From c15c5d9ba4c614d4a0025aac9d7b187ab961dc81 Mon Sep 17 00:00:00 2001 From: Jeff Lenamon Date: Fri, 18 Sep 2026 03:49:03 +0000 Subject: [PATCH 1/2] receipts: NVIDIA/go-nvml #207 merged, forty-seven merged patches across thirty-six projects Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WqzM1kt5hbuGjMzGV8SQiJ --- README.md | 9 +++++++-- evals/README.md | 5 +++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4c7726f..f41436e 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Jeffy was run against 132 open-source projec | Projects tested | Converged | Failed | PRs merged | PRs open | Issues filed | |:---:|:---:|:---:|:---:|:---:|:---:| -| **132** | **103** | **28** | **46** | **28** | **4** | +| **132** | **103** | **28** | **47** | **28** | **4** |
@@ -45,7 +45,7 @@ Jeffy was run against 132 open-source projec ## Independent Validation -A merged pull request is the one result Jeffy cannot award itself. It takes an independent maintainer, someone with no stake in this project, to review the patch and accept it into their own codebase. Maintainers have done exactly that 46 times, across 35 open source projects, including those below. +A merged pull request is the one result Jeffy cannot award itself. It takes an independent maintainer, someone with no stake in this project, to review the patch and accept it into their own codebase. Maintainers have done exactly that 47 times, across 36 open source projects, including those below. @@ -125,6 +125,11 @@ A merged pull request is the one result Jeffy cannot award itself. It takes an i + + + + + diff --git a/evals/README.md b/evals/README.md index 46e5347..91d22f2 100644 --- a/evals/README.md +++ b/evals/README.md @@ -4,13 +4,13 @@ Empirical evidence of how an autonomous coding agent performs on real software: | Projects tested | Fixed | Failed | PRs merged | PRs open | Issues filed | |:---:|:---:|:---:|:---:|:---:|:---:| -| **132** | **104** | **28** | **46** | **28** | **4** | +| **132** | **104** | **28** | **47** | **28** | **4** | **Fixed** means the loop's closing audit came back clean and an independent evaluator countersigned it: 103 loop runs converged, plus one audit (PapaParse) held to the same method. That is a standard this repository set and checked itself. A merged pull request is the one outcome it cannot award itself, which is why those rows come first. **Failed** means the project's pre-registered run budget ran out without convergence, or, for one project (libuv), the run was abandoned before it had a budget or a receipt; every one is published. Counted per attempt rather than per project, [ATTEMPTS.md](./ATTEMPTS.md) holds more non-converged rows than this table holds Failed rows, because a project that failed more than once, or converged only on a retry, contributes each attempt. ## Merged upstream -46 patches this loop wrote are merged across 35 projects, because a maintainer with no stake in this project reviewed each one and said yes, and three more findings were fixed upstream by others who read them: +47 patches this loop wrote are merged across 36 projects, because a maintainer with no stake in this project reviewed each one and said yes, and three more findings were fixed upstream by others who read them: - **[bat](https://github.com/sharkdp/bat/pull/3862) - merged.** A just-merged security flag did nothing when piped; caught before it ever shipped. - **[fasthttp](https://github.com/valyala/fasthttp/pull/2343) - merged.** A `Content-Length` no parser should accept became a wrong number. @@ -52,6 +52,7 @@ Empirical evidence of how an autonomous coding agent performs on real software: - **Microsoft, [GSL](https://github.com/microsoft/GSL/pull/1272) - merged.** `dyn_array_iterator` declared `random_access_iterator_tag` but had no `<`, `>`, `<=`, `>=`, `->` or `n + it`, and its default constructor was guarded on `__cpp_lib_ranges`, so `std::sort` over a `dyn_array` did not compile. The relational operators check the same contract as `operator==`, `->` checks the same as `*`, `n + it` forwards to `it + n`, and the default constructor is unconditional; the rework the maintainer asked for makes the iterator satisfy `std::random_access_iterator` and `std::contiguous_iterator` outright, which the tests now assert. Filed on 6 September as a follow-up to #1271; Copilot flagged `nullptr + 0` in `to_address` as undefined behaviour, the reply cited [expr.add], Carson Radtke agreed that Copilot was wrong and merged it on 15 September for the 5.0.1 patch release. - **[money](https://github.com/RubyMoney/money/pull/1227) - merged.** `import_rates(:json, ...)` parsed the file with `JSON.load`, which honours `json_class` keys and instantiates any class carrying a `json_create` hook, while the method's own deprecation warning offered `:json` as the safe alternative to `:ruby`. It now parses with `JSON.parse`, and the new spec fails on main and passes with the change. Filed on 3 September from the corpus run; one maintainer approved the next day and a second approved and merged it on 16 September. - **[money](https://github.com/RubyMoney/money/pull/1228) - merged.