elements match any substring. cy.contains('User') misses an input whose value is Username, so the command times out.

Full details and maintainer reply
CypressReported2026-07-21
mediumNTLM auth block without a domain line makes a valid file fail to parseBruno · Crash↓ 1.1M / mo★ 47,783 stars

If an auth:ntlm block has a username and password but no domain line, the parser throws a TypeError on parse. The domain lookup checks the password key but reads the domain key.

Full details and maintainer reply
BrunoFixed2026-07-21
mediumCSS escape of a non-ASCII first digit picks the wrong ASCII code pointSelenium · Wrong-result bug↓ 36M / mo★ 34,564 stars

By.className and By.id escape a Unicode digit at the start such as an Arabic-Indic five as the ASCII five. The selector for that class matches the same element as the ASCII class name.

Full details and maintainer reply
SeleniumFixed2026-07-21
mediumBy.name with % throws a format exception or builds a wrong selectorSelenium · API-contract bug↓ 36M / mo★ 34,564 stars

By.name runs String.format twice, so a name such as 100% throws UnknownFormatConversionException, and a name like a%db throws IllegalFormatConversionException at construction time.

Full details and maintainer reply
SeleniumFixed2026-07-21
mediumGauge max reports 0 when every sample is negativek6 · Wrong-result bug★ 31,993 stars

A gauge max starts at 0 and is never guarded for the first sample, so an all-negative series reports max 0 in summaries and JSON exports.

Full details and maintainer reply
k6Fixed2026-07-21
mediumAsync requests logged as None lower all reported response-time percentilesLocust · Wrong-result bug↓ 9.4M / mo★ 28,227 stars

Requests logged with response_time None, the documented async pattern, count in the percentile denominator but not in the histogram. This lowers every p50 to p99.9 toward the minimum, while median and average stay correct.

Full details and maintainer reply
LocustFixed2026-07-21
mediumVirtual sensor routes use /sensors, not the spec's /sensor pathAppium · API-contract bug↓ 5.4M / mo★ 22,117 stars

Get, update and delete calls at the W3C spec path /sensor/{type} return not found. The server registers virtual sensor routes under the plural /sensors path, so spec-conformant clients cannot reach them.

Full details and maintainer reply
AppiumFixed2026-07-21
mediumTimeout errors return HTTP 408 instead of the spec's 500, so clients may retryAppium · API-contract bug↓ 5.4M / mo★ 22,117 stars

Implicit wait, element find and async script timeouts answer with 408 Request Timeout. Keep-alive clients and proxies may replay a 408 by themselves, so the timed-out command can run twice.

Full details and maintainer reply
AppiumFixed2026-07-21
lowJTD parser rejects valid JSON unicode escapes inside enum string valuesAjv · API-contract bug↓ 1.6B / mo★ 14,863 stars

If a string spells an allowed enum value with a unicode escape, such as \u0041 for A, the parser fails with an unexpected token error. The same value typed as plain text parses fine.

Full details and maintainer reply
AjvReported2026-07-21
lowSectionHeader.from_params raises KeyError for the invalid header typeRobot Framework · Crash↓ 3.9M / mo★ 11,955 stars

The default name table has six entries, but the code handles more than six types. Zip truncates, so the INVALID HEADER type gets no name and rebuilds from parsed invalid headers fail with KeyError.

Full details and maintainer reply
Robot FrameworkFixed2026-07-21
mediumCancelled FPY sequence still runs its queued directiveF Prime · Concurrency bug★ 11,832 stars

A directive queued before a CANCEL runs after the sequencer reports the cancel, so a command can reach its target. A stale stack directive can set an out-of-range stack size, and the window is narrow but deterministic once hit.

Full details and maintainer reply
F PrimeFixed2026-10-01
mediumEquality match treats distinct integers above 2^53 as equalKarate · Soundness bug★ 8,992 stars

Numeric match compares values as doubles, so large Long or BigInteger values that differ by one look equal. Values such as snowflake ids or balances pass an EQUALS assertion and fail NOT_EQUALS.

Full details and maintainer reply
KarateFixed2026-07-21
mediumcontains only deep ignores duplicate counts, so unequal multisets passKarate · Soundness bug★ 8,992 stars

On equal-length arrays with different duplicate counts, contains only deep passes where contains only fails. So a roles list with an extra admin entry can satisfy the assertion.

Full details and maintainer reply
KarateFixed2026-07-21
mediumNegated partial schema macro passes on a list whose element contains the schemaKarate · Soundness bug★ 8,992 stars

The not-contains-partial macro uses exact matching for list elements. So an array with an element that matches only in part still passes, while the positive form passes on the same data.

Full details and maintainer reply
KarateFixed2026-07-21
mediumMultipart matcher with name and filename ignores the name constraintWireMock · Wrong-result bug★ 7,404 stars

withName and withFileName write the same Content-Disposition key, so the second overwrites the first. A stub then accepts a part with the wrong form field name if the filename matches.

Full details and maintainer reply
WireMockFixed2026-07-21
mediumXPath boolean expressions always match, so stubs fire on false conditionsWireMock · Wrong-result bug★ 7,404 stars

If a one-argument matchesXPath expression yields a boolean, such as count(//x) = 99 or 1 = 2, it always matches. Stubs then fire for documents that fail the condition.

Full details and maintainer reply
WireMockReported2026-07-21
highTypedArray toSorted on a subarray sorts from the start of the buffergoja · Wrong-result bug★ 7,152 stars

A call to toSorted on a typed array view with a non-zero offset, such as subarray(3), sorts elements from the start of the underlying buffer. The result is wrong data on a common path, without an error.

Full details and maintainer reply
gojaFixed2026-07-21
mediumString split with an empty separator splits emoji into one piece instead of twogoja · Wrong-result bug★ 7,152 stars

An empty separator makes split count characters outside the BMP as one element instead of two UTF-16 code units. The split length then disagrees with the string's own length.

Full details and maintainer reply
gojaFixed2026-07-21
mediumLarge negative decimal JSON numbers become -Infinity when read as floatREST Assured · Wrong-result bug★ 7,145 stars

With default settings JsonPath picks float for negative non-integers beyond Float.MAX_VALUE, so -1e40 returns -Infinity while +1e40 stays a correct double.

Full details and maintainer reply
REST AssuredFixed2026-07-21
higharray.properties returns null for all elements when the first lacks propertiesREST Assured · Wrong-result bug★ 7,145 stars

The Groovy-5 spread workaround only runs when the first array element has a properties key. So a GeoJSON feature list whose first feature lacks it returns null and drops every feature's data.

Full details and maintainer reply
REST AssuredFixed2026-07-21
lowXmlPath negative index on a hyphenated element name fails with an unclear errorREST Assured · API-contract bug★ 7,145 stars

XmlPath with a hyphenated element name and a negative index, such as root.some-list[-1], throws a parameter list was not defined error. The hyphen is not escaped, and the error points at params() instead of that cause.

Full details and maintainer reply
REST AssuredFixed2026-07-21
lowrandomUuid produces UUIDs marked as version 0 instead of version 4Gatling · Wrong-result bug★ 6,955 stars

The version bits of generated random UUIDs hold 0, so every value fails a version-4 check. Values remain random, but code that validates UUID versions rejects them.

