PR #13835 merged into ohmyzsh/ohmyzsh — 175K+ stars
Bug: c90141e introduced %-escaping in the josh theme — but branch_size was still computed from the raw (unescaped) branch name. For a branch like feat/100%done (13 chars raw), the displayed string feat/100%%done is 14 chars — causing the prompt padding to be off by one space per % in the branch name.
Maintainer feedback:
"Clean fix. The root cause is clear: branch_size was computed before the %-escaping, so the prompt padding was off by one per % in the branch name. Moving the escape to right after git_current_branch so both branch_size and the prompt string use the same escaped value is the correct approach. Minimal change, well explained. LGTM." — its-Sohan (reviewer)
"LGTM! Thanks!" — carlosala (maintainer, merged)
I do deep commit-level analysis on actively maintained open source projects — looking for behavioral contract changes that slip past code review: silent return value mutations, exception scope widening, broken caller assumptions, wrong entity types in API calls.
When I find something real, I report it with a reproducible description and a suggested fix.
Full writeups with code → oss-findings
| Date | Repo | What | Severity | Status |
|---|---|---|---|---|
| Jul 7 | ohmyzsh/ohmyzsh ⭐ 175K | PR #13835 — branch_size computed before %→%% escaping — prompt padding off by N spaces per % in branch name — "Minimal change, well explained. LGTM" — carlosala |
🟡 Medium | ✅ Merged |
| Jul 1 | NanmiCoder/MediaCrawler | PR #925 — IpProxyProvider.get() returns None for unknown provider names — silently stored, crashes later with AttributeError: 'NoneType' object has no attribute 'get_proxy' — labeled bug + lgtm by NanmiCoder |
🟡 Medium | ✅ Merged |
| Jul 1 | calesthio/OpenMontage | PR #227 — success contract mismatch in CharacterAnimationReviewer — diverged from visual_qa.py sibling pattern — merged by calesthio |
🟡 Medium | ✅ Merged |
| Jun 29 | n8n-io/n8n ⭐ 194K | PR #32801 — IPv6 [::1] missing from MCP redirect URI DTO — admin gets HTTPS-required error even though runtime accepts it — merged by nikhilkuria — BIGGEST REPO — named in v2.29.0 release notes |
🟡 Medium | ✅ Merged + Release Note |
| Jun 29 | denoland/deno ⭐ 100K+ | PR #35520 — BTreeSet::contains byte-exact match misses case-insensitive npm names in trust-policy — "bug is real and your analysis is spot on" — bartlomieju |
🔴 High | ✅ Merged |
| Jun 26 | harry0703/MoneyPrinterTurbo ⭐ 89K+ | PR #1078 — youtube_shorts platform name mismatch — metadata silently dropped on upload |
🟡 Medium | ✅ Merged |
| Jun 25 | palmier-io/palmier-pro | PR #150 — CFTypeID guard missing before force cast — fatal crash on XMEML export |
🔴 High | ✅ Merged |
| Jun 22 | harry0703/MoneyPrinterTurbo ⭐ 89K+ | PR #1065 — match_materials_to_script missing from REST DTO — chronological term gen unreachable via API |
🟡 Medium | ✅ Merged |
| Jun 22 | bytedance/deer-flow ⭐ 75K (ByteDance) | PR #3714 — _lock defined but never acquired in token budget — data race on concurrent runs — merged by WillemJiang — v2.1.0 release note upcoming |
🔴 High | ✅ Merged |
| Jun 21 | krillinai/KrillinAI | PR #297 — Path traversal: API keys readable via /api/file/config/config.toml |
🔴 Critical | ✅ Merged |
| Jun 18 | affaan-m/ECC ⭐ 217K | PR #2292 — find -exec rm bypass via compound commands (&& ; ` |
|
|
| Jun 18 | penpot/penpot | #10279 — Stale MCP token shown after regeneration — merged same day into v2.17.0 | 🟡 Medium | ✅ Merged in v2.17.0 |
| Jun 16 | magento/magento2 | #40882 — NoSuchEntityException race in InvalidSkuProcessor bulk price API |
🔴 High | ⏳ PR #40883 |
| Jun 14 | midjourney-api | #294 — ChannelId used as ServerId in guild API calls |
🔴 High | ⏳ Open |
| Jun 14 | midjourney-api | #295 — Dead code in cacheCommand() — cache never populated |
🟡 Medium | ⏳ Open |
| Jun 13 | harry0703/MoneyPrinterTurbo ⭐ 89K+ | PR #1033 — CLI local source validation gaps | 🟡 Medium | ✅ Merged |
| Jun 10 | harry0703/MoneyPrinterTurbo ⭐ 89K+ | #1013 — Groq model unvalidated on list-fetch failure | 🟡 Medium | ✅ Fixed PR #1014 |
| Jun 5 | codeceptjs/CodeceptJS | PR #5639 — --shuffle flag silently ignored after commit #5438 — named in v4.0.8 release notes |
🔴 High | ✅ Merged |
| Jun 4 | medusajs/medusa | Discussion #15550 — Race condition in compensatePaymentIfNeededStep |
🔴 High | 👀 Watching |
| Jun 4 | harry0703/MoneyPrinterTurbo ⭐ 89K+ | #984 — Qwen empty choices[] unhandled crash |
🔴 High | ✅ Fixed PR #994 |
| Jun 4 | Understand-Anything | Discussion — commit analysis findings | 🟡 Medium | 👀 Watching |
| Repository | Language | Stars | Finding |
|---|---|---|---|
| ohmyzsh/ohmyzsh | Shell | 175K+ | Prompt padding off-by-one from unescaped branch size — merged ✅ |
| affaan-m/ECC | JavaScript | 217K+ | Security bypass in gateguard hook — merged ✅ |
| penpot/penpot | ClojureScript | 50K+ | Stale MCP token state — merged in v2.17.0 ✅ |
| harry0703/MoneyPrinterTurbo | Python | 89K+ | 4 bugs found, 4 fixed |
| medusajs/medusa | TypeScript | 28K+ | Race condition in async workflow step |
| erictik/midjourney-api | TypeScript | 1.8K | 2 bugs found |
| apify/crawlee-python | Python | 9K+ | Silent URL filtering behavior change |
| tox-dev/tox | Python | 4K+ | Config override namespace risk |
| gptme/gptme | Python | 4K+ | LLM routing logic analysis |
| Lum1104/Understand-Anything | Python | — | Commit analysis findings |
| acacode/swagger-typescript-api | TypeScript | 4K+ | Analyzed — no actionable findings |
| bagisto/bagisto | PHP | 9.1K+ | 2 security bugs found |
| aws/aws-sam-cli | Python | 6.7K | Analyzed — no actionable findings |
| codeceptjs/CodeceptJS | JavaScript | 10K+ | shuffle regression — PR #5639 merged ✅ |
| magento/magento2 | PHP | 14K+ | NoSuchEntityException race condition in bulk price API |
| NanmiCoder/MediaCrawler | Python | 6K+ | None proxy provider crash — merged ✅ |
Issues Opened ██████████ 20+
PRs Submitted ████████░░ 19+
PRs Merged ████████░░ 16 ← accepted by maintainers
Discussions ██░░░░░░░░ 2
Repos Analyzed ██████████ 30+
Confirmed Bugs ██████████ 16+
Biggest Merge ██████████ n8n — 194K stars 🏆
Named in Release ██░░░░░░░░ 2 ← CodeceptJS v4.0.8 + n8n v2.29.0 🏆