Reliability fixes, merged upstream

anthropics/anthropic-sdk-python #1213

Recursively copy mutable contents of file tuples to prevent multipart encoding from mutating caller headers.

BerriAI/litellm #22450

Copy schemas before strict/additionalProperties removal so caller schemas and disk-cache keys remain stable.

microsoft/autogen #7326

Accumulate registered function descriptions from the live AgentBuilder system message instead of overwriting it from static configuration.

agno-agi/agno #6811

Allocate independent streaming tool-call dictionaries and prevent empty streaming names from overwriting the function name.

microsoft/semantic-kernel #13610

Preserve the first system/developer message during Python chat-history truncation and handle the target_count=1 boundary.

run-llama/llama_index #20863

Use the existing safe formatter for literal braces in customized ReActAgent prompts and warn about missing tool placeholders.

567-labs/instructor #2122

Add retry token budgeting, separate validator data in prompts, and repair allow_override behavior; tests accompany the proposal. No general injection-prevention claim.

langchain-ai/langchain #35544

Drop forced tool_choice with a warning when Anthropic extended thinking is enabled; preserve auto and unaffected requests.

microsoft/semantic-kernel #13635

Use value equality to avoid duplicate null entries in strict JSON Schema type arrays, with three regression tests.

stanfordnlp/dspy #9612

Keep GEPA feedback text consistent with the module-level score when a predictor-level score is overridden.

huggingface/smolagents #2205

Keep role-converted tool results separate from genuine user messages while preserving ordinary same-role merging.

mem0ai/mem0 #5250

Convert Redis cosine distance to similarity (1 - distance); regression asserts distances 0.1/0.4 yield scores 0.9/0.6. Closed without merge; maintainer acknowledged the conversion in a broader sweep.

BerriAI/litellm #32203

Guard choices-less chunks during stream assembly and respect Model Armor fail_on_error during assembly failures; the original commit includes six regression cases. Closed without merge.

stanfordnlp/dspy #9978

Reject an empty Evaluate devset with a descriptive ValueError before metric-summary division, with a regression test.

anthropics/anthropic-sdk-python #1752

Reject FIFO and other non-regular write targets before opening them to avoid blocking the async event loop.

huggingface/datasets #8323

Reject rename_columns collisions with untouched columns to prevent duplicate Arrow column names and inaccessible data.

PrefectHQ/marvin #1361

Copy caller context dictionaries before adding internal keys in seven public transformation functions.

567-labs/instructor #2426

Find an unquoted tasks-array bracket across streamed chunks so brackets in preceding strings do not silently discard tasks.

guardrails-ai/guardrails #1573

Avoid stale indexes while deleting multiple FieldReAsk items from a list.

langfuse/langfuse-python #1753

Handle explicit None arguments when merging legacy function_call deltas so streamed generation output is retained.

microsoft/autogen #7943

Raise a descriptive RuntimeError when speaker-selection streaming finishes without a CreateResult.

griptape-ai/griptape #2243

Use exact namespace matching to prevent vector results from leaking across hyphen-prefixed namespaces. The author closed this PR after the behavior was fixed upstream.

microsoft/semantic-kernel #14287

Preserve metadata while combining streamed text content.

huggingface/smolagents #2630

Return usable non-streaming completions with token_usage=None when providers omit usage metadata.

ethz-spylab/agentdojo #186

Exclude errored trials from benchmark denominators and render all-error aggregates as N/A, retaining completed/error counts.

UKGovernmentBEIS/inspect_ai #5261

Normalize symbolic target notation in math scoring so equivalent plain-text and LaTeX targets receive consistent verdicts.

Kilo-Org/kilocode #6281

fix(ui): use sidebar background color for chat session panel

langchain-ai/langchain #35899

Allocate independent metadata dictionaries as a defensive change; the PR does not establish an active runtime mutation path.

Latent aliasing hazard: the PR explicitly reports no current CallbackManager mutation path. Preserved as a defensive patch, excluded from the substantive runtime-fix count.

cgiovando/disaster-imagery-viewer #1

Repair drifted Nepal impact-layer endpoints and add browser GeoJSON health checks.

ollama/ollama-python #726

Accumulate assistant content in the streaming tool example so the next tool round replays the text actually emitted.

deedy5/ddgs #489

Collect successful pending backend results after another engine fails while preserving timeout/error classification.

