PR #13835 merged into ohmyzsh/ohmyzsh โ 175K+ stars
Bug: c90141e introduced %-escaping in the josh theme โ but branch_size was still computed from the raw (unescaped) branch name. For a branch like feat/100%done (13 chars raw), the displayed string feat/100%%done is 14 chars โ causing the prompt padding to be off by one space per % in the branch name.
Maintainer feedback:
"Clean fix. The root cause is clear: branch_size was computed before the %-escaping, so the prompt padding was off by one per % in the branch name. Moving the escape to right after git_current_branch so both branch_size and the prompt string use the same escaped value is the correct approach. Minimal change, well explained. LGTM." โ its-Sohan (reviewer)
"LGTM! Thanks!" โ carlosala (maintainer, merged)
I do deep commit-level analysis on actively maintained open source projects โ looking for behavioral contract changes that slip past code review: silent return value mutations, exception scope widening, broken caller assumptions, wrong entity types in API calls.
When I find something real, I report it with a reproducible description and a suggested fix.
Full writeups with code โ oss-findings
| Date | Repo | What | Severity | Status |
|---|---|---|---|---|
| Jul 7 | ohmyzsh/ohmyzsh โญ 175K | PR #13835 โ branch_size computed before %โ%% escaping โ prompt padding off by N spaces per % in branch name โ "Minimal change, well explained. LGTM" โ carlosala |
๐ก Medium | โ Merged |
| Jul 1 | NanmiCoder/MediaCrawler | PR #925 โ IpProxyProvider.get() returns None for unknown provider names โ silently stored, crashes later with AttributeError: 'NoneType' object has no attribute 'get_proxy' โ labeled bug + lgtm by NanmiCoder |
๐ก Medium | โ Merged |
| Jul 1 | calesthio/OpenMontage | PR #227 โ success contract mismatch in CharacterAnimationReviewer โ diverged from visual_qa.py sibling pattern โ merged by calesthio |
๐ก Medium | โ Merged |
| Jun 29 | n8n-io/n8n โญ 194K | PR #32801 โ IPv6 [::1] missing from MCP redirect URI DTO โ admin gets HTTPS-required error even though runtime accepts it โ merged by nikhilkuria โ BIGGEST REPO โ named in v2.29.0 release notes |
๐ก Medium | โ Merged + Release Note |
| Jun 29 | denoland/deno โญ 100K+ | PR #35520 โ BTreeSet::contains byte-exact match misses case-insensitive npm names in trust-policy โ "bug is real and your analysis is spot on" โ bartlomieju |
๐ด High | โ Merged |
| Jun 26 | harry0703/MoneyPrinterTurbo โญ 89K+ | PR #1078 โ youtube_shorts platform name mismatch โ metadata silently dropped on upload |
๐ก Medium | โ Merged |
| Jun 25 | palmier-io/palmier-pro | PR #150 โ CFTypeID guard missing before force cast โ fatal crash on XMEML export |
๐ด High | โ Merged |
| Jun 22 | harry0703/MoneyPrinterTurbo โญ 89K+ | PR #1065 โ match_materials_to_script missing from REST DTO โ chronological term gen unreachable via API |
๐ก Medium | โ Merged |
| Jun 22 | bytedance/deer-flow โญ 75K (ByteDance) | PR #3714 โ _lock defined but never acquired in token budget โ data race on concurrent runs โ merged by WillemJiang โ v2.1.0 release note upcoming |
๐ด High | โ Merged |
| Jun 21 | krillinai/KrillinAI | PR #297 โ Path traversal: API keys readable via /api/file/config/config.toml |
๐ด Critical | โ Merged |
| Jun 18 | affaan-m/ECC โญ 217K | PR #2292 โ find -exec rm bypass via compound commands (&& ; ` |
|
|
| Jun 18 | penpot/penpot | #10279 โ Stale MCP token shown after regeneration โ merged same day into v2.17.0 | ๐ก Medium | โ Merged in v2.17.0 |
| Jun 16 | magento/magento2 | #40882 โ NoSuchEntityException race in InvalidSkuProcessor bulk price API |
๐ด High | โณ PR #40883 |
| Jun 14 | midjourney-api | #294 โ ChannelId used as ServerId in guild API calls |
๐ด High | โณ Open |
| Jun 14 | midjourney-api | #295 โ Dead code in cacheCommand() โ cache never populated |
๐ก Medium | โณ Open |
| Jun 13 | harry0703/MoneyPrinterTurbo โญ 89K+ | PR #1033 โ CLI local source validation gaps | ๐ก Medium | โ Merged |
| Jun 10 | harry0703/MoneyPrinterTurbo โญ 89K+ | #1013 โ Groq model unvalidated on list-fetch failure | ๐ก Medium | โ Fixed PR #1014 |
| Jun 5 | codeceptjs/CodeceptJS | PR #5639 โ --shuffle flag silently ignored after commit #5438 โ named in v4.0.8 release notes |
๐ด High | โ Merged |
| Jun 4 | medusajs/medusa | Discussion #15550 โ Race condition in compensatePaymentIfNeededStep |
๐ด High | ๐ Watching |
| Jun 4 | harry0703/MoneyPrinterTurbo โญ 89K+ | #984 โ Qwen empty choices[] unhandled crash |
๐ด High | โ Fixed PR #994 |
| Jun 4 | Understand-Anything | Discussion โ commit analysis findings | ๐ก Medium | ๐ Watching |
| Repository | Language | Stars | Finding |
|---|---|---|---|
| ohmyzsh/ohmyzsh | Shell | 175K+ | Prompt padding off-by-one from unescaped branch size โ merged โ |
| affaan-m/ECC | JavaScript | 217K+ | Security bypass in gateguard hook โ merged โ |
| penpot/penpot | ClojureScript | 50K+ | Stale MCP token state โ merged in v2.17.0 โ |
| harry0703/MoneyPrinterTurbo | Python | 89K+ | 4 bugs found, 4 fixed |
| medusajs/medusa | TypeScript | 28K+ | Race condition in async workflow step |
| erictik/midjourney-api | TypeScript | 1.8K | 2 bugs found |
| apify/crawlee-python | Python | 9K+ | Silent URL filtering behavior change |
| tox-dev/tox | Python | 4K+ | Config override namespace risk |
| gptme/gptme | Python | 4K+ | LLM routing logic analysis |
| Lum1104/Understand-Anything | Python | โ | Commit analysis findings |
| acacode/swagger-typescript-api | TypeScript | 4K+ | Analyzed โ no actionable findings |
| bagisto/bagisto | PHP | 9.1K+ | 2 security bugs found |
| aws/aws-sam-cli | Python | 6.7K | Analyzed โ no actionable findings |
| codeceptjs/CodeceptJS | JavaScript | 10K+ | shuffle regression โ PR #5639 merged โ |
| magento/magento2 | PHP | 14K+ | NoSuchEntityException race condition in bulk price API |
| NanmiCoder/MediaCrawler | Python | 6K+ | None proxy provider crash โ merged โ
|
Issues Opened โโโโโโโโโโ 20+
PRs Submitted โโโโโโโโโโ 19+
PRs Merged โโโโโโโโโโ 16 โ accepted by maintainers
Discussions โโโโโโโโโโ 2
Repos Analyzed โโโโโโโโโโ 30+
Confirmed Bugs โโโโโโโโโโ 16+
Biggest Merge โโโโโโโโโโ n8n โ 194K stars ๐
Named in Release โโโโโโโโโโ 2 โ CodeceptJS v4.0.8 + n8n v2.29.0 ๐