惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
V
V2EX
WordPress大学
WordPress大学
U
Unit 42
I
InfoQ
A
About on SuperTechFans
宝玉的分享
宝玉的分享
J
Java Code Geeks
博客园 - 司徒正美
爱范儿
爱范儿
Engineering at Meta
Engineering at Meta
G
Google Developers Blog
人人都是产品经理
人人都是产品经理
小众软件
小众软件
Microsoft Security Blog
Microsoft Security Blog
L
LangChain Blog
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
Hugging Face - Blog
Hugging Face - Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
aimingoo的专栏
aimingoo的专栏
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
Last Week in AI
Last Week in AI
腾讯CDC
Recent Announcements
Recent Announcements

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant
"I Found ~30 Mergeable OSS Bugs in a Day. They Were All t...
greymoth · 2026-06-26 · via DEV Community

greymoth

Yesterday I shipped around 28 pull requests across real repos — zod, NestJS, Fastify, Scrapy, Pygments, others. Not spam. Not docs typos. Actual behavioral fixes that got merged or are pending review.

The method has a name now. I'm calling it sibling-leftover.

What sibling-leftover actually is

When a maintainer merges a PR that fixes something in one area, they're implicitly approving the intent. But if the fix touched only one of two symmetric branches in the code — and left the sibling untouched — there's a window. The maintainer already agreed the behavior was wrong. The fix pattern is already in-tree. You're not arguing a new position; you're completing a sentence they started.

The leftover sibling is almost always a bug. Not always a serious one. But it's real.

Two concrete examples

zod #5945 → #6141

zod #5945 fixed cidrv4 validation. The PR landed. Closed. Merged. I looked at the diff and noticed cidrv6 sat right next to it in the same file, same logic shape, no corresponding fix. Opened #6141 targeting ipv6. The maintainer already understood the problem domain; the test pattern was already established. Merge friction: near zero.

NestJS #17188 → #17207

NestJS #17188 fixed a behavior in the WebSockets transport. Adjacent in the codebase: the microservices transport, same underlying issue. #17207. Same shape, different branch. I didn't have to explain why something was wrong — the merged PR did that for me.

This is the pattern. One fix → locate its symmetric counterpart → ship the mirror.

Why merge rates are high

Three reasons stack:

  1. Domain approval is already in. The maintainer accepted that this class of bug exists. They didn't reject the premise, they fixed it. You're not asking them to believe something new.

  2. Test infrastructure exists. The first PR almost always adds or modifies tests. Your fix can follow the same structure, in the same file, targeting the sibling case. Reviewers don't have to imagine what passing looks like.

  3. The diff is small and symmetric. A small, obviously correct diff in a familiar area is much easier to approve than a large refactor. Cognitive load for the reviewer is low.

How to run this yourself

Step one: find recently merged PRs in repos you care about. GitHub search — is:pr is:merged sort:updated — works. Filter by the last 30-60 days.

Step two: read the diff. Look for constants, enum branches, transport names, protocol variants, format handlers — anything where the code obviously has siblings. cidrv4/cidrv6. websockets/microservices. rgb/rgba. http/https. These pairs are everywhere.

Step three: grep the repo for the sibling. Confirm it has the same bug pattern. Write the fix following the same style as the merged PR — same variable naming, same test shape.

Step four: open the PR. Reference the original merged fix explicitly. "This mirrors #XXXX which fixed the same issue in [sibling]. Applying the same approach here." That sentence alone cuts review time.

What this is not

It's not cherry-picking trivially obvious things to pad a contribution count. Some of the fixes I found were non-trivial — the sibling had slightly different logic that required careful adaptation. A few I dropped because the behavior divergence was intentional and I wasn't sure.

The method is a search strategy, not a guarantee. You still have to read the code. You still have to understand why the original fix was correct. The frame just tells you where to look.

One thing I'll keep doing

Before I look for new bug categories, I now scan the merged PRs from the last week in repos I'm watching. It's maybe 20 minutes. The hit rate — "this fix has an unaddressed sibling" — is surprisingly high. My rough estimate from yesterday: about 40% of format/transport/protocol-related fixes leave something behind.

The bugs are there. They're findable. The method is repeatable.