AutomateLab-tech/content-distribution-mcp #6

Persist the scheduled profile and replace duplicate queued entries when rescheduling a content/channel pair.

simonw/claude-code-transcripts #112

Render queued prompt enqueue records at their original timestamp with explicit labels, preserving later delivery as a separate event.

simonw/llm #1668

Use completed async-response conversion when logging to SQLite, retaining the precompletion await-required error.

travisennis/cake #509

Require Cake's Bash LLM judge to parse the complete response as strict JSON, allowing only one optional plain or json Markdown fence, so trailing or malformed content fails closed while tool-argument repair remains separate.

travisennis/cake #511

Report invocation wall time separately from cumulative, potentially overlapping tool work and scheduled retry delays; remove unsupported exclusive-remainder and wall-share columns while retaining measurable activity from incomplete invocations.

travisennis/cake #517

Reject lossy tool-argument JSON repair that could discard extra objects, doubled braces, or provider markup after a valid prefix, while preserving complete valid JSON and raw-control-character escaping.

watchlight-ai-beacon/watchlight-de #162

Resolve fixture actors through the existing governed handle and reject unknown fixture keys or invalid actor values in the Python and TypeScript policy-test runners.

watchlight-ai-beacon/watchlight-de #168

Add explicit per-call PERSON exclusions in Python and TypeScript so known organization names can bypass only the optional PERSON heuristic while other enabled detectors continue to run.

apify/apify-cli #1394

Restore retry and backoff options when recursively removing files after the earlier rimraf-to-fs.rm migration, preserving force behavior and error propagation.

rivet-dev/agentos #1964

Merge caller-provided TypeScript permission scopes over AgentOS's secure baseline while preserving explicit overrides and the registered-binding auto-grant.

nolabs-ai/nono #1816

Show path and network remediation guidance only when supervised diagnostics contain corresponding path or network-denial evidence, without changing sandbox enforcement.

NovaCode37/claude-security-skills #47

Make all reported findings return exit code 1 across four previously inconsistent security-skill engines, with a shared minimum-severity filter governing both reports and exit decisions.

antfu/case-police #178

fix: use context.filename for ESLint 10 compatibility

mobxjs/mobx #4613

fix(eslint-plugin-mobx): replace deprecated context.getSourceCode() for ESLint 10 compat

microsoft/tsdoc #461

fix(eslint-plugin-tsdoc): replace deprecated ESLint APIs for v10 compatibility

graphql-hive/graphql-eslint #2946

fix: replace deprecated ESLint context methods for v10 compatibility

bryanrsmith/eslint-plugin-sort-class-members #106

fix: replace deprecated context.getSourceCode() for ESLint 10 compatibility

ngrx/platform #5103

feat(eslint-plugin): add ESLint v10 compatibility

github/eslint-plugin-github #686

fix: add ESLint v10 to peerDependencies

atfzl/eslint-plugin-css-modules #105

fix: replace deprecated context.getFilename() for ESLint 10 compatibility

sibiraj-s/eslint-plugin-file-progress #20

fix: add ESLint 10 compatibility

MaartenGr/BERTopic #2474

Enable ruff rule `UP`

javascript-obfuscator/javascript-obfuscator #1384

Replace mkdirp with native fs.mkdirSync({ recursive: true })

aws/aws-cdk #37083

fix(custom-resources): replace deprecated url.parse() with WHATWG URL API

orval-labs/orval #3029

chore(deps): replace chalk with native util.styleText

redis/ioredis #2081

fix: replace deprecated url.parse() with WHATWG URL API

Azure/Azurite #2631

chore: replace rimraf with native fs.rm()

conventional-changelog/conventional-changelog #1430

chore(deps): replace del-cli with Node.js built-in fs.rmSync

graphistry/pygraphistry #924

infra: replace flake8 with ruff for linting (closes #466)

stumpy-dev/stumpy #1133

Migrate from Flake8/Black/isort to Ruff (fixes #1055)

