AI & Agent Dev Bug SandboxDefensive Tech Intelligence

Drop in an error log

Name: AI & Agent Dev Bug Sandbox
Creator: AI & Agent Dev Bug Sandbox

A sourced fix-playbook workspace for AI and agent engineers. Find the root cause, the affected version, the rollback-safe next step, and edge-case audits.

Active Intelligence Feed

medium85%

Docs: RLS guide GRANT examples are no-op; TRUNCATE bypasses RLS and default grants expose it

The Supabase RLS documentation instructs users to grant SELECT/INSERT/UPDATE/DELETE to anon/authenticated after creating tables in the public schema, but these privileges are already granted by default. The actual required action—revoking the overbroad default grants—is missing. Additionally, TRUNCATE is included in the default grant and is not blocked by RLS, creating a silent security gap where authenticated or anonymous roles could wipe table data if a direct database path is available.

Supabase

medium95%

Telemetry request ignores built-in timeout when caller signal is provided

When `next build` supplies a cancellation signal to the telemetry POST request, the built-in five-second timeout is not applied. This allows stalled telemetry endpoints to block the build for far longer than intended (e.g., 20-45 seconds) because only the caller's signal is used, which normally does not fire during a local build.

V16.2.6 V16.3.0-Canary.97 Next.js

medium95%

Telemetry _controller is always undefined due to Promise identity loss in record(), so flushDetached's abort is a silent no-op

In Telemetry.record(), the promise stored in this.queue is the result of chaining .then().catch().then() on the promise returned by submitRecord(). Because .then()/.catch() return new Promise objects and do not copy custom properties, the final promise never has the _controller property that submitRecord() attached to its returned promise. The line (prom as any)._controller = (prom as any)._controller is a no-op. Consequently, flushDetached() always sees item._controller as undefined, making the abort() call a silent no-op.

V16.3.0-Canary.97 Next.js

medium95%

pg-meta pg-format: arrayToList useSpace flag is dead, causing stray leading space for nested arrays

The useSpace flag in arrayToList is ignored because both ternary branches are identical, resulting in an extra leading space when formatting nested arrays that appear as the first element. This diverges from upstream pg-format and can affect exact string comparisons in SQL generation.

Pg-Meta

medium75%

Route group layout leaks into root `not-found` page

When `notFound()` is called inside a nested route that belongs to a route group, the root `not-found` page incorrectly renders inside the route group's layout instead of only within the root layout.

V16.3.0-Preview.10 Next.js

medium65%

Windows: pnpm dev fails due to Unix-style NODE_OPTIONS environment variable assignment in package.json scripts

Running `pnpm dev` on Windows 11 fails because Supabase monorepo scripts use inline `NODE_OPTIONS=...` syntax, which is interpreted as a command by cmd.exe, producing `NODE_OPTIONS is not recognized as an internal or external command`. This blocks local development for Windows contributors.

Supabase

medium70%

Turbopack dev: computed next/dynamic RSC loaders with client descendants fail under cacheComponents

In Next.js 16.3.0 and 16.3.1-canary.1, enabling `cacheComponents` in Turbopack dev causes a module factory error for client reference proxies when using computed `next/dynamic` loaders that render Server Components with Client Component descendants. The error occurs after HMR, while full page reload does not trigger it.

V16.3.0 V16.3.1-Canary.1 Next.js

medium80%

Turbopack HMR fails to update server component using singleton registry on macOS

When using a singleton pattern to register server components, Turbopack HMR does not update the content in the browser, while webpack works correctly. The issue occurs on macOS with Next.js 16.3.0.

V16.3.0 Next.js

medium90%

pg-meta functions read-path schemas reject procedures with null return_type

The pg-meta functions API creates procedures with a null return_type, but its row schema expects a non-null string, causing ZodError on functions.list() and functions.retrieve() when procedures are present.

Supabase Pg-Meta

medium92%

Inconsistent environment variable naming between Supabase Connect panel and Flask quickstart documentation

The Supabase Connect panel generates .env templates using SUPABASE_KEY, while the Flask quickstart documentation and supabase-py client expect SUPABASE_PUBLISHABLE_KEY. This mismatch causes authentication failures (supabase_key is required) for users following the Connect panel instructions.

