Public bug reports
Every bug we have reported in public, with its fix where there is one: 212 reports in 78 projects, 134 of them fixed upstream, in 48 projects. In 66 reports the maintainers thanked or credited us. Bugs we have not reported yet, and bugs we reported privately, are not on this page. It lists the public reports of the bug record, with the same numbers, and is updated with it; statuses are as of 3 November 2026.
- 212 public reports
- 134 fixed
- 78 open
- 78 projects with public reports
In the maintainers’ words
“Great catch, thank you!”
“Your diagnosis of this one looks right, and your fix makes sense.”
“Can you maybe share how did you find & generate these bugs?”
Found-by: Mike Murunov [genproof.com]
Martin Odersky merged one of the fixes into Scala 3 (scala3#26047), and Wilson Snyder merged our own fix into Verilator (verilator#8354).
Linux kernel (WireGuard) ★ 254k
- fixed chacha20poly1305_encrypt and _decrypt truncate size_t lengths to 32 bits · fix · follow-up · libcrypto-next
- fixed poly1305_update wraps buflen plus nbytes in 32 bits and writes out of bounds · fix · libcrypto-next
Playwright ★ 99k
- fixed getByRole name filter misses meter and progress elements labelled by a label tag · fix · v1.62.0 (2026-07-24)
- fixed Search input with a broken list attribute gets combobox role, not searchbox · fix · v1.62.0 (2026-07-24)
Redis ★ 77k
Cypress ★ 51k
Bruno ★ 48k
curl ★ 43k
Selenium ★ 35k
- fixed CSS escape of a non-ASCII first digit picks the wrong ASCII code point · fix · selenium-4.47.0 (2026-08-10)
- fixed By.name with % throws a format exception or builds a wrong selector · fix · selenium-4.47.0 (2026-08-10)
x-algorithm ★ 34k
k6 ★ 32k
- fixed Gauge max reports 0 when every sample is negative · fix · v2.2.0 (2026-08-10)
nginx ★ 32k
OpenSSL ★ 31k
Locust ★ 28k
- fixed Async requests logged as None lower all reported response-time percentiles · fix · 2.46.2 (2026-07-24)
zstd ★ 28k
Appium ★ 22k
- fixed Virtual sensor routes use /sensors, not the spec's /sensor path · fix · appium@3.6.0 (2026-07-25)
Thanks, this was indeed a typo. The fix will be included in the next release.
- fixed Timeout errors return HTTP 408 instead of the spec's 500, so clients may retry · fix · appium@4.0.0-beta.0 (2026-09-19) pre-release
Thanks, the issue seems to be valid.
Ajv ★ 15k
coturn ★ 15k
Pillow ★ 14k
Robot Framework ★ 12k
- fixed SectionHeader.from_params raises KeyError for the invalid header type · fix · v7.5rc1 (2026-09-04) pre-release; first stable: v7.5 (2026-09-14)
Thanks for the report.
F Prime ★ 12k
Karate ★ 9k
- fixed Equality match treats distinct integers above 2^53 as equal · v2.1.2 (2026-08-14)
- fixed contains only deep ignores duplicate counts, so unequal multisets pass · v2.1.2 (2026-08-14)
- fixed Negated partial schema macro passes on a list whose element contains the schema · v2.1.2 (2026-08-14)
WireMock ★ 7k
- fixed Multipart matcher with name and filename ignores the name constraint · fix · 4.0.0-beta.40 (2026-10-07) pre-release
- open XPath boolean expressions always match, so stubs fire on false conditions
zlib ★ 7k
goja ★ 7k
REST Assured ★ 7k
- fixed Large negative decimal JSON numbers become -Infinity when read as float · fix · rest-assured-6.1.0 (2026-10-09) [git tag]
Thanks to haskiindahouse for the report.
- fixed array.properties returns null for all elements when the first lacks properties · fix · rest-assured-6.1.0 (2026-10-09) [git tag]
Thanks to haskiindahouse for the report.