asyncapi/generator #2015

chore: replace rimraf with native fs.rmSync

americanexpress/jest-image-snapshot #385

chore: replace chalk and lodash with picocolors and native code

florisla/stm32loader #86

chore: replace flake8, black and isort with ruff

ActiveCampaign/postmark.js #182

feat: replace axios with native fetch API

TypeStrong/fork-ts-checker-webpack-plugin #891

chore(deps): replace chalk with picocolors

donmccurdy/glTF-Transform #1803

chore: replace glob with native node:fs globSync

just-jeb/angular-builders #2070

chore(deps): replace lodash with native JS equivalents

facebook/jscodeshift #685

chore: replace micromatch with picomatch

getsentry/sentry-javascript #19531

chore(remix): Replace glob with native recursive fs walk

getsentry/sentry-javascript #19532

chore(remix): replace yargs with native util.parseArgs

getsentry/sentry-javascript #19533

ref(sveltekit): Replace recast + @babel/parser with acorn

mqttjs/MQTT.js #2041

chore: replace number-allocator with inline Set-based implementation

ds300/patch-package #593

chore: replace chalk with picocolors

ds300/patch-package #594

chore: replace fs-extra with native Node.js fs APIs

mozilla/addons-linter #5949

chore(deps): replace chalk with native util.styleText

farhoudshapouran/react-native-ui-datepicker #239

chore: remove lodash dependency, use native deepEqual

cloudflare/workers-sdk #12692

chore(create-cloudflare): remove unused chalk dependency

sindresorhus/eslint-plugin-unicorn #2906

chore: replace `is-builtin-module` with native `node:module` `isBuiltin`

splinetool/react-spline #236

chore: replace lodash.debounce with inline implementation

microsoft/griffel #755

fix(eslint-plugin): replace deprecated context.getSourceCode() with context.sourceCode

tldraw/signia #90

chore: replace is-ci with native process.env.CI check

WebThingsIO/gateway #3267

chore: replace mkdirp with native fs.mkdirSync

jestjs/jest #15969

chore(jest-changed-files): replace execa with native node:child_process

jestjs/jest #15970

chore(jest-core, jest-watcher): replace ansi-escapes with inline ANSI sequences

jestjs/jest #15971

chore(jest-util): replace `slash` with inline implementation

jestjs/jest #15972

chore(jest-util): replace p-limit with inline implementation

testing-library/react-testing-library #1441

chore: replace chalk with picocolors and remove rimraf

danger/danger-js #1501

refactor: replace p-limit with inline concurrency limiter

nrwl/nx #34635

chore(repo): remove `is-ci` dependency

refinedev/refine #7309

refactor: replace rimraf with native fs.rmSync

payloadcms/payload #15782

chore: migrate remaining chalk usage to miniChalk utility

remix-run/react-router #14837

chore: replace chalk with picocolors

cloudflare/workers-sdk #12705

chore: replace glob with tinyglobby

svg-sprite/svg-sprite #970

chore(deps): remove prettysize dependency

http-party/http-server #958

Replace chalk with picocolors

webpack/webpack-hot-middleware #474

Remove strip-ansi dependency

db-migrate/node-db-migrate #844

chore: replace mkdirp with native fs.promises.mkdir

sequelize/sequelize #18132

meta: replace trivial lodash functions with native equivalents

jest-community/jest-junit #279

chore: replace strip-ansi, mkdirp, uuid with Node.js native APIs

postcss/postcss-cli #510

chore: replace fs-extra with native Node.js fs

mozilla/nunjucks #1524

chore: replace fs-extra with native Node.js fs in tests

techniq/layerchart #796

Replace lodash-es get/memoize with native equivalents

tschaub/gh-pages #653

chore: replace fs-extra with native node:fs

klaudiosinani/signale #138

build(deps): replace chalk with picocolors

commitizen/cz-cli #1016

chore: replace fs-extra with native node:fs

dherault/serverless-offline #1876

chore: replace fs-extra with native Node.js fs APIs

dherault/serverless-offline #1877

chore: replace fs-extra with native node:fs

sequelize/cli #1564

build(deps): replace fs-extra with native node:fs

sc-forks/solidity-coverage #921

Replace globby with glob

stylelint/stylelint #9118

Replace `globby` and `fast-glob` with `tinyglobby`

google/gts #962

chore(deps): replace chalk with picocolors

webpack/stylus-loader #450

chore(deps): replace fast-glob with tinyglobby

mochajs/mocha #5775

chore(deps): remove rimraf devDependency

typicode/json-server #1719

chore: replace chalk with picocolors

cucumber/cucumber-js #2763

chore(deps): replace chalk with picocolors

openclaw/openclaw #30424

fix: reorder system prompt sections to maximize Anthropic prefix caching

Prompt-ordering/cache optimization proposal. No measured cache improvement established by this audit; excluded from substantive defect totals.