Supabase

medium95%

react-user-management example App.jsx missing import/export sections causing module load error

The React quickstart example in the Supabase documentation and the GitHub example repo omits the necessary import statements and default export, leading to a runtime Uncaught SyntaxError because main.jsx expects a default export. This is a documentation/code snippet inconsistency introduced by PR #45539.

React

medium65%

SQL Editor misleadingly shows '0 rows' for UPDATE/DELETE statements

The SQL Editor's results panel displays '0 rows' and 'Success. No rows returned.' after executing UPDATE or DELETE statements that affect rows but do not return them, because it only inspects the length of the returned rows array and ignores PostgreSQL's command tag and row count.

Next.js

medium78%

`@next/playwright instant()` clears testing cookies for other origins

The @next/playwright instant() helper removes the next-instant-navigation-testing cookie for all origins in a shared Playwright BrowserContext, instead of only the application URL it is controlling. This breaks multi-origin test scenarios where app B's testing cookie is deleted when instant() is called for app A.

V16.3.1-Canary.8 Next.js

medium78%

Segment cache: sibling PPR route prefetches are permanently dropped after same-tick batch

Batching router.prefetch calls for multiple slugs of a PPR route in the same tick causes the first-scheduled sibling to be deferred by the 4-request bandwidth cap. When bandwidth frees, the sibling incorrectly resolves against the fallback route entry populated by other completed prefetches instead of fetching its own per-URL segment. Subsequent prefetches become permanent no-ops, forcing full dynamic navigation for the affected slug.

V16.3.0 V16.3.1-Canary.8 Next.js

medium95%

Update OAuth docs page: fix method names and response shape

The OAuth flows documentation contains outdated code samples that reference a non-existent method `getUserGrants()`, pass a positional string to `revokeGrant()`, and show an incorrect flat response shape. Actual SDK uses `listGrants()`, `revokeGrant({ clientId })`, and nested OAuthGrant type with `granted_at`. Following the docs leads to runtime TypeErrors and undefined fields.

V2.112.2 Supabase

medium90%

reasoning_content is not streamed when response_format=json_object (aggregated into a single chunk)

ChatDeepSeek with response_format=json_object streams reasoning_content as one aggregated chunk because langchain-openai uses the beta streaming helper when response_format is present, which buffers the full response.

Vlangchain-Openai==1.4.0 Vlangchain-Deepseek==1.1.0 Langchain

medium75%

Cron job status not refreshed after toggle in dashboard

In the Supabase dashboard, toggling a cron job's enabled/disabled switch from the table triggers a modal and a refresh, but the displayed status remains unchanged until the user manually clicks the refresh button at the top of the table.

React

medium92%

Turbopack build panic misattributes NUL-byte env error to CSS module

On Windows, a malformed inherited environment variable containing a NUL byte causes Turbopack to fail with a panic that incorrectly points to an unrelated CSS module, hiding the actionable environment variable name.

V16.3.1-Canary.12 Next.js

medium90%

Studio policy editor emits invalid empty `WITH CHECK` clause for non-INSERT policies

The Supabase Studio RLS policy editor generated a PostgreSQL policy with a trailing `with check ( )` clause for a SELECT policy, causing a syntax error and preventing the policy from being created.

React

medium95%

Homepage Vue quickstart link leads to 404 due to incorrect URL slug

The homepage's "Read docs for Vue" button uses the URL /docs/guides/getting-started/quickstarts/vuejs, but the correct slug is /vue, causing a 404 error and poor onboarding experience.

Next.js

medium75%

Update MessageBird verification docs to Bird branding and integration details

Supabase phone login documentation still references legacy MessageBird product and endpoints, causing user confusion; official Bird (MessageBird) updates are available in auth PRs #2684 and #2685.

Supabase

medium85%

Contributing docs missing required pnpm build step before pnpm dev on fresh clone

The Next.js contributing guide does not instruct contributors to run `pnpm build` before `pnpm dev`. On a fresh clone, `pnpm dev` fails due to missing generated artifacts, leading to cascading module not found and TypeScript errors.