Full details and maintainer reply
GatlingFixed2026-07-21
mediumsubstring(pattern).find(n) never finds a match when n is 1 or moreGatling · Wrong-result bug★ 6,955 stars

substring(pattern).find(n) with n of 1 or more never finds the match, while find(0) and findAll work. Checks that capture a later occurrence fail.

Full details and maintainer reply
GatlingFixed2026-07-21
lowOut-of-range negative EL index throws an uncaught exception for arrays and java.util.ListGatling · Crash★ 6,955 stars

A negative index whose magnitude exceeds the length, such as x(-5) on three elements, throws IndexOutOfBoundsException for arrays, java.util.List and tuples. Scala Seq and List return a clean failure.

Full details and maintainer reply
GatlingFixed2026-07-21
lowCompiler crashes with MatchError on an erroneous quoted pattern with an importScala 3 · Crash★ 6,324 stars

An inline match in a non-inline method has a quoted pattern with an unresolved import. Error recovery then calls tpd.singleton on an error type, so the compiler crashes with MatchError instead of reporting the unresolved import.

Full details and maintainer reply
Scala 3Confirmed2026-02-11
lowCompiler aborts with AssertionError on a malformed context bound with a quoteScala 3 · Crash★ 6,324 stars

Malformed context bounds with intersection types and a quoted expression trigger an AssertionError in TypeOps.dominators. The compiler then aborts in the typer phase, without a clean error report.

Full details and maintainer reply
Scala 3Reported2026-02-11
lowParser crashes when a line comment hides then in a for generator inside newScala 3 · Crash★ 6,324 stars

A comment that hides the then keyword of an if inside a for generator within new arguments fails a position check. The compiler then aborts during parser error recovery.

Full details and maintainer reply
Scala 3Fixed2026-02-11
lowCompiler asserts on a duplicate enum name with simple and parametric casesScala 3 · Crash★ 6,324 stars

The code declares enum E twice, once with a simple case K0 and once with a parametric case K0. This causes an AssertionError in typer instead of a duplicate definition error.

Full details and maintainer reply
Scala 3Fixed2026-04-07
mediumNested macro splices at depth 230 overflow the stack during inliningScala 3 · Crash★ 6,324 stars

A recursive macro that splices itself compiles at depth 220 but raises StackOverflowError at depth 230 during the inlining phase, so valid code fails to compile.

Full details and maintainer reply
Scala 3Fixed2026-04-08
mediumErased context parameter before a normal one produces bytecode the JVM rejectsScala 3 · Crash★ 6,324 stars

A method with an erased `using` parameter followed by a normal context parameter gets wrong local slot numbers, so the JVM throws VerifyError at runtime. The reversed order works.

Full details and maintainer reply
Scala 3Fixed2026-04-08
mediumCompiler asserts in erasure when an override uses an erased `using` clauseScala 3 · Crash★ 6,324 stars

A generic trait method has an erased `using` clause before a type-parameter argument. An override of it triggers an AssertionError in erasure, so valid code fails to compile.

Full details and maintainer reply
Scala 3Fixed2026-04-08
lowCompiler asserts on exports of members from a cyclic opaque type companionScala 3 · Crash★ 6,324 stars

An export of members of an opaque type companion with a self-referential alias triggers an AssertionError in Namer after the cyclic type error. The compiler does not make a clean exit.

Full details and maintainer reply
Scala 3Fixed2026-05-10
lowVerilator rejects an undeclared data input of bufif and nmos gates with a plain enableVerilator · API-contract bug★ 4,022 stars

When the enable of a bufif, notif, nmos or pmos gate is a plain identifier, Verilator rejects an undeclared data input. IEEE 1800 requires an implicit net there, as for and gates.

Full details and maintainer reply
VerilatorFixed2026-09-14
mediumCompiler aborts with an assertion when a generate block declares a classIcarus Verilog · Crash★ 3,687 stars

If a valid class sits inside a generate block, iverilog fails an internal assertion and aborts. The same class at module scope compiles fine.

Full details and maintainer reply
Icarus VerilogFixed2026-06-14
mediumCompiler segfaults when it cannot resolve an enum value in its generate blockIcarus Verilog · Crash★ 3,687 stars

If the same generate block declares and uses an enum, the compiler cannot resolve its value and segfaults. Declare the enum at module scope to avoid the crash.

Full details and maintainer reply
Icarus VerilogFixed2026-06-14
mediumbuf, not or tran gate with different output widths makes iverilog abortIcarus Verilog · Crash★ 3,687 stars

If a buf, not or tran gate has outputs of different widths, an internal assertion fails and iverilog aborts without a normal width error.

Full details and maintainer reply
Icarus VerilogReported2026-09-14
mediumSimulator overflows its stack on a stable loop through a real or strength netIcarus Verilog · Crash★ 3,687 stars

If a wire drives itself through bufif1, or a real variable assigns itself, vvp recurses. vvp recurses until it segfaults at time 0, even though the value never changes.

Full details and maintainer reply
Icarus VerilogFixed2026-09-14
lowBiggerDecimal integral check accepts '-', '+' and letters, and crashes on empty stringCirce · Wrong-result bug★ 2,541 stars

integralIsValidLong returns true for '-', '+' and 'a', and throws StringIndexOutOfBoundsException on an empty string. Its documented precondition is not checked.

Full details and maintainer reply
CirceReported2026-05-10
mediumPrinter with empty indent puts rbraceLeft and rbraceRight in swapped positionsCirce · Wrong-result bug★ 2,541 stars

If indent is empty and the brace padding is custom, the padding after the closing brace appears before it and the reverse. The indented output path produces the correct order, so only the no-indent path is incorrect.

Full details and maintainer reply
CirceReported2026-05-10
lowPrinter indents text after a closing brace at the child nesting depthCirce · Wrong-result bug★ 2,541 stars

If the indent is not empty and newline padding follows closing braces or brackets, the printer indents the next text one level too deep. The error affects only the whitespace of custom-printed JSON.

Full details and maintainer reply
CirceReported2026-05-10
highlinesLimited misses over-long lines that arrive together with their newlinefs2 · API-contract bug★ 2,454 stars

If a complete over-long line and its terminator arrive in one chunk, linesLimited skips the length check and passes the line. The same input split into single elements raises LineTooLongException, so the guard depends on chunking.

Full details and maintainer reply
fs2Fixed2026-05-10
lowstringToLong accepts negative zero and breaks the prism round-trip lawMonocle · API-contract bug★ 1,700 stars

The string prism parses '-0' to 0 and reverseGet returns '0', so the round-trip law fails for '-0', '-00' and '-01'.

Full details and maintainer reply
MonocleFixed2026-05-10
infotimestamptz precision error message misspells the type name as timestampzskunk · Diagnostics bug★ 1,665 stars

If timestamptz gets an out-of-range precision, it produces an error that names the type timestampz. The message is wrong, but the failure itself is correct.