- fixed XmlPath negative index on a hyphenated element name fails with an unclear error · fix · rest-assured-6.1.0 (2026-10-09) [git tag]
Gatling ★ 7k
- fixed randomUuid produces UUIDs marked as version 0 instead of version 4 · fix · v3.16.0 (2026-09-29)
Thanks for reporting!
- fixed substring(pattern).find(n) never finds a match when n is 1 or more · fix · v3.16.0 (2026-09-29)
Thanks again!
- fixed Out-of-range negative EL index throws an uncaught exception for arrays and java.util.List · fix · v3.16.0 (2026-09-29)
Thanks!
Scala 3 ★ 6k
- open Compiler crashes with MatchError on an erroneous quoted pattern with an import
Thanks a lot for the minimization and the explanations @haskiindahouse!
- open Compiler aborts with AssertionError on a malformed context bound with a quote
- fixed Parser crashes when a line comment hides then in a for generator inside new · fix · 3.8.3-RC1 (2026-02-25) pre-release; first stable: 3.8.3 (2026-03-31)
- fixed Compiler asserts on a duplicate enum name with simple and parametric cases · fix · 3.10.0-RC1 (2026-09-03) pre-release; first stable: 3.10.0 (2026-10-12)
- fixed Nested macro splices at depth 230 overflow the stack during inlining · fix · 3.10.0-RC1 (2026-09-03) pre-release; first stable: 3.10.0 (2026-10-12)
Thanks for the report. Fixing in #25937.
- fixed Erased context parameter before a normal one produces bytecode the JVM rejects · fix · 3.9.0-RC1 (2026-06-10) pre-release; first stable: 3.9.0 (2026-09-03)
- fixed Compiler asserts in erasure when an override uses an erased `using` clause · fix · 3.9.0-RC1 (2026-06-10) pre-release; first stable: 3.9.0 (2026-09-03)
- fixed Compiler asserts on exports of members from a cyclic opaque type companion · fix · 3.10.0-RC1 (2026-09-03) pre-release; first stable: 3.10.0 (2026-10-12)
Nanopb ★ 6k
Verilator ★ 4k
Icarus Verilog ★ 4k
- fixed Compiler aborts with an assertion when a generate block declares a class · fix
Thanks for reporting this, fixed with #1395
- fixed Compiler segfaults when it cannot resolve an enum value in its generate block · fix
Thanks for the report. Will be fixed with #1386
- open buf, not or tran gate with different output widths makes iverilog abort
- fixed Simulator overflows its stack on a stable loop through a real or strength net · fix
Idris 2 ★ 3k
Circe ★ 3k
fs2 ★ 2k
- fixed linesLimited misses over-long lines that arrive together with their newline · fix · v3.14.0 (2026-09-05)
leptonica ★ 2k
- open leptonica numaIsSorted compares each element with the first one only
- open leptonica numaWindowedMean dereferences NULL when the window is wider than the array
- open leptonica parseStringForNumbers calls atof(NULL) on a string with no numbers
- open leptonica pixMaxDynamicRange reads before its log table for large 32-bit pixels
- open leptonica pixScaleGray2xLIDither and 4x read past the raster of a one-row image
- fixed leptonica numaRebinHistogram loses the x-axis of the input histogram · fix
- open leptonica numaUniformSampling gives negative or zero values at bin edges
Monocle ★ 2k
sttp ★ 2k
- fixed ByteBuffer bodies are wrong or fail for direct buffers and for consumed buffers · fix · v4.0.25 (2026-05-29)
Can you maybe share how did you find & generate these bugs? Would be interesting to see if this is something we could do longer-term
- fixed toCurl drops multipart file names, content types and per-part headers · fix · v4.0.25 (2026-05-29)
Thanks for the report - PRs welcome!
- fixed Digest auth throws Unknown qop when the server lists several qops · fix · v4.0.25 (2026-05-29)
Thanks for the report - PRs welcome!