V16.3.1-Canary.22 Next.js

medium95%

Route export validation rejects string literal union params in layouts and pages

Next.js generated ParamMap widens dynamic segment values to string, ignoring the return type of generateStaticParams even when dynamicParams is false. This causes components (layouts/pages) that declare narrower types such as 'en' | 'de' to fail type validation during build, despite correct runtime behavior.

V15.5.0 V16.3.1 Next.js

medium95%

langchain-profiles refresh corrupts strings containing JSON literal substrings

`langchain-model-profiles` CLI `refresh` performs global string replacements (`true`->`True`, `false`->`False`, `null`->`None`) on a `json.dumps` result, corrupting quoted JSON keys and values that contain those substrings. The generated `_profiles.py` still imports successfully but with silently altered profile data.

V0.0.6 Langchain

medium97%

Fix singleton tuple config handling in _ConfigurableModel.batch_as_completed

`_ConfigurableModel.batch_as_completed` and `abatch_as_completed` incorrectly reject singleton tuple configs, causing an AttributeError despite the annotated `Sequence[RunnableConfig]` contract. The code checks only for `list`, not the abstract `Sequence`, so non-list sequences are passed to `ensure_config` unnormalized.

V1.3.15 Langchain

medium98%

core: ImagePromptValue cannot be deserialized while sibling prompt values can

ImagePromptValue is marked serializable and dumps() succeeds, but loads() fails because the class is absent from both deserialization allowlists (legacy langchain and langchain_core namespaces) in langchain_core/load/mapping.py. Its three sibling prompt values all round-trip correctly.

V1.6.0 Langchain-Core

medium95%

RunnableParallel.get_input_schema rejects inputs that invoke accepts due to Pydantic v2 root field name mismatch

RunnableParallel.get_input_schema merges step input schemas but fails to exclude the Pydantic v2 root model synthetic field 'root', causing the returned schema to reject every valid input that invoke accepts when any step is RunnablePassthrough or unannotated RunnableLambda.

V1.6.0 Langchain

medium95%

core: create_image_block does not enforce the mime_type requirement its docstring declares

`create_image_block` in langchain-core accepts base64 data without a `mime_type`, unlike its siblings `create_video_block`, `create_audio_block`, and `create_file_block`. This produces blocks that cannot be converted to valid provider payloads and violates the function's documented contract.

V1.6.0 Langchain

medium95%

Docs: Google nonce example declares hashedNonce inside promise callback causing ReferenceError and potential security bypass

The Supabase Google login documentation contains a code snippet where hashedNonce is declared inside a .then() callback, making it inaccessible outside the callback. Users following the guide encounter a ReferenceError when trying to use hashedNonce, and may skip the nonce or pass the raw nonce to both Google and Supabase, reducing security.

Supabase Auth

medium98%

core: `DictPromptTemplate.aformat` is never called — the async prompt path uses sync `format`

In `_MultiModalMessagePromptTemplate.aformat`, the `DictPromptTemplate` branch incorrectly calls the synchronous `format()` instead of awaiting `aformat()`. This means any subclass overriding `aformat` is silently bypassed on the async path, breaking consistency with the sibling `StringPromptTemplate` and `ImagePromptTemplate` branches which correctly await their async variants.

V1.6.0 Langchain-Core

Active Intelligence Feed🟢🟢🟢

Docs: RLS guide GRANT examples are no-op; TRUNCATE bypasses RLS and default grants expose it

Telemetry request ignores built-in timeout when caller signal is provided

Telemetry _controller is always undefined due to Promise identity loss in record(), so flushDetached's abort is a silent no-op

pg-meta pg-format: arrayToList useSpace flag is dead, causing stray leading space for nested arrays

Route group layout leaks into root `not-found` page

Windows: pnpm dev fails due to Unix-style NODE_OPTIONS environment variable assignment in package.json scripts

Turbopack dev: computed next/dynamic RSC loaders with client descendants fail under cacheComponents

