Hey. I am Aniruddha Adak.

A final year computer science student coding from a hostel room in West Bengal.

Two years ago, I was staring at a blank terminal. I was trying to understand how Git actually worked. I was terrified of merge conflicts.

Today, I am looking back at 348 merged pull requests across dozens of repositories.

Open source completely changed how I write code.

But for the DEV Summer Bug Smash, I do not want to talk about the easy wins. I want to share a real Smash Story.

I want to talk about the chaos.

Here are the 11 critical bugs across modern AI and web frameworks that forced me to become a better software engineer.

The Windows Curse

Bugs in open source rarely look like simple syntax errors. They look like complete system failures.

While contributing to advanced Graph RAG tools like cognee and AI frameworks like openclaw, I noticed a silent killer.

Most maintainers build on Unix systems. They use Mac. They use Linux.

Windows users are often left in the dark.

🐞 In cognee, users were facing a chaotic OS Error 3. Windows was struggling with long file paths during dataset context resolution. It completely broke the local database integration.

I dove into the LanceDB integration and wrote a fix to automatically prefix Windows paths. This bypassed the legacy path limits.

Closes #2941

This PR automatically normalizes and prefixes absolute Windows paths for the vector_db_url when using local filesystem storage. This resolves OS Error 3 triggered by LanceDB subprocesses when generating long file paths for persisting vector data on Windows.

posted on

The Silent AI Crashes

AI agents are powerful. But they are incredibly fragile when they receive unexpected data.

🦗 In the hermes-agent repository, I found a bug where the system would panic if an API returned an empty response. I implemented a fix to handle None responses gracefully from the ACP permission requests.

What does this PR do?

This PR hardens the ACP ? Hermes permission-approval bridge by safely handling an unexpected None result from
equest_permission, preventing attribute errors and defaulting to a safe deny.

Related Issue

Fixes #13449

Type of Change

• [x] ?? Bug fix (non-breaking change that fixes an issue)


• [ ] ? New feature (non-breaking change that adds functionality)


• [ ] ?? Security fix


• [ ] ?? Documentation update


• [x] ? Tests (adding or improving test coverage)


• [ ] ?? Refactor (no behavior change)


• [ ] ?? New skill (bundled or hub)

Changes Made

• Return "deny" when
  equest_permission resolves to None in the approval callback.


• Add a unit test covering the None response case to ensure the callback denies safely.

How to Test

1. Connect via an ACP client that sends an empty response to permission requests.


2. Verify the permission is denied rather than throwing an exception.

Checklist

Code

• [x] I've read the Contributing Guide


• [x] My commit messages follow Conventional Commits


• [x] I searched for existing PRs to make sure this isn't a duplicate


• [x] My PR contains only changes related to this fix/feature (no unrelated commits)


• [x] I've run pytest tests/ -q and all tests pass


• [x] I've added tests for my changes (required for bug fixes, strongly encouraged for features)


• [x] I've tested on my platform

Documentation & Housekeeping

• [x] I've updated relevant documentation (README, docs/, docstrings) � or N/A


• [x] I've updated cli-config.yaml.example if I added/changed config keys � or N/A


• [x] I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows � or N/A


• [x] I've considered cross-platform impact (Windows, macOS) per the compatibility guide � or N/A


• [x] I've updated tool descriptions/schemas if I changed tool behavior � or N/A

posted on

🪰 Second, I found a vulnerability where global settings were exposed and public registration was left wide open. I locked it down.

Closes #3084

This PR addresses the security vulnerabilities reported in #3084:

• Requires superuser privileges for POST /api/v1/settings to prevent global configuration takeover.


• Fully masks LLM and VectorDB API keys in GET /api/v1/settings to prevent leaking key prefixes.


• Adds a COGNEE_PUBLIC_REGISTRATION_ENABLED environment variable to allow administrators to disable public self-registration.

posted on

🐛 Batch 3 Edge Cases: I patched another layer of database failures.

Resolves #606, resolves #607, resolves #608, resolves #609, resolves #610. Expands the _build_database_directive() function to correctly train the LLM to identify Compositional Faults (treating simultaneous CPU and Storage constraints as independent sources while filtering out connection bounds), infer replication lag from bare WAL metrics despite missing Replica metrics, accurately ignore historical maintenance distractions via timestamps, identify stale autoscaling recovery, and distinguish VACUUM-driven Checkpoint Storms.

posted on

🪳 Validation Status: I fixed a critical bug by including eks_* keys so the system could correctly identify a healthy state.

Fixes #582

Type of Change

• [x] Bug fix (non-breaking change which fixes an issue)


• [ ] New feature (non-breaking change which adds functionality)


• [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)


• [ ] This change requires a documentation update

What changed and why

The is_clearly_healthy() short-circuit relies on the presence of keys in _INVESTIGATED_EVIDENCE_KEYS to verify that an investigation collected evidence. This set was missing all Kubernetes / EKS keys. Because of this gap, investigations finding pure-Kubernetes workloads in a healthy state missed the short-circuit and incorrectly ran the root cause LLM.