Tapir ★ 1k
- fixed Enum validator's description string is missing its closing parenthesis · fix · v1.13.20 (2026-06-10)
Thanks for the report - PRs welcome!
- fixed Schema product field has equals without a matching hashCode · fix · v1.13.20 (2026-06-10)
Thanks for the report - PRs welcome!
- fixed Default CORS settings leave PATCH out, so browsers block PATCH requests · fix · v1.13.20 (2026-06-10)
Thanks for the report - PRs welcome!
Caliban ★ 993
- fixed ObjectValue equality compares only hash codes, so unequal objects can be equal · fix · v3.1.1 (2026-05-24)
- fixed withExtension adds a second entry for a key and does not replace the first · fix · v3.1.1 (2026-05-24)
- fixed String and enum toString do not escape backslashes, tabs or carriage returns · fix · v3.1.1 (2026-05-24)
- fixed Relay Connection reports wrong hasNextPage and hasPreviousPage with cursors · fix · v3.1.1 (2026-05-24)
- fixed Single-root-field check for subscriptions runs only on the first subscription · fix · v3.1.1 (2026-05-24)
- fixed Fragment validation cache keyed by hash can return a result for a different query · fix · v3.1.3 (2026-07-01)
- fixed Schema comparison reports unchanged directive arguments as changed · fix · v3.1.1 (2026-05-24)
- fixed Remote schema parsing always drops subscriptions · fix · v3.1.1 (2026-05-24)
- fixed Remote response unwrap keeps only the first field of a multi-field object · fix · v3.1.1 (2026-05-24)
- fixed SchemaTracer calls head on a field list that can be empty · fix · v3.1.1 (2026-05-24)
- fixed Schema reporting stops for good after one error and ignores the retry delay · fix · v3.1.1 (2026-05-24)
quicklens ★ 852
- fixed atOrElse throws IndexOutOfBoundsException on a Seq for a missing index · fix · v1.9.15 (2026-06-16)
Thanks for the report - PRs welcome!
Laminar ★ 839
Kyo ★ 822
- fixed TMap.contains returns true for any key whenever the map is not empty · fix · v1.0.0-RC4 (2026-06-18) pre-release
- fixed TMap.initWith builds the map and never runs the function passed to it · fix · v1.0.0-RC4 (2026-06-18) pre-release
- fixed Schedule.linear doubles its delays, so growth is exponential, not linear · fix · v1.0.0-RC4 (2026-06-18) pre-release
Magnolia ★ 800
- fixed Subtype typeAnnotations returns the parent's parameter annotations · fix · scala3-v1.3.21 (2026-06-16)
Thanks for the report - PRs welcome!
- fixed Monadic[Future].point submits a task to the pool, not a completed value · fix · scala3-v1.3.21 (2026-06-16)
Thanks for the report - PRs welcome!
uPickle ★ 768
Airframe ★ 666
DeepGEMM-Ascend ★ 631
Iron ★ 562
- fixed The Not implication rule encodes the inverse, so refined Int values can break bounds · fix · v3.3.2 (2026-07-06)
- fixed Collection implications such as ForAll to Exists compile though short lists break them · fix · v3.3.2 (2026-07-06)
Hello. Thank you for opening this issue and the others.
- fixed Long range constraints compare through Double and fail above 2^53 · fix · v3.3.2 (2026-07-06)
Ox ★ 529
- fixed Flow.range with a negative step emits only the first element · fix · v1.0.5 (2026-06-08)
Thanks for the report - PRs welcome!
- fixed AdaptiveRetry stops on a Left result when no failure cost applies · fix · v1.0.5 (2026-06-08)
MUnit ★ 472
- fixed Failure message suffix throws NullPointerException for exceptions without a message · fix · v1.3.6 (2026-09-03)
humanize ★ 379
gguf-tools ★ 373
Narya ★ 315
- fixed A compiled file crashes with an internal anomaly when file numbers change · fix
Your diagnosis of this one looks right, and your fix makes sense.