Full details and maintainer reply
skunkFixed2026-05-10
mediumByteBuffer bodies are wrong or fail for direct buffers and for consumed bufferssttp · Wrong-result bug★ 1,506 stars

If several code paths call ByteBuffer.array, it throws for direct and read only buffers. For consumed buffers, it returns the whole array behind the buffer, so request or response bodies come out wrong.

Full details and maintainer reply
sttpFixed2026-05-10
lowtoCurl drops multipart file names, content types and per-part headerssttp · Diagnostics bug★ 1,506 stars

If a request has a multipart body, the curl output omits filename, content type and per-part headers. For other body types, it prints a placeholder, so the debug command sends a different request.

Full details and maintainer reply
sttpFixed2026-05-10
mediumDigest auth throws Unknown qop when the server lists several qopssttp · API-contract bug★ 1,506 stars

If the server sends qop as auth,auth-int, the client compares the whole string against auth and auth-int. It then throws IllegalArgumentException with Unknown qop, so the request fails.

Full details and maintainer reply
sttpFixed2026-05-10
lowEnum validator's description string is missing its closing parenthesisTapir · Wrong-result bug★ 1,475 stars

When a program logs the description of an enumeration validator, it prints an unbalanced string such as Some(in(A,B,C. Only the printed text is wrong, not the validation itself.

Full details and maintainer reply
TapirFixed2026-05-10
lowSchema product field has equals without a matching hashCodeTapir · Wrong-result bug★ 1,475 stars

If two product fields are equal, they get different hash codes, so maps, sets and distinct() can miss or duplicate them. Only code that puts these schema types into hash-based collections has the problem.

Full details and maintainer reply
TapirFixed2026-05-10
lowDefault CORS settings leave PATCH out, so browsers block PATCH requestsTapir · API-contract bug★ 1,475 stars

If the default CORS interceptor runs, browser preflight for PATCH fails with no Access-Control-Allow-Methods header, so the request never reaches the route. Add PATCH to the allowed methods as a workaround.

Full details and maintainer reply
TapirFixed2026-05-10
mediumObjectValue equality compares only hash codes, so unequal objects can be equalCaliban · Wrong-result bug★ 993 stars

Two response objects whose 32-bit hash codes collide compare equal even when their fields differ. Deduplication and deep merges can then drop or mix data.

Full details and maintainer reply
CalibanFixed2026-05-10
lowwithExtension adds a second entry for a key and does not replace the firstCaliban · API-contract bug★ 993 stars

If withExtension runs twice with the same key, the extensions hold two entries, which the spec does not allow. Serializers then disagree on which value wins.

Full details and maintainer reply
CalibanFixed2026-05-10
lowString and enum toString do not escape backslashes, tabs or carriage returnsCaliban · Wrong-result bug★ 993 stars

The toString of StringValue escapes only quotes and newlines, and EnumValue only quotes. A backslash stays unescaped, so a JSON parser reads it as another value.

Full details and maintainer reply
CalibanFixed2026-05-10
highRelay Connection reports wrong hasNextPage and hasPreviousPage with cursorsCaliban · Wrong-result bug★ 993 stars

The page flags depend only on first or last, not on the after or before cursor. Clients that page forward from the middle see hasPreviousPage false and can miss earlier items.

Full details and maintainer reply
CalibanFixed2026-05-10
lowSingle-root-field check for subscriptions runs only on the first subscriptionCaliban · Soundness bug★ 993 stars

The validator finds one subscription operation and checks only that one. A later subscription with several root fields passes validation.

Full details and maintainer reply
CalibanFixed2026-05-10
lowFragment validation cache keyed by hash can return a result for a different queryCaliban · Soundness bug★ 993 stars

The memo caches use hash codes as keys with no equality check. A collision can make invalid queries pass or valid queries fail.

Full details and maintainer reply
CalibanFixed2026-05-10
lowSchema comparison reports unchanged directive arguments as changedCaliban · Diagnostics bug★ 993 stars

When one argument of a directive changes, the check reports every other common argument as changed, because it runs per argument against the directive. Schema diffs get noisy.

Full details and maintainer reply
CalibanFixed2026-05-10
mediumRemote schema parsing always drops subscriptionsCaliban · Wrong-result bug★ 993 stars

parseRemoteSchema hardcodes subscriptionType to None, so any subscription in a remote schema definition is lost. Stitched schemas lose their subscriptions.

Full details and maintainer reply
CalibanFixed2026-05-10
mediumRemote response unwrap keeps only the first field of a multi-field objectCaliban · Data-loss bug★ 993 stars

RemoteResolver.unwrap returns only the first root field of a remote response. The other fields are lost in stitch pipelines without an error.

Full details and maintainer reply
CalibanFixed2026-05-10
lowSchemaTracer calls head on a field list that can be emptyCaliban · Crash★ 993 stars

SchemaTracer.wrapper calls head on request.field.fields without an emptiness check. An empty list throws NoSuchElementException instead of producing a response. The fix uses headOption.

Full details and maintainer reply
CalibanFixed2026-05-10
mediumSchema reporting stops for good after one error and ignores the retry delayCaliban · Wrong-result bug★ 993 stars

On a SchemaError, ReportingDaemon logs the error and ends its loop, so later schema reports never run. The retry hint in the error is not used.

Full details and maintainer reply
CalibanFixed2026-05-10
mediumatOrElse throws IndexOutOfBoundsException on a Seq for a missing indexquicklens · API-contract bug★ 851 stars

If atOrElse modifies a List at a missing index, it throws, and the default is not used. It computes the default value but writes it back with updated, which needs an existing index.

Full details and maintainer reply
quicklensFixed2026-05-10
mediumFailed append still counts as an inserted node, so later child indices driftLaminar · Wrong-result bug★ 838 stars

The Append branch sets the node count to one even when the DOM insert returns false. So each failed append shifts later insert indices, and the rendered children stop matching the model.

Full details and maintainer reply
LaminarFixed2026-05-10
mediumFailed DOM insert still updates the child's parent in Laminar trackingLaminar · Wrong-result bug★ 838 stars

insertChildBefore and insertChildAfter set the parent after the raw DOM insert, whatever its result. So a failed insert leaves the child recorded under a parent it is not in.

Full details and maintainer reply
LaminarFixed2026-05-10
highTMap.contains returns true for any key whenever the map is not emptyKyo · Wrong-result bug★ 821 stars

The key argument is never used, so contains only checks whether the map has any entries. Lookups for keys that are not in the map return true.

Full details and maintainer reply
KyoFixed2026-05-18
highTMap.initWith builds the map and never runs the function passed to itKyo · Wrong-result bug★ 821 stars

initWith ignores its function argument and returns the new map, so the user's code never runs. Its signature also drops the result type parameter.

Full details and maintainer reply
KyoFixed2026-05-18
mediumSchedule.linear doubles its delays, so growth is exponential, not linearKyo · Wrong-result bug★ 821 stars

The linear schedule adds the base to itself at each step, so delays double: 1, 2, 4, 8 seconds. Retry waits grow much faster than the name promises.

Full details and maintainer reply
KyoFixed2026-05-18
mediumSubtype typeAnnotations returns the parent's parameter annotationsMagnolia · Wrong-result bug★ 800 stars

If subtypesFromMirrorStep builds a Subtype, it passes the sealed trait's paramTypeAnns instead of the subtype's own annotations. A derived typeclass then sees the wrong annotations on a case class.