Turbopack HMR fails to update server component using singleton registry on macOS

pg-meta functions read-path schemas reject procedures with null return_type

Inconsistent environment variable naming between Supabase Connect panel and Flask quickstart documentation

react-user-management example App.jsx missing import/export sections causing module load error

SQL Editor misleadingly shows '0 rows' for UPDATE/DELETE statements

`@next/playwright instant()` clears testing cookies for other origins

Segment cache: sibling PPR route prefetches are permanently dropped after same-tick batch

Update OAuth docs page: fix method names and response shape

reasoning_content is not streamed when response_format=json_object (aggregated into a single chunk)

Cron job status not refreshed after toggle in dashboard

Turbopack build panic misattributes NUL-byte env error to CSS module

Studio policy editor emits invalid empty `WITH CHECK` clause for non-INSERT policies

Homepage Vue quickstart link leads to 404 due to incorrect URL slug

Update MessageBird verification docs to Bird branding and integration details

Contributing docs missing required pnpm build step before pnpm dev on fresh clone

Route export validation rejects string literal union params in layouts and pages

langchain-profiles refresh corrupts strings containing JSON literal substrings

Fix singleton tuple config handling in _ConfigurableModel.batch_as_completed

core: ImagePromptValue cannot be deserialized while sibling prompt values can

RunnableParallel.get_input_schema rejects inputs that invoke accepts due to Pydantic v2 root field name mismatch

core: create_image_block does not enforce the mime_type requirement its docstring declares

Docs: Google nonce example declares hashedNonce inside promise callback causing ReferenceError and potential security bypass

core: `DictPromptTemplate.aformat` is never called — the async prompt path uses sync `format`

Docs: RLS guide GRANT examples are no-op; TRUNCATE bypasses RLS and default grants expose it

Telemetry request ignores built-in timeout when caller signal is provided

Telemetry _controller is always undefined due to Promise identity loss in record(), so flushDetached's abort is a silent no-op

pg-meta pg-format: arrayToList useSpace flag is dead, causing stray leading space for nested arrays

Route group layout leaks into root `not-found` page

Windows: pnpm dev fails due to Unix-style NODE_OPTIONS environment variable assignment in package.json scripts

Turbopack dev: computed next/dynamic RSC loaders with client descendants fail under cacheComponents

Turbopack HMR fails to update server component using singleton registry on macOS

pg-meta functions read-path schemas reject procedures with null return_type

Inconsistent environment variable naming between Supabase Connect panel and Flask quickstart documentation

react-user-management example App.jsx missing import/export sections causing module load error

SQL Editor misleadingly shows '0 rows' for UPDATE/DELETE statements

`@next/playwright instant()` clears testing cookies for other origins

Segment cache: sibling PPR route prefetches are permanently dropped after same-tick batch

Update OAuth docs page: fix method names and response shape

reasoning_content is not streamed when response_format=json_object (aggregated into a single chunk)

Cron job status not refreshed after toggle in dashboard

Turbopack build panic misattributes NUL-byte env error to CSS module

Studio policy editor emits invalid empty `WITH CHECK` clause for non-INSERT policies

Homepage Vue quickstart link leads to 404 due to incorrect URL slug

Update MessageBird verification docs to Bird branding and integration details

Contributing docs missing required pnpm build step before pnpm dev on fresh clone

Route export validation rejects string literal union params in layouts and pages

langchain-profiles refresh corrupts strings containing JSON literal substrings

Fix singleton tuple config handling in _ConfigurableModel.batch_as_completed

core: ImagePromptValue cannot be deserialized while sibling prompt values can

RunnableParallel.get_input_schema rejects inputs that invoke accepts due to Pydantic v2 root field name mismatch

core: create_image_block does not enforce the mime_type requirement its docstring declares

Docs: Google nonce example declares hashedNonce inside promise callback causing ReferenceError and potential security bypass

core: `DictPromptTemplate.aformat` is never called — the async prompt path uses sync `format`

Ecosystem Topology

Agent Frameworks

Vector Databases

Toolchains

Active Intelligence Feed