Skip to content

Reliability fixes, merged upstream

The clearest proof that we read agent frameworks closely is the fixes we have landed in them. 4 merged pull requests below fix concrete AI/framework defects. Each links to the public PR. The full record also includes maintenance, typing, documentation, and workflow integrations.

Upstream contributionsVerified 2026-10-06 UTC4 AI/framework fixes105 published external pull requests merged in 2026, including 52 code, workflow, typing or maintenance contributions across open-source infrastructure.

§ 01

Merged AI-framework fixes

Public pull requests
LangChain · 144k ★

Fixed thinking + tools crash in ChatAnthropic.bind_tools()

Anthropic’s API rejects forced tool_choice when extended thinking is enabled. LangChain’s bind_tools() could forward a forced tool choice while thinking was enabled, producing a 400 response. Ported the guard the structured-output path already had.

Pull requestlangchain/pull/35544StatusMergedReleasedlangchain-anthropic 1.3.5
Microsoft Semantic Kernel · 28k ★

Fixed ChatHistoryTruncationReducer silently deleting system prompts

The truncation reducer was calling extract_range, a summarization helper that filters out system and developer messages. System prompts were being dropped with no warning. Ported Microsoft’s own .NET fix to the Python SDK.

Pull requestsemantic-kernel/pull/13610StatusMergedReleasedpython-1.41.1
microsoft/semantic-kernel

.Net: fix: prevent duplicate "null" in JSON Schema type arrays for nullable parameters

Use value equality to avoid duplicate null entries in strict JSON Schema type arrays, with three regression tests.

Read the case study →

PR #13635Merged2026-06-16
Merge evidence
stanfordnlp/dspy

fix(evaluate): raise descriptive ValueError on empty devset instead of ZeroDivisionError

Reject an empty Evaluate devset with a descriptive ValueError before metric-summary division, with a regression test.

Read the case study →

PR #9978Merged2026-08-26
Merge evidence

105 published external pull requests merged in 2026, including 52 code, workflow, typing or maintenance contributions across open-source infrastructure. Beyond the 4 fixes above, 57 more across PyTorch Ignite, Optuna, React Router (56k ★), Nuxt (60k ★), MobX (28k ★), Cloudflare Workers SDK (4.4k ★), Sentry, ngrx, TSDoc, and others (maintenance and typing modernization). See the canonical ledger below for exact totals, classifications, search coverage and retrieval date. Browse merged pull requests by roli-lpci on GitHub.

26 merged technical, integration or documentation contributions are in AI-agent upstreams. The 4 framework fixes are a subset of this work.

Griptape · report resolved by maintainer

Reported incorrect namespace matching in LocalVectorStoreDriver

Roli Bosch reported that vector queries could return entries from another namespace sharing a hyphenated prefix. A Griptape maintainer fixed the matching logic and added a regression test, explicitly citing the report. The maintainer's fix merged on 13 July 2026. Hermes contributed the report; the maintainer authored the merged fix.

Maintainer fixgriptape/pull/2244

How these fixes get made: the case studies explain the defect, regression evidence, attribution and exact upstream outcome.

The merged external contribution record

One row per merged pull request, verified against the upstream repository's merge commit and changed files. Only merged pull requests are published. Roli Bosch contributes under roli-lpci; the Hermes Labs attribution identifies our founder and credits earlier reporters and maintainers where relevant. Own-account and Hermes organization PRs are excluded.

Download the canonical structured ledger (JSON). Its scoped reviewed set contains 61 merged engineering/documentation PRs: 52 code, workflow, typing or maintenance changes and 9 documentation-only changes. They include the 4 framework fixes; these subsets must not be added again.

Merged pull requests by class
ClassMerged
AI/framework fixes4
Other bug fixes11
Maintenance and compatibility31
Typing2
Documentation9
External integrations1
Documentation/ecosystem listings43
Research/index submissions1
Features3

The earlier 33 and 35 totals were dated engineering/documentation subtotals; the 61 entries above derive from the scoped ledger. The public projection includes 105 merged external PRs, including 43 community listings and 1 research-index entry. Neither listings nor research-index entries count as merged code. Dates below are merge dates.

AI/framework fixes · 4 merged PRs
Other bug fixes · 11 merged PRs
Merged

simonw/llm #1668

Use completed async-response conversion when logging to SQLite, retaining the precompletion await-required error.

Merge commit
Merged

travisennis/cake #509

Require Cake's Bash LLM judge to parse the complete response as strict JSON, allowing only one optional plain or json Markdown fence, so trailing or malformed content fails closed while tool-argument repair remains separate.