Full details and maintainer reply
MagnoliaFixed2026-05-10
lowMonadic[Future].point submits a task to the pool, not a completed valueMagnolia · Concurrency bug★ 800 stars

If point uses Future(value), each lift submits a task to the ExecutionContext. Unlike Future.successful, the Future does not complete at once, and a shut down or saturated pool delays or breaks it.

Full details and maintainer reply
MagnoliaFixed2026-05-10
mediumMessagePack reader returns empty containers for lengths of 2^31 and aboveuPickle · Wrong-result bug★ 768 stars

A 32-bit length of 2^31 or more wraps negative, so the array or map reads as empty and the reader ignores the payload that follows. Malformed input passes without any error.

Full details and maintainer reply
uPickleReported2026-05-10
lowJSON reader accepts invalid hex digits in unicode escapes and yields wrong charactersuPickle · Soundness bug★ 768 stars

The reader accepts escapes such as u00gZ, uXXXX or u0G00, does not reject them, and decodes them to arbitrary code points. Malformed JSON then produces wrong text without an error.

Full details and maintainer reply
uPickleReported2026-05-10
mediumBigInt codec truncates negative values below the Long range during packAirframe · Data-loss bug★ 665 stars

If pack receives a negative BigInt below Long.MinValue, the codec checks only the upper bound, so a different number gets stored without an error. The codec handles positive out-of-range values as intended.

Full details and maintainer reply
AirframeReported2026-05-18
highGrouped GEMM computes rows past the end of each groupDeepGEMM-Ascend · Wrong-result bug★ 600 stars

The last m-block of each group does not truncate, so rows past the group's valid rows get computed. The error affects group sizes that are not multiples of BLOCK_M.

Full details and maintainer reply
DeepGEMM-AscendReported2026-09-30
mediumThe docs call C the accumulator, but the kernel only uses its presenceDeepGEMM-Ascend · Wrong-result bug★ 600 stars

The documented C += A @ B does not happen, because the kernel adds the product to whatever D holds. A C that is not the same tensor as D gives a wrong result with no error.

Full details and maintainer reply
DeepGEMM-AscendReported2026-09-30
highThe Not implication rule encodes the inverse, so refined Int values can break boundsIron · Soundness bug★ 561 stars

The Not[C1] implies Not[C2] rule encodes the inverse instead of the contrapositive, so a value that is at most 5 passes as at most 3. The compiler accepts an invalid refinement, and the value breaks the bound at runtime.

Full details and maintainer reply
IronFixed2026-05-10
highCollection implications such as ForAll to Exists compile though short lists break themIron · Soundness bug★ 561 stars

Implications such as ForAll ==> Exists and Init ==> Head compile, but empty or one-element lists break the target constraint, so invalid values type-check.

Full details and maintainer reply
IronFixed2026-05-10
mediumLong range constraints compare through Double and fail above 2^53Iron · Soundness bug★ 561 stars

Greater, Less and Multiple on Long values compare through Double, so the checks reject or accept values above 2^53 in error. For example, 2^53 + 1 fails Greater of 2^53.

Full details and maintainer reply
IronFixed2026-05-10
mediumFlow.range with a negative step emits only the first elementOx · Wrong-result bug★ 527 stars

If the step is negative, the loop continues while t is at most the end value. range(5, 1, -1) stops after 5, but range(1, 5, -1) does not stop until Int overflow.

Full details and maintainer reply
OxFixed2026-05-10
mediumAdaptiveRetry stops on a Left result when no failure cost appliesOx · Wrong-result bug★ 527 stars

If shouldPayFailureCost returns false for a retriable error, afterAttempt stops the retry sequence. The Right case continues for free, so the documented free retry never happens.

Full details and maintainer reply
OxFixed2026-05-18
lowFailure message suffix throws NullPointerException for exceptions without a messageMUnit · Diagnostics bug★ 472 stars

munitAppendToFailureMessage calls endsWith on a null exception message. So a test that throws an exception without a message reports munit's NPE, not the original failure.

Full details and maintainer reply
MUnitFixed2026-05-10
infoChapter 3 has a wrong Section 3.8 claim, a mismatched construction orientation and typosSymmetryBook · Specification gap★ 453 stars

Section 3.8 wrongly says the m-th root of t⁻¹ is a symmetry. Construction 3.6.9 orientation differs from its proof, though its statement holds. Typos follow.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoChapter 4 exercise claims an equivalence that fails; two others lack a hypothesisSymmetryBook · Specification gap★ 453 stars

Exercise 4.6.9 claims a map from pairs of cycles onto bicycles that commute is onto, but a two-point counterexample shows it is not. Exercises 4.2.6 and 4.3.5 need a hypothesis that the text omits.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoGroup exercise: evaluation at refl reverses multiplication, so it is not a homomorphismSymmetryBook · Specification gap★ 453 stars

The last claim of Exercise 5.6.4 is off by an inverse: with the book's composition order, evaluation at refl reverses multiplication. For non-abelian groups the map is not a homomorphism.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoChapter 7 has a typo, an unstated inverse and an unstated hypothesisSymmetryBook · Specification gap★ 453 stars

Exercise 7.2.10 has s where s' belongs and fails in the integers as printed. Example 7.3.5 misses an inverse, and Exercise 7.3.6 misses a hypothesis.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoChapter 9 claims need a hypothesis, a converse is false, and inverses are absentSymmetryBook · Specification gap★ 453 stars

Corollary 9.3.9(5) and Lemma 9.8.3 need a hypothesis, the converse in Remark 9.4.5 is false, and Remark 9.7.1 misses inverses. Lemma 9.6.4 also has a notation problem.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoOrder-3 subgroup count of symmetric groups is only correct up to n=5SymmetryBook · Specification gap★ 453 stars

The count n(n-1)(n-2)/6 of order-3 subgroups of symmetric groups is correct only for n up to 5. The symmetric group on 6 points has 40 such subgroups, not 20, and the text also has a typo.

Full details and maintainer reply
SymmetryBookReported2026-10-06
infoLemma on generators: the 'if' direction fails for the empty generator setSymmetryBook · Specification gap★ 453 stars

For the symmetric group on 2 points and an empty S, the embedding map can be an embedding even though S does not generate the group. Theorems 11.6.8 and 11.6.10 also need a definition and a hypothesis.

Full details and maintainer reply
SymmetryBookReported2026-10-06
highQ4_K dequantization uses the wrong scale for half of each blockgguf-tools · Wrong-result bug★ 370 stars

The high-nibble weights of each Q4_K block use the scale and min of the earlier sub-block. The code dequantizes half of every Q4_K tensor with wrong values and gives no error.

Full details and maintainer reply
gguf-toolsReported2026-09-30
highgguf_get_tensor divides by zero on deprecated tensor types 4 and 5gguf-tools · Crash★ 370 stars

Types q4_2 and q4_3 have zero items per block, so gguf_get_tensor divides by zero. The issue says this raises SIGFPE on x86 and gives a zero tensor size on arm64.