- fixed Same file loads twice through different relative paths and causes a type error · fix
- fixed Field projection from a transported tuple in 3D dimension raises an internal bug · fix
- open Unannotated definitions store normal-form types, which makes .nyo files huge
- fixed calc reverse-orientation check is slow because it builds a full error text · fix
- fixed Writes of compiled .nyo files are not atomic, so concurrent runs break · fix
- fixed calc hides an internal bug raised by its forward check · fix
- fixed A compiled Narya file can refer to a constant of a different file · fix
Good catch, you're probably right. Linking is a terrible headache.
- fixed Loading compiled Narya files takes exponential time with diamond imports · fix
Sure! Thanks for finding this, by the way; it looks like a huge improvement.
Gears ★ 306
Hedgehog ★ 268
ScalaSQL ★ 259
- open Take followed by a larger drop generates a negative LIMIT that some databases reject
- open Upsert with no update assignments generates an incomplete DO UPDATE SET clause
- open A None value always declares the JDBC type NULL, which some drivers reject
- open camelToSnake turns XMLParser into xmlparser, so acronym columns are not found
- open WithCte.filter puts the WHERE clause inside the CTE, not the outer query
- open startsWith, endsWith and contains treat % and _ in user values as wildcards
Proposed fix sounds good to me. Thanks in advance for submitting a PR!
- open Identifier escape() does not escape a quote or bracket inside a name
PPrint ★ 248
borer ★ 242
- fixed Reader longCompare gives the wrong sign when the subtraction overflows · fix · v1.17.0 (2026-07-28) [git tag]
Great catch, thank you! I'd be happy to merge a PR if you have time to submit one.
fansi ★ 237
dotty-cps-async ★ 194
- fixed Async Either.forall returns false for Left instead of the stdlib's true · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/119) and proposed fix.
- fixed Async Try.recover throws MatchError when the partial function does not match · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/120) and proposed fix.
- fixed Async `Using` leaks the resource when the body fails · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/121) and proposed fix.
- fixed Async IndexedSeq indexWhere ignores its from argument · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/122) and proposed fix.
- fixed Async Array dropWhile returns one element when every element matches · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/123) and proposed fix.
- fixed Async breakable never runs its body, so it skips side effects · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/124) and proposed fix.
- fixed Async lastIndexWhere throws IndexOutOfBounds when end is past the array · fix · 1.3.3 (2026-05-17)
Thanks to @haskiindahouse for the [bug report](https://github.com/dotty-cps-async/dotty-cps-async/issues/125) and proposed fix.
Hearth ★ 166
- fixed NonEmptyMap.map keeps duplicate keys and loses entries when converted to a Map · fix · 0.3.1 (2026-06-11)
wvlet ★ 158
- fixed Generated SQL identifiers keep embedded double quotes unescaped · fix · v2026.3.0 (2026-08-28)
- fixed Newlines inside triple-quoted string literals vanish from generated SQL · fix · v2026.3.0 (2026-08-28)
- fixed DuckDB schema analysis leaks a JDBC statement on every analysis · fix · v2026.3.0 (2026-08-28)
onnx-scala ★ 151
yaes ★ 140
- fixed `Raise.catching` ignores exceptions that are subclasses of the target type · fix · v0.20.0 (2026-05-29)
Good catch! @haskiindahouse, I assign it to you 🚀
workflows4s ★ 131
Soundness ★ 114
- fixed Signed add overflow check misses negative overflow, so MinValue plus -1 wraps · fix · 0.64.0 (2026-09-04)
- fixed Short ** Double truncates its result to a Short and gives wrong results · fix · 0.64.0 (2026-09-04)
- fixed Byte and Short hex, octal and binary output sign-extends to 32 bits · fix · 0.64.0 (2026-09-04)
- fixed Float and Double modulo gives wrong results for a negative divisor · fix · 0.64.0 (2026-09-04)