** `Currency.reset!` reloaded the table and cleared the instance and iso_numeric caches but not the memoized key set that `Currency.new` gates on, so after a `register`, a lookup and a `reset!`, the removed id was still admitted and `initialize_data!` raised `NoMethodError` where `find` expects `UnknownCurrency`. `reset!` now clears the key set too, and the new spec fails on main and passes with the change. Filed on 3 September beside #1227; the maintainer merged main into the branch herself after #1227 landed and merged it eight minutes later on 16 September. +- **NVIDIA, [go-nvml](https://github.com/NVIDIA/go-nvml/pull/207) - merged.** `DynamicLibrary.Path()` allocated the `dlinfo(RTLD_DI_ORIGIN)` buffer with `C.CBytes(make([]byte, 0, C.PATH_MAX))`, and `C.CBytes` copies `len(b)` bytes, which is zero, so the first `Path()` call on a library opened by soname wrote the library's directory past a zero-byte allocation; with `libdl.so.2` under a 224-character directory on `LD_LIBRARY_PATH`, the process died with SIGSEGV in the next `dlclose`. The slice now carries its full length, and the new `TestPathFromSoname` crashes on main and passes with the change. Filed on 6 September; a maintainer cleared CI on 15 September, tariq1890 asked on 17 September for the commit to be signed as well as signed off, it was signed and rebased with the patch unchanged, he approved the same day and merged it on 18 September. - **[chalk](https://github.com/chalk/chalk/pull/687) - fixed upstream.** The maintainer reproduced the finding, then wrote and merged his own fix, shipped in v6.0.0. - **Cisco, [libsrtp](https://github.com/cisco/libsrtp/issues/822) - fixed upstream.** The committed autotools script appended `--static` to `PKG_CONFIG` unconditionally, so the `AC_SEARCH_LIBS` probes linked every entry of libcrypto's `Libs.private`; on stock Ubuntu that names `-l:libjitterentropy.a`, which no package installs, and `./configure` aborted with `can't find compatible openssl crypto lib` for every OpenSSL build. Filed as an issue rather than a pull request because removing the line narrows the generated `libsrtp3.pc` and the NSS backend takes the same path, which is a maintainer's call, with either patch offered. Another contributor opened [#823](https://github.com/cisco/libsrtp/pull/823) seven hours later citing the issue, deleting the line it named, and the maintainer merged it three days after the report. - **Apache, [casbin](https://github.com/apache/casbin/issues/1752) - fixed upstream.** `SetEquals`, `SetEqualsInt` and `Set2DEquals` sorted both arguments in place, so comparing live policy rows reordered the model itself and later `Enforce` calls returned the wrong answer. Reported with the reproduction and a patch that copies before sorting; the maintainer closed both the issue and the pull request pointing at his own commit 071dce14, which drops the sort entirely for a counting map and is cheaper than what we sent. From c1ddd1a1af367fa96b54dc966ba0b7176c5c2cd5 Mon Sep 17 00:00:00 2001 From: Jeff Lenamon Date: Fri, 18 Sep 2026 04:04:24 +0000 Subject: [PATCH 2/2] readme: NVIDIA leads the Independent Validation table Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WqzM1kt5hbuGjMzGV8SQiJ --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index f41436e..c4cb77d 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,11 @@ A merged pull request is the one result Jeffy cannot award itself. It takes an i + + + + + @@ -125,11 +130,6 @@ A merged pull request is the one result Jeffy cannot award itself. It takes an i - - - - -
commons-codec #443
The Git tree-id builder sorted entries by UTF-16 code units where Git sorts UTF-8 bytes, so a name outside the Basic Multilingual Plane gave a different id from git write-tree		 9 days
NVIDIAgo-nvml #207
The buffer handed to dlinfo for a library's directory was allocated with zero bytes, so the first Path() on a library opened by soname wrote past it and the next dlclose crashed		12 days
Oracle macaron #1466
The build spec dropped the JDK version read from the JAR whenever the artifact recorded no language version		Finding Merged in
NVIDIAgo-nvml #207
The buffer handed to dlinfo for a library's directory was allocated with zero bytes, so the first Path() on a library opened by soname wrote past it and the next dlclose crashed		12 days
Google snappy #257
Every release build compressed a 4 GiB input into a stream whose header claimed 0 bytes		commons-codec #443
The Git tree-id builder sorted entries by UTF-16 code units where Git sorts UTF-8 bytes, so a name outside the Basic Multilingual Plane gave a different id from git write-tree		 9 days
NVIDIAgo-nvml #207
The buffer handed to dlinfo for a library's directory was allocated with zero bytes, so the first Path() on a library opened by soname wrote past it and the next dlclose crashed		12 days
Oracle macaron #1466
The build spec dropped the JDK version read from the JAR whenever the artifact recorded no language version