Full details and maintainer reply
gguf-toolsReported2026-09-30
mediumA compiled file crashes with an internal anomaly when file numbers changeNarya · Crash★ 310 stars

A compiled file with a match or let rec fails to load after a file number change, with anomaly Meta.Map.find_opt. The same files check fine from source.

Full details and maintainer reply
NaryaFixed2026-10-05
lowSame file loads twice through different relative paths and causes a type errorNarya · API-contract bug★ 310 stars

Imports with a parent-directory path are not reduced, so one file loads twice under two names. Constants from the two copies differ, so a valid file gets rejected with an unequal-constants error.

Full details and maintainer reply
NaryaFixed2026-10-05
mediumField projection from a transported tuple in 3D dimension raises an internal bugNarya · Crash★ 310 stars

Field projection from a transport in a three-dimensional degeneracy of a record type raises bug E0500 on valid HoTT code. The program is correct, but Narya cannot check it.

Full details and maintainer reply
NaryaFixed2026-10-05
mediumUnannotated definitions store normal-form types, which makes .nyo files hugeNarya · Hang★ 310 stars

Without a type annotation, the .nyo file stores the synthesized type in normal form, which can grow as 3 to the power of the depth. One definition produced a 280 MB compiled file and slow imports.

Full details and maintainer reply
NaryaConfirmed2026-10-05
lowcalc reverse-orientation check is slow because it builds a full error textNarya · Hang★ 310 stars

When the forward check of a calc step fails, calc still builds the complete error text for it before it tests the reverse. Large types take 7.3 seconds and 1.7 GB instead of about 2.6 seconds.

Full details and maintainer reply
NaryaFixed2026-10-05
infoDocs give the wrong option name -no-format and an incomplete `-source-only` option descriptionNarya · Specification gap★ 310 stars

The docs name -no-format, which the tool rejects as an unknown option; the real option is -no-reformat. The description of the `-source-only` option also omits that compiled files are still written.

Full details and maintainer reply
NaryaFixed2026-10-05
mediumWrites of compiled .nyo files are not atomic, so concurrent runs breakNarya · Concurrency bug★ 310 stars

A reader can load a .nyo file while another process still writes it, and an interrupted write leaves a broken file. With the `-source-only` option, the tool still writes compiled files, which can break other runs.

Full details and maintainer reply
NaryaFixed2026-10-05
lowcalc hides an internal bug raised by its forward checkNarya · Diagnostics bug★ 310 stars

calc's error handler accepts any diagnostic, even internal bugs, from the forward check. If the reverse check passes, the internal error is never shown to the user.

Full details and maintainer reply
NaryaFixed2026-10-05
mediumRepeat-until-success schedule never stops for an even repetition countGears · Hang★ 305 stars

The retry counter advances by two, but the stop check expects one. So an even maxRepetitions never stops, and an odd one stops at about half the requested count.

Full details and maintainer reply
GearsReported2026-05-10
lowUniform Long generator overflows on wide ranges and retries out-of-range valuesHedgehog · Wrong-result bug★ 268 stars

The formula max - min + 2 overflows for wide ranges, and the offset can give values below min. The retry guard catches these, so the cost is extra retries rather than wrong values.

Full details and maintainer reply
HedgehogReported2026-05-10
infoMersenneTwister64 hashCode uses only the index, so seeded generators collideHedgehog · API-contract bug★ 268 stars

hashCode returns the index mti0 and ignores the 312-element state, so generators from a fresh seed share one hash. Hash maps of generators degrade, but equality is still correct.

Full details and maintainer reply
HedgehogFixed2026-05-10
lowTake followed by a larger drop generates a negative LIMIT that some databases rejectScalaSQL · API-contract bug★ 260 stars

A drop call with a count greater than the take count produces SQL with a negative LIMIT. PostgreSQL and MySQL reject that SQL, and SQLite reads it as no limit. Collections return an empty result.

Full details and maintainer reply
ScalaSQLReported2026-05-10
lowUpsert with no update assignments generates an incomplete DO UPDATE SET clauseScalaSQL · API-contract bug★ 260 stars

An onConflictUpdate call with no assignments emits DO UPDATE SET with nothing after it, which is a syntax error. The API accepts the empty call without a compile error.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
mediumA None value always declares the JDBC type NULL, which some drivers rejectScalaSQL · Crash★ 260 stars

The base dialect calls setNull with the NULL type code instead of the column's real type. MS SQL routes around this, but other drivers such as Oracle may reject the statement.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
mediumcamelToSnake turns XMLParser into xmlparser, so acronym columns are not foundScalaSQL · Wrong-result bug★ 260 stars

camelToSnake merges consecutive capitals into one word, so the default mapping of XMLParser or HTTPSConnection misses snake_case columns such as xml_parser. The query then fails with column not found.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
mediumWithCte.filter puts the WHERE clause inside the CTE, not the outer queryScalaSQL · Wrong-result bug★ 260 stars

WithCte.filter swaps its arguments, so the WHERE clause lands in the CTE definition. Plain filters return the same rows, but filters applied after limits or aggregates on the CTE can change the result.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
mediumstartsWith, endsWith and contains treat % and _ in user values as wildcardsScalaSQL · Wrong-result bug★ 260 stars

The LIKE pattern concatenates the value and does not escape it. A search for 50% matches any string that starts with 50, and a_b matches axb, so untrusted input widens the match.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
mediumIdentifier escape() does not escape a quote or bracket inside a nameScalaSQL · Security vulnerability★ 260 stars

Table and column names that hold the dialect's delimiter break out of the quoted identifier. If such names come from untrusted data, they can alter the generated SQL.

Full details and maintainer reply
ScalaSQLConfirmed2026-05-10
lowTruncation counts a CRLF line break as two linesPPrint · Wrong-result bug★ 248 stars

The truncation counts the carriage-return and newline pair as two breaks, because it resets the flags before the pair check runs. Line counts in truncated output for Windows-style text are off by one per break.

Full details and maintainer reply
PPrintReported2026-05-10
lowReader longCompare gives the wrong sign when the subtraction overflowsborer · Wrong-result bug★ 242 stars

If longCompare compares a stored Long.MaxValue against Long.MinValue, the subtraction overflows and reports the reverse order.

Full details and maintainer reply
borerFixed2026-05-10
lowoverlayAll error message shows the end position where the start should befansi · Diagnostics bug★ 237 stars

If start is not less than end, the exception text repeats the end value instead of start, so the message shows wrong numbers. Only the message text is wrong, and only for invalid calls.

Full details and maintainer reply
fansiReported2026-05-10
mediumEqual multi-style values hash the same but compare unequal, so sets keep duplicatesfansi · API-contract bug★ 237 stars

Multiple attribute values compare by reference in equals but by content in hashCode. Two equal values built in separate calls count as two members in a Set, so deduplication fails.