- fixed A Rankine delta added to a Temperature uses the inverted 9/5 factor · fix · 0.64.0 (2026-09-04)
- fixed Levenshtein distance is 0 when the left string is empty · fix · 0.64.0 (2026-09-04)
- fixed Compass 8-point list has Southwest twice and no Northwest · fix · 0.64.0 (2026-09-04)
- fixed CSV writer does not quote cells that contain the delimiter or line breaks · fix · 0.64.0 (2026-09-04)
- fixed Raster crop uses the bottom offset for the top edge and keeps wrong rows · fix · 0.64.0 (2026-09-04)
- fixed Signal numbers are off by two and Hup gives -1 · fix · 0.64.0 (2026-09-04)
- fixed Session store uses an unsynchronized HashMap shared across request threads · fix · 0.64.0 (2026-09-04)
- fixed Long digest drops the top and bottom bytes, so distinct Longs can collide · fix · 0.64.0 (2026-09-04)
- fixed Ordinal subsequent(size) returns one element more than requested · fix · 0.64.0 (2026-09-04)
- fixed Two manifest attribute objects use the misspelled name Specifacation · fix · 0.64.0 (2026-09-04)
- fixed Topological sort throws NoSuchElementException on cyclic input · fix · 0.64.0 (2026-09-04)
- fixed Semver comparison says equal versions are less and releases sort below prereleases · fix · 0.64.0 (2026-09-04)
flink-scala-api ★ 113
quote4 ★ 111
ldbc ★ 110
- fixed Pooled connection validation failures never emit a debug message · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Batch query builder breaks on a lowercase values keyword · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Statement.execute throws a MatchError for SHOW, DESCRIBE and EXPLAIN · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Code generation maps MEDIUMBLOB columns to TINYBLOB · fix · v0.6.1 (2026-05-23)
Really appreciate the careful reports.
- fixed ResultSet.isFirst returns true for every row after the first · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Text-protocol string escape misses NUL, newline and other characters · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Code generation maps DOUBLE and REAL columns to FLOAT and loses precision · fix · v0.6.1 (2026-05-23)
Thanks again for the thorough reports across the board, they've been genuinely helpful.
- fixed Chained TLS builder calls drop the earlier setting · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Charset version check reverses its test, so it drops gb18030 on MySQL 8 · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Schema DSL rejects VARCHAR lengths above 255 · fix · v0.6.1 (2026-05-23)
Thanks again for the thorough reports across the board, they've been genuinely helpful.
- fixed Circuit breaker lets many test requests through in half-open state · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed Pool resetConnection commits the unfinished transaction of a returned connection · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
- fixed The cp850 charset declares two bytes per character, not one · fix · v0.6.1 (2026-05-23)
A special thank you to @haskiindahouse for reporting multiple bugs in this release. Your detailed bug reports were invaluable in improving the quality of ldbc!
Scalus ★ 106
- fixed NonNegativeInterval hashCode ignores reduced form, so hash sets break · fix · v0.18.0 (2026-06-15)
@haskiindahouse nice catch! Fixed
- fixed BLS12-381 point wrappers override equals but not hashCode · fix · v0.18.0 (2026-06-15)
@haskiindahouse Thank you for reporting!
geny ★ 98
decisions4s ★ 85
etl4s ★ 81
DRAT-trim ★ 73
record4s ★ 68
snapshot4s ★ 68
strymonas ★ 56
Unwrapped ★ 40
Pillars ★ 33
- open RabbitMQ config ignores automaticTopologyRecovery, so a false value has no effect
- open Server drops the recorder IO, so the response body size metric never records
- open Redaction strategy encodes as OptIn while its decoder expects optin
- open The HTTP client declares body size histograms but never writes them
- open The config encoder throws MatchError on a custom SSL context
- open Doobie config drops the system schema, app schema and debug settings