This PR adds the missing EKS investigation keys (eks_pods, eks_events, eks_deployments, eks_node_health, eks_pod_logs) to _INVESTIGATED_EVIDENCE_KEYS.

Note: This relies on the changes from #581 where the EKS mappers populate these keys in state["evidence"].

Testing steps with evidence

• Added parameterized unit tests in tests/nodes/root_cause_diagnosis/test_evidence_checker.py.


• Tested the is_clearly_healthy function directly, ensuring pure-EKS healthy configurations return True, mixed outputs return True, and an unhealthy state correctly blocks it returning False.

Impact analysis

• 
  Backward Compatibility: Yes, fully compatible.


• 
  Breaking Changes: None. This saves redundant reasoning LLM tokens and time.

AI-Assisted Contribution

• [x] I have reviewed every line of code.


• [x] I understand the logic.


• [x] I have tested edge cases.


• [x] I have verified the code matches the project conventions.

posted on

The Ghost in the UI

Sometimes the most annoying bugs are the ones the user stares at directly.

🪰 In openclaw, the configuration wizard would just look broken if a user had no skills set up. It was a blank void. I jumped into the frontend and built an empty state notice to guide the user forward.

Summary

• Rebase the skills wizard empty-state fix onto current main.


• Show an explicit all-ready note when skill setup has no missing dependencies to install.


• Add localized title copy and focused regression coverage.

Real behavior proof

Behavior addressed: setupSkills() could show the status summary, ask to configure skills, and then exit without any next-step note when every non-blocked skill was already eligible and no requirements were missing.
Real environment tested: local OpenClaw source checkout on macOS, Node/pnpm repo runtime, with a temporary OPENCLAW_HOME and the production skills status/setup path exercised directly through node --import tsx.
Exact steps or command run after this patch: OPENCLAW_HOME=$(mktemp -d) TMP_WS=$(mktemp -d) node --import tsx --input-type=module probe that builds real workspace skill status, disables the few missing non-blocked local skills to create the all-ready state, then calls setupSkills() with a recording prompter.
Evidence after fix:

{

  "disabledMissingSkills": [

    "qqbot-channel",

    "qqbot-media",

    "qqbot-remind"

  ],

  "finalNote": {

    "title": "All skills ready",

    "message": "No missing skill dependencies to install.\nTo inspect available skills, run: openclaw skills list --verbose\nTo check skill status, run: openclaw skills check"

  }

}

Observed result after fix: the wizard emits an All skills ready note with openclaw skills list --verbose and openclaw skills check, does not show dependency multiselect, and does not call the installer.
What was not tested: no manual interactive terminal wizard session; the direct probe exercises the production setup path with a recording prompter, and the focused test covers the exact prompter calls.

Verification

• pnpm test src/commands/onboard-skills.test.ts


• pnpm check:test-types


• git diff --check


• Auto Review: clean, no accepted/actionable findings.

powered by Sentry.

Let us keep creating in the open.

Vollständiger Original-Bericht

Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

↗ Original-Artikel auf dev.to lesen

Wie bewertest du diesen Beitrag?

1 Klick Feedback

Hot 0 ️ Patch Now 0 Hilfreich 0 🤔 Diskutieren 0

Teilen mit Netzwerk & Team:

𝕏 Twitter 💼 LinkedIn 🦋 Bluesky WhatsApp Slack / Teams 👥 Team-Invite Link kopieren 📸 Social Card

Hat Ihnen dieser Tipp / Anleitung geholfen?

👍 Ja, hilfreich! Feedback geben

Community-Analysen & Experten-Meinungen 0

Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.

Eigene Analyse verfassen

Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf „ Eigene Analyse verfassen“!

Beitrag teilen Kopieren

Feedback Experten-Votum

Hot 0 ️ Patch 0 Hilfreich 0 Top 0

🔴 Akute Relevanz 🟡 In Evaluierung 🟢 Keine Auswirkung

Community Pulse: Relevanz-Einschätzung

1 Klick Experten-Votum

🔴 Akute Relevanz

🟡 In Evaluierung

🟢 Keine Auswirkung

Spannende Innovation

🔴 Akute Relevanz 0%

🟡 In Evaluierung 0%

🟢 Keine Auswirkung 0%

Spannende Innovation 0%

Verwandte Story-Cluster & Quellen (Vektor-KI)

Port 8095 Engine

1 Quelle

Hackers Just Poisoned the Rust Supply Chain | Threat Wire

↗ Analyse öffnen

1 Quelle

Hackers Found a Way Into Humanoid Robots | Threat Wire

↗ Analyse öffnen

1 Quelle

Bits und so #1021 (Passwort für Laufwerk)

↗ Analyse öffnen

◀ VORHERIGER BEITRAG 4 Min

Adobe schließt über 80 Sicherheitslücken in Cold Fusion, Premiere & Co

2

NÄCHSTER BEITRAG 2 Min

OpenAI’s First AI Device Reportedly Revealed, and It’s Not What Most Expected

23 Weiterlesen ▶

Tipp: Mit Pfeiltasten [ ← ] und [ → ] blättern