Full details and maintainer reply
fansiReported2026-05-10
mediumAsync Either.forall returns false for Left instead of the stdlib's truedotty-cps-async · Wrong-result bug★ 194 stars

Inside an async block, forall on a Left value returns false, while scala.util.Either returns true. Code that depends on the vacuous result gets the opposite answer without an error.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync Try.recover throws MatchError when the partial function does not matchdotty-cps-async · Crash★ 194 stars

When recover or recoverWith gets an exception the partial function does not handle, the async version throws MatchError and drops the original failure. The original error is lost.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync `Using` leaks the resource when the body failsdotty-cps-async · Resource leak★ 194 stars

The async version of `Using` releases the resource only on success. When the body fails, the resource is never closed, so each failure leaks a handle.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync IndexedSeq indexWhere ignores its from argumentdotty-cps-async · Wrong-result bug★ 194 stars

The IndexedSeq override accepts a from index but always starts the search at 0. A call like indexWhere(p, 3) can return an index before the requested start point.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync Array dropWhile returns one element when every element matchesdotty-cps-async · Wrong-result bug★ 194 stars

When the predicate matches all elements in an async block, dropWhile returns a one-element array instead of an empty one. The slice bound is off by one.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync breakable never runs its body, so it skips side effectsdotty-cps-async · Wrong-result bug★ 194 stars

The async breakable wrapper passes the monadic body to Breaks.breakable as a discarded value, so the body never runs. Effects inside the block do not happen and the call reports success.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumAsync lastIndexWhere throws IndexOutOfBounds when end is past the arraydotty-cps-async · Crash★ 194 stars

Unlike the standard library, the async lastIndexWhere does not clamp end to the array size. If the caller sets an end larger than the array length, the call throws and does not search.

Full details and maintainer reply
dotty-cps-asyncFixed2026-05-10
mediumNonEmptyMap.map keeps duplicate keys and loses entries when converted to a MapHearth · Data-loss bug★ 164 stars

When two keys map to the same new key, map keeps both entries, so size reports 2. toListMap keeps only the last value without an error, so the first entry is lost.

Full details and maintainer reply
HearthFixed2026-05-18
lowGenerated SQL identifiers keep embedded double quotes unescapedwvlet · Security vulnerability★ 158 stars

doubleQuoteIfNecessary wraps non-plain identifiers in double quotes without escaping embedded quotes. A name with a quote yields malformed SQL.

Full details and maintainer reply
wvletFixed2026-05-10
mediumNewlines inside triple-quoted string literals vanish from generated SQLwvlet · Wrong-result bug★ 158 stars

TripleQuoteString.sqlExpr splits the literal on newlines and rejoins the parts with || without a newline. A multi-line string then becomes one run of text in the query output, with no error.

Full details and maintainer reply
wvletFixed2026-05-10
mediumDuckDB schema analysis leaks a JDBC statement on every analysiswvlet · Resource leak★ 158 stars

DuckDBSchemaAnalyzer creates a statement for schema analysis and never closes it, but it closes only the result set. In pooled setups, statements build up with each analysis until the connection closes.

Full details and maintainer reply
wvletFixed2026-05-10
highONNX model outputs always load as None because a name filter never matchesonnx-scala · Wrong-result bug★ 151 stars

The output-name filter compares a string with inner iterables, so it is always false. Model output reads return only None values for every model.

Full details and maintainer reply
onnx-scalaReported2026-05-10
mediumA model with BOOL, STRING, UINT or FLOAT16 tensors fails to load with MatchErroronnx-scala · Crash★ 151 stars

The tensor decoder handles only six ONNX data types and has no default case. A model whose initializers use another type fails to load with a scala.MatchError.

Full details and maintainer reply
onnx-scalaReported2026-05-10
low`Raise.catching` ignores exceptions that are subclasses of the target typeyaes · API-contract bug★ 140 stars

If E is RuntimeException, the catch compares exception classes with ==, so an ArithmeticException escapes as a raw exception. The catch works when the exception class is E itself.

Full details and maintainer reply
yaesFixed2026-05-10
mediumDiagram drops the last step of a three-step interruption pathworkflows4s · Wrong-result bug★ 131 stars

A diagram of a three-step interruption sequence omits the final step, because an off-by-one threshold keeps only the second step. The step still runs at execution time.

Full details and maintainer reply
workflows4sFixed2026-05-10
lowDiagrams draw a Loop that has not started as executedworkflows4s · Wrong-result bug★ 131 stars

If a loop has only its unstarted body in its history, RenderUtils.hasStarted returns true. Diagrams then show the loop that has not run with the executed style, and other renderers inherit the wrong answer.

Full details and maintainer reply
workflows4sFixed2026-05-10
lowSigned add overflow check misses negative overflow, so MinValue plus -1 wrapsSoundness · Wrong-result bug★ 114 stars

The addS family tests only positive overflow, so Long.MinValue plus -1 wraps to Long.MaxValue with no OverflowError, while unsigned add functions are correct.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumShort ** Double truncates its result to a Short and gives wrong resultsSoundness · Wrong-result bug★ 114 stars

The Short ** Double operator casts its Double result to Short, so (200: Short) ** 2.0 returns -25536 instead of 40000 and fractional results lose their fraction.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumByte and Short hex, octal and binary output sign-extends to 32 bitsSoundness · Wrong-result bug★ 114 stars

A negative Byte or Short converts to hex, octal or binary through an Int. So 0xFF as a Byte prints ffffffff instead of ff, and binary output has 32 digits.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumFloat and Double modulo gives wrong results for a negative divisorSoundness · Wrong-result bug★ 114 stars

The %% operator on Float and Double only corrects negative remainders for positive divisors, so 7.0 %% -3.0 returns 1.0 instead of -2.0, while the integer versions are correct.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumA Rankine delta added to a Temperature uses the inverted 9/5 factorSoundness · Wrong-result bug★ 114 stars

A Rankine quantity converts with 9/5 instead of 5/9 when added or subtracted. So 9 R added to 273.15 K gives 289.35 K instead of 278.15 K.

Full details and maintainer reply
SoundnessFixed2026-05-10
lowLevenshtein distance is 0 when the left string is emptySoundness · Wrong-result bug★ 114 stars

The edit distance loop never runs for an empty left string. So the distance between an empty string and abc is 0 instead of 3, and the normalized distance reports a perfect match.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumCompass 8-point list has Southwest twice and no NorthwestSoundness · Wrong-result bug★ 114 stars

Compass.points8 ends with Southwest instead of Northwest, so lookups in the northwest quadrant around 315 degrees return Southwest.

Full details and maintainer reply
SoundnessFixed2026-05-10
highCSV writer does not quote cells that contain the delimiter or line breaksSoundness · Data-loss bug★ 114 stars

Dsv quotes only cells that hold a quote character. A cell with a comma or newline goes out raw, so the output splits into extra columns or rows when read back.

Full details and maintainer reply
SoundnessFixed2026-05-10
highRaster crop uses the bottom offset for the top edge and keeps wrong rowsSoundness · Wrong-result bug★ 114 stars

crop(top = 10) keeps the wrong rows because the pixel mapping offsets Y by bottom instead of top. The crop comes out flipped, and no error appears.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumSignal numbers are off by two and Hup gives -1Soundness · Wrong-result bug★ 114 stars

The id formula on the Signal enum returns -1 for Hup. For other signals, it is two below the POSIX number, so an OS call that uses it targets the wrong signal or fails.