Merge commit
Merged

travisennis/cake #511

Report invocation wall time separately from cumulative, potentially overlapping tool work and scheduled retry delays; remove unsupported exclusive-remainder and wall-share columns while retaining measurable activity from incomplete invocations.

Merge commit
Merged

travisennis/cake #517

Reject lossy tool-argument JSON repair that could discard extra objects, doubled braces, or provider markup after a valid prefix, while preserving complete valid JSON and raw-control-character escaping.

Merge commit
Merged

apify/apify-cli #1394

Restore retry and backoff options when recursively removing files after the earlier rimraf-to-fs.rm migration, preserving force behavior and error propagation.

Merge commit
Merged

nolabs-ai/nono #1816

Show path and network remediation guidance only when supervised diagnostics contain corresponding path or network-denial evidence, without changing sandbox enforcement.

Merge commit
Merged

NovaCode37/claude-security-skills #47

Make all reported findings return exit code 1 across four previously inconsistent security-skill engines, with a shared minimum-severity filter governing both reports and exit decisions.

Merge commit
Merged

bytedance/deer-flow #5656

Aligned the bundled Vercel deploy skill directory with its public name and changed its four commands to the actual /mnt/skills/public/vercel-deploy/scripts/deploy.sh mount. Added coverage that loads the skill through DeerFlow’s runtime loader and checks the resolved mounted path; the PR reports 26 focused skill tests passed, while a clean full backend suite was unavailable.

Merge commit
Maintenance and compatibility · 31 merged PRs
Merged

travisennis/cake #510

Run the existing offline evaluation-harness and session-metrics fixture suites in CI and the full local fixture aggregate for code-affecting changes.

Merge commit
Merged

sinonjs/sinon #2775

Replaces the prebuild rimraf command with native Node filesystem cleanup and removes the direct rimraf dependency.

Merge commit
Merged

react-hook-form/react-hook-form #13770

Replaced the rimraf-based dist cleanup command with Node fs.rmSync and removed the direct rimraf dependency and its exclusive pnpm lockfile entries. The upstream comparison and validation were reported on macOS; Windows locked-file behavior was not validated.

Merge commit
Merged

reduxjs/redux #4951

Replaced rimraf in the root clean command with a small Node fs.rmSync script, preserving recursive, forced removal and bounded retries, and removed rimraf and its exclusive pnpm lockfile dependency closure. Upstream cleanup comparison covered nested, hidden, read-only and missing content plus symlink preservation; Windows locked-file behavior was not validated.

Merge commit
Typing · 2 merged PRs
Documentation · 9 merged PRs
Merged

watchlight-ai-beacon/watchlight-de #164

Document that an explicit same-named deepagents `subagents` entry with `tools: []` stops inheritance of the parent's custom tools, while framework middleware tools (e.g. deepagents filesystem tools) remain and need separate confinement.

Merge commit
Merged

nolabs-ai/nono-packs #29

Require Nono provenance evidence - output naming Nono, or a successful `nono why --self` result with status DENIED - before pack guidance recommends sandbox permission remediation, route unconfirmed permission errors to a non-sandbox diagnosis, and stop inferring active profiles, across twelve harness packs.

Merge commit
Merged

trailofbits/skills #345

Adds a when-to-use trigger to the interpreting-culture-index skill description and aligns the plugin metadata version references.

Merge commit
Merged

bethington/ghidra-mcp #552

Removes two tests/performance paths from the CLAUDE.md verification table after that directory was deleted, so the per-file test guidance names only existing tests.

Merge commit
Merged

pipecat-ai/pipecat #5981

Corrects the RTVI source path in AGENTS.md from the removed rtvi.py module to the current rtvi/ package, so agent instructions point at code that exists.

Merge commit
Merged

bytebase/dbhub #447

Corrected the connector interface path in CLAUDE.md from src/interfaces/connector.ts to src/connectors/interface.ts.

Merge commit
External integrations · 1 merged PRs
Merged

samvitgersappa/Orbit #1

Repair the Little Canary adapter to use SecurityPipeline, preserve advisory behavior, and distinguish completed, degraded, unavailable, and failed screening.

Merge commit
Documentation/ecosystem listings · 43 merged PRs
Research/index submissions · 1 merged PRs
Features · 3 merged PRs
Merged

travisennis/cake #504

Add cake debug skills to report selected skill-catalog XML size, approximate token count, and description lengths with advisory thresholds, without changing prompt rendering or skill filtering.

Merge commit
Merged

yunaremaia/mcp-guard #80

Adds MCP008 known-pattern metadata scanning and optional deterministic Little Canary structural filtering, with bounded inspection and documented limitations.

Merge commit

Back to the open-source catalog.