Everything we've shippedupstream, and everythingwe've shipped ourselves.

A RegExp route matcher advanced its own lastIndex on every request, so consecutive URLs alternated between matching and missing — and the wrong answer was cached for the process's lifetime.

Wildcard cache invalidation compiled the key straight into a regular expression, so a key containing a dot, bracket or second asterisk matched — or deleted — the wrong entries.

Same root cause reachable through CORS configuration — a /g or /y origin pattern alternates between allowing and blocking valid requests.

A workflow step still waiting out a retry interval could get invoked a second time after its transaction had already committed to unwinding everything else — the retry check looked only at the step's own status, never at the flow's.

Writing off or reinstating a claimed order line validated against the item's original ordered quantity instead of what was actually left to claim or give back — letting two claims each write off the full quantity, or a reinstate push the balance negative.

Moving an inventory reservation to a new location skipped the destination's availability check entirely and never decremented the source location's reserved quantity, since the code only knew how to validate a same-location quantity change.

A cart's second combinable tax line for the same item silently overwrote the first on recalculation — the upsert matched existing rows by item alone, with nothing to tell two tax lines on one item apart.

A buy-get promotion's max-quantity cap only checked against earlier rounds' totals, never against what its own round had already committed to — a round fragmented across several target items could blow straight past the cap.

A transaction-checkpoint merge check turned out to be provably unreachable dead code — filed as an issue rather than a guess, since the fix depends on concurrent-execution semantics not confidently inferable from the surrounding code alone.

Editing an order line's price, with nothing else changed, still re-reserved its full quantity as if none of it were fulfilled — and if that failed, the workflow's own rollback resurrected reservations fulfillment had already consumed, with no ceiling.

A base class method's own signature didn't match the only call it ever receives — closed by the repo's contributor-vouching bot before review, not for being wrong.

A loop's exit condition was computed once and never re-checked — real, but smaller than first reported; verified by reproduction that it doesn't change what renders, only how much work it wastes getting there.

Five yearly reports labelled their columns by a fiscal year's end date instead of its name — erpnext doesn't accept outside pull requests, so this shipped as a branch link on the issue instead.

A version-check call that only exists on newer Frappe threw a server-side error on every navigation on older sites — silently caught, so the failure had no diagnostic trail at all.

Independently verified a contributor's fix for a leave-balance miscalculation before it duplicated as a competing PR — confirmed correct and more complete than the fix we were about to write ourselves.

A table column literally named "count" was indistinguishable from the app's own synthetic "count every row" measure, so counting it silently counted an unrelated column instead.

A repayment schedule's date stopped advancing and every row landed on the same day whenever a Loan Product's schedule-type field was left at its blank default — a real bug, but a different one than the issue itself described.

frappe._(...) could never work inside a Page Data Script no matter where _ was assigned — the sandbox's attribute guard rejects any name starting with an underscore before it even looks at what it resolves to.

Two rapid clicks on "Get Certificate" could both pass the not-certified-yet check before either saved, producing duplicate certificate rows — closed with a DB-level unique constraint after review caught a NULL-vs-empty-string gap in the first version.

get-app truncated any repo name containing a dot down to whatever came before the first one — this repo restricts PR creation to existing collaborators, so the tested fix went up as a comment on the existing issue with a link to the branch instead.

The built-in ERPNext node duplicated a row at every page boundary past 1,000 records, and crashed before making a request if Options was touched without adding a filter.

The ERPNext node's own friendly-error guard for an empty Properties field crashed instead of firing — the field's real default is {}, not the populated shape the guard assumed, so it threw a raw TypeError before its own error message could.

The import path panicked on any os.Stat failure other than "file does not exist" — a permissions error or a broken symlink took down the whole import instead of surfacing as a normal error.

Passwords were never Unicode-normalized before hashing or comparing them, so a password typed with a precomposed accent on one device could fail to verify on another device producing the decomposed form of the same character.

The webapp only suggested "first last" name matches for an @-mention, so the server's own order-independent search returned a match the client-side filter then silently dropped.

A Telegram error handler assumed every non-2xx response parsed to a JSON object, so a response that parsed to null, a string or an array crashed instead of marking the message failed.

A content-attribute validator crashed outright on a nil or malformed items list, and the crash cascaded into sibling validators that should have run independently of it.

A label's title validator used a regex anchor that tolerates a trailing newline — the same class of mistake already fixed once elsewhere in the codebase, on a phone-number field.

A Twilio call endpoint has no guard of its own against being hit outside an active call context and 500s if it is — filed with an explicit caveat that the exact UI trigger from the report couldn't be reproduced.

Team, Agent and Inbox summary reports mix two different timestamp columns within the same row — filed as a finding rather than a fix, since which one is "correct" is genuinely ambiguous.

An automation rule's webhook fired against a conversation's stale triggering message under a race, sending the wrong message content — root-caused after an earlier pass had only gotten as far as "plausible."

A workflow's Find Records step aborted the entire run when a filter's variable resolved to a legitimate null — an optional relation simply not being set — instead of correctly matching zero records.

Every workflow step carries a "continue on failure" setting, but the executor only ever read it inside iterator loops, so a failing step outside one aborted the whole run regardless of what it was set to.

A database-event trigger's watched-fields filter was silently ignored on upsert events, so a logic function watching one field that also wrote back other fields on the same record could re-trigger itself forever.

SSO login silently assumed every identity provider signs id_tokens with RS256 instead of reading what the provider's own discovery document actually advertised, breaking login for any provider whose default is something else.

Manually removing a contact from a segment deleted the membership row outright instead of flagging it, so the next segment rebuild silently re-added the same contact the removal was meant to keep out.

A value set in .env or .env.local was silently overridden by the derived local.php config, while an identically-named real environment variable was correctly protected from that same override.

Saving a segment filter on a multiselect field with "Including ALL" or "Excluding ALL" crashed on save — the form only marked the field multi-value for the plain in/not-in operators, missing both ALL variants.

Sorting or paginating the Tags list re-rendered a second, nested copy of the search toolbar on every ajax refresh — the one list template in the codebase missing the same-request guard every other entity list already had.