Full details and maintainer reply
SoundnessFixed2026-05-10
highSession store uses an unsynchronized HashMap shared across request threadsSoundness · Concurrency bug★ 114 stars

Context keeps per-session values in a plain HashMap that concurrent HTTP threads access, so parallel requests can lose updates, throw ConcurrentModificationException or corrupt the map.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumLong digest drops the top and bottom bytes, so distinct Longs can collideSoundness · Wrong-result bug★ 114 stars

The Long Digestible uses shifts 52 down to 4 instead of 56 down to 0, so it hashes only seven misaligned bytes, and the Double instance inherits the loss.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumOrdinal subsequent(size) returns one element more than requestedSoundness · Wrong-result bug★ 114 stars

subsequent builds an interval one longer than size, so the Foreground and Background ANSI style bit fields in escapade overlap by one bit each.

Full details and maintainer reply
SoundnessFixed2026-05-10
lowTwo manifest attribute objects use the misspelled name SpecifacationSoundness · API-contract bug★ 114 stars

SpecifacationVendor and SpecifacationVersion contain a typo, while SpecificationTitle is correct, so Scala code cannot refer to them by the expected names. The JAR manifest keys themselves are correct.

Full details and maintainer reply
SoundnessFixed2026-05-10
lowTopological sort throws NoSuchElementException on cyclic inputSoundness · API-contract bug★ 114 stars

Dag does not check for cycles when it adds edges. Sort calls get on the search result, so a cyclic graph fails with an unexplained NoSuchElementException, not a cycle error.

Full details and maintainer reply
SoundnessFixed2026-05-10
mediumSemver comparison says equal versions are less and releases sort below prereleasesSoundness · Wrong-result bug★ 114 stars

The comparator returns true for 1.0.0 against 1.0.0 and ranks 1.0.0 below 1.0.0-alpha, which breaks sorting and comparisons under the SemVer 2.0 precedence rules.

Full details and maintainer reply
SoundnessFixed2026-05-10
infoMappedTypeInformation hashCode ignores the mapper and adds needless collisionsflink-scala-api · API-contract bug★ 113 stars

Type infos with the same nested type and different mappers always share a hash bucket. Lookups in hash maps degrade for those entries, but results stay correct.

Full details and maintainer reply
flink-scala-apiConfirmed2026-05-10
infoOption comparator error message stops mid-sentenceflink-scala-api · Diagnostics bug★ 113 stars

The UnsupportedOperationException for a non-comparable element type ends with the words: Element type that doesn't support. Users see an incomplete message when they use an Option as a key.

Full details and maintainer reply
flink-scala-apiConfirmed2026-05-10
mediumCoproduct serializer breaks for sealed types with 129 or more subtypesflink-scala-api · Crash★ 113 stars

Writes and reads of the subtype index use a signed byte, so index 128 and up becomes negative. Deserialization then throws ArrayIndexOutOfBoundsException.

Full details and maintainer reply
flink-scala-apiConfirmed2026-05-10
mediumQq match in a recursive partial def fails with a kernel errorquote4 · Crash★ 111 stars

A partial def that matches a Qq pattern and recurses fails at kernel check with 'declaration has metavariables', on code the reporter expects to compile. The report gives no minimal reproducer.

Full details and maintainer reply
quote4Reported2026-01-27
lowPooled connection validation failures never emit a debug messageldbc · Diagnostics bug★ 110 stars

If validation fails or times out for a pooled connection, no debug message appears. The log effect gets created and then discarded, so pool problems leave no trace in the logs.

Full details and maintainer reply
ldbcFixed2026-05-10
lowBatch query builder breaks on a lowercase values keywordldbc · API-contract bug★ 110 stars

If a clause uses lowercase values, MySQL rejects the combined statement with a syntax error, because the builder splits on uppercase VALUES only. Uppercase VALUES works.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumStatement.execute throws a MatchError for SHOW, DESCRIBE and EXPLAINldbc · Crash★ 110 stars

Statement.execute treats only SELECT as a query. If SHOW, DESCRIBE, EXPLAIN or a similar statement returns rows, it throws MatchError and gives no results.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumCode generation maps MEDIUMBLOB columns to TINYBLOBldbc · Wrong-result bug★ 110 stars

If a schema contains mediumblob, the parser builds a TINYBLOB type. Generated DDL and Scala mappings then allow only 255 bytes for columns meant to hold up to 16 MB.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumResultSet.isFirst returns true for every row after the firstldbc · Wrong-result bug★ 110 stars

isFirst checks that the cursor position is greater than zero. If the cursor is on row two or later, it returns true, so code that branches on isFirst misbehaves.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumText-protocol string escape misses NUL, newline and other charactersldbc · Security vulnerability★ 110 stars

The text-protocol escape handles only quotes and backslashes, in the wrong order, so NUL, CR, LF and Ctrl-Z stay raw. If an attacker controls a string on that path, it can break out of the literal.

Full details and maintainer reply
ldbcFixed2026-05-10
highCode generation maps DOUBLE and REAL columns to FLOAT and loses precisionldbc · Wrong-result bug★ 110 stars

The schema parser has no DOUBLE type, so DOUBLE and REAL columns become FLOAT. Generated Scala code then uses 32-bit Float for 64-bit values, and the precision loss gives no error.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumChained TLS builder calls drop the earlier settingldbc · Wrong-result bug★ 110 stars

If a builder chains withTLSParameters with withFallback in either order, it resets the setting applied first without an error. The connection then uses default TLS parameters or the wrong fallback policy.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumCharset version check reverses its test, so it drops gb18030 on MySQL 8ldbc · Wrong-result bug★ 110 stars

isOkayForVersion reverses the version comparison, so on MySQL 8 it drops gb18030, eucjpms and cp932 and offers them to servers that lack them. Only apps that rely on these charsets see the fault.

Full details and maintainer reply
ldbcFixed2026-05-10
lowSchema DSL rejects VARCHAR lengths above 255ldbc · API-contract bug★ 110 stars

The VARCHAR check uses the CHAR limit, so VARCHAR(500) fails to compile, although MySQL allows up to 65,535 bytes.

Full details and maintainer reply
ldbcFixed2026-05-10
mediumCircuit breaker lets many test requests through in half-open stateldbc · Concurrency bug★ 110 stars

If several concurrent calls enter the half-open state after the reset timeout, they can all run the test action. A success can then close the breaker, even though a concurrent test has failed.

Full details and maintainer reply
ldbcFixed2026-05-18
highPool resetConnection commits the unfinished transaction of a returned connectionldbc · Data-loss bug★ 110 stars

If resetConnection turns autocommit on before it rolls back, MySQL commits the pending transaction at that point. Half-written data from an unhandled error gets persisted instead of discarded.

Full details and maintainer reply
ldbcFixed2026-05-18
lowThe cp850 charset declares two bytes per character, not oneldbc · Wrong-result bug★ 110 stars

The charset table gives cp850 a maximum length of 2 bytes per character, but cp850 is single-byte. Buffer size and the single-byte fallback branch then take the wrong path.

Full details and maintainer reply
ldbcFixed2026-05-18
lowNonNegativeInterval hashCode ignores reduced form, so hash sets breakScalus · API-contract bug↓ 45k / mo★ 105 stars

equals compares reduced fractions but hashCode uses the raw fields, so 2/4 equals 1/2 yet they have different hashes, and HashSet or HashMap lookups miss equivalent intervals.

Full details and maintainer reply
ScalusFixed2026-05-10
mediumBLS12-381 point wrappers override equals but not hashCodeScalus · API-contract bug↓ 45k / mo★ 105 stars

G1Element, G2Element and MLResult override equals by curve point but keep the identity hashCode. Equal points get different hashes, so HashSet and HashMap lookups miss them.

Full details and maintainer reply
ScalusFixed2026-05-10
mediumBytes overrides equals but not hashCode, so HashMap lookups miss equal keysgeny · API-contract bug★ 98 stars

Two Bytes objects built from the same array compare equal but have different hash codes. Map keys or set members give lookup misses for values that are equal.

Full details and maintainer reply
genyReported2026-05-10
mediummaxBy and minBy return null or zero for an empty generator, without an errorgeny · Wrong-result bug★ 98 stars

Unlike min and max, maxBy and minBy return null for reference types and zero for numeric types on an empty generator. The caller gets a placeholder with no error.

Full details and maintainer reply
genyReported2026-05-10
mediumMarkdown decision table rows get one column too few when some rules lack annotationsdecisions4s · Wrong-result bug★ 85 stars

When at least one rule has an annotation, rules without one produce rows with fewer cells than the header. Downstream tools may corrupt the malformed Markdown table, but the HTML renderer is fine.

Full details and maintainer reply
decisions4sConfirmed2026-05-10
lowDistinct hit policy treats +0.0 and -0.0 as the same outputdecisions4s · Wrong-result bug★ 85 stars

The Distinct hit policy deduplicates outputs with a Set, and Double equality treats positive and negative zero as equal. A table with +0.0 and -0.0 outputs returns a result instead of reporting a conflict.

Full details and maintainer reply
decisions4sFixed2026-05-10
lowThe diagnostics printer throws at construction for a table with no input fieldsdecisions4s · Crash★ 85 stars

A constant decision table with zero input columns makes DiagnosticsPrinter throw on max of an empty collection during construction. The crash happens before the printer outputs any diagnostic.

Full details and maintainer reply
decisions4sReported2026-05-10
mediumLineage JSON export is invalid when names contain quotes or backslashesetl4s · API-contract bug★ 79 stars

The JSON helper wraps strings in quotes without escaping them. A name or description with a double quote or backslash, or an input with a newline, makes the lineage JSON unparseable.

Full details and maintainer reply
etl4sConfirmed2026-05-10
lowLineage chain and combine return identical lineages despite different doc commentsetl4s · Specification gap★ 79 stars

chain and combine have identical bodies, but their doc comments describe sequential and parallel use. The maintainer says the shared accumulating design is intended, and the docs confuse users.

Full details and maintainer reply
etl4sConfirmed2026-05-10
criticallrat-check reports VERIFIED for a proof that proves nothingDRAT-trim · Soundness bug★ 72 stars

On a satisfiable formula, the checker accepts the one-line proof 2 0 0 and prints VERIFIED with exit code 0, a regression from an earlier commit. A second proof also segfaults the checker.

Full details and maintainer reply
DRAT-trimReported2026-09-29
lowCirce encoder emits record fields in hash order, not declaration orderrecord4s · API-contract bug★ 68 stars

If a record has more than four fields, the circe encoder builds a hash Map, so JSON fields come out in hash order, not declaration order. The order can also differ between Scala versions.

Full details and maintainer reply
record4sReported2026-05-10
lowThe snapshot representation drops the ESC character and hides ANSI differencessnapshot4s · Wrong-result bug★ 67 stars

If InlineRepr.printChar maps the ESC character to an empty string, strings with colour codes snapshot as bracketed plain text. Two strings that differ only by ESC compare equal.

Full details and maintainer reply
snapshot4sReported2026-05-10
lowCode generator throws divide-by-zero when the known divisor is zerostrymonas · Crash★ 56 stars

If a known divisor is zero at staging time, int_div and long_div fold the division at once and the macro crashes with ArithmeticException. int_mod already has a guard for a related case.

Full details and maintainer reply
strymonasReported2026-05-10
highCooked.collect returns the stream elements in reverse orderstrymonas · Wrong-result bug★ 56 stars

If collect runs on a stream, it builds the list with each new element at the front. The elements come back in reverse, so every result has the wrong order, and one reverse call fixes it.

Full details and maintainer reply
strymonasReported2026-05-10
lowzipWithIndex keeps its counter across runs of the same streamUnwrapped · Wrong-result bug★ 40 stars

The index variable sits outside the stream body. If a second run consumes the same stream, the index continues from the first run instead of at zero.

Full details and maintainer reply
UnwrappedReported2026-05-10
lowPutPartiallyApplied equals throws ClassCastException for values of other typesUnwrapped · Crash★ 40 stars

If code compares this object with another type or with null, equals throws and does not return false, because it casts without checking canEqual. Sibling classes do the canEqual check.

Full details and maintainer reply
UnwrappedReported2026-05-10
mediumRabbitMQ config ignores automaticTopologyRecovery, so a false value has no effectPillars · Wrong-result bug★ 33 stars

The config conversion does not copy automaticTopologyRecovery to the client config. The client still recovers topology when the user disables the setting.

Full details and maintainer reply
PillarsReported2026-05-10
infoFlag not-found message runs the flag name into the words 'not found'Pillars · Diagnostics bug★ 33 stars

The code builds the FlagNotFound message without a space, so a 404 for flag my-feature says 'Flag my-featurenot found'. The message is wrong, but the status code is correct.

Full details and maintainer reply
PillarsReported2026-05-10
lowServer drops the recorder IO, so the response body size metric never recordsPillars · Wrong-result bug★ 33 stars

The server-side recorder builds the metric effect inside Option.foreach, so the effect never runs. The response body size histogram stays empty.

Full details and maintainer reply
PillarsReported2026-05-10
lowRedaction strategy encodes as OptIn while its decoder expects optinPillars · API-contract bug★ 33 stars

The encoder writes OptIn in mixed case, while every other value is lowercase and the decoder lowercases input. The decode error for an unknown value also names an SSL mode.

Full details and maintainer reply
PillarsReported2026-05-10
lowThe HTTP client declares body size histograms but never writes themPillars · Wrong-result bug★ 33 stars

The client metrics middleware declares request and response body size histograms but never records them. Dashboards show empty panels, and nothing warns at startup.

Full details and maintainer reply
PillarsReported2026-05-10
lowThe config encoder throws MatchError on a custom SSL contextPillars · Crash★ 33 stars

The SSL encoder covers three cases, so a custom SSL context fails with scala.MatchError, for example in a config dump. The decoder also cannot read it back.

Full details and maintainer reply
PillarsReported2026-05-10
mediumDoobie config drops the system schema, app schema and debug settingsPillars · Wrong-result bug★ 33 stars

toHikariConfig ignores systemSchema, appSchema and debug, so queries use the default schema and debug logging stays off. Users who set these values get different behaviour without any warning.

Full details and maintainer reply
PillarsReported2026-05-10