openstreetmap/iD #12820

Flag multipolygon type on nodes and ways

benoitc/gunicorn #3732

Clarify worker heartbeat timeout documentation

travisennis/cake #510

Run the existing offline evaluation-harness and session-metrics fixture suites in CI and the full local fixture aggregate for code-affecting changes.

pytorch/ignite #3591

replace typing hints in ignite/handlers/tqdm_logger.py

optuna/optuna #6478

Simplify Union type alias in optuna/samplers/_cmaes.py

web-infra-dev/rsbuild #7238

docs: fix trailing comma in zh html/template code example

nuxt/nuxt #34391

docs: add shared/ directory to Nuxt 4 upgrade guide

huggingface/smolagents #2020

fix: use dict format for tool call arguments in few-shot examples

huggingface/smolagents #2024

fix: align few-shot observation examples with runtime format

NVIDIA/NemoClaw #367

docs: improve instruction clarity in update-docs SKILL.md

simonw/llm #1666

docs: explain templates and fragments together

simonw/llm #1667

docs: explain source verification in schema extraction tutorial

simonw/sqlite-utils #853

docs: explain temporary storage for large database operations

python-trio/trio #3505

Document that Trio subprocess APIs call subprocess.Popen from a worker thread and therefore inherit applicable per-thread operating-system state from that worker.

theskumar/python-dotenv #696

Document shell completion setup

pypa/packaging.python.org #2126

Document hash-bearing project detail pages for manually hosted package indexes and point readers to the Simple Repository API and dumb-pypi.

simonw/datasette #2901

Document and test async startup hooks

useblocks/sphinx-needs #1868

Document a copyable Sphinx-Needs configuration for rendering nested portin and portout needs inside a parent needflow block.

fsspec/filesystem_spec #2116

Document compressed file usage and optional codecs

GenAI-Security-Project/GenAI-Security-Advisor #4

docs: align category example and release claim with current sources

pastas/pastas #1342

Add a worked groundwater-observation sampling example that preserves measured values and original timestamps rather than interpolating to a regular index.

watchlight-ai-beacon/watchlight-de #164

Document that an explicit same-named deepagents `subagents` entry with `tools: []` stops inheritance of the parent's custom tools, while framework middleware tools (e.g. deepagents filesystem tools) remain and need separate confinement.

nolabs-ai/nono-packs #29

Require Nono provenance evidence - output naming Nono, or a successful `nono why --self` result with status DENIED - before pack guidance recommends sandbox permission remediation, route unconfirmed permission errors to a non-sandbox diagnosis, and stop inferring active profiles, across twelve harness packs.

NixOS/nixpkgs #552130

hermeneutic: init at 0.1.8

Closed-unmerged packaging proposal. GitHub reports contradictory/capped changed-file data, so technical acceptance and code contribution are intentionally uncounted.

character-ai/larch #9076

ci: upgrade lintlang to 0.5.0

packetcraft/llm-sec-workbench #1

test: cover current Little Canary gate contract

Roelzz/mcs-agent-analyser #31

Add the pinned Rule Audit v0.1.3 pre-commit hook for two judge prompts in an external repository.

agent-next/agent-ready #71

docs: add instruction-quality pre-commit gate

developmentmachine/agent-platform #5

ci: run configured LintLang hook

promptfoo/promptfoo #10663

feat(examples): add local Hermeneutic wording assertion

samvitgersappa/Orbit #1

Repair the Little Canary adapter to use SecurityPipeline, preserve advisory behavior, and distinguish completed, degraded, unavailable, and failed screening.

Roelzz/mcs-agent-analyser #33

Run the previously accepted Rule Audit pre-commit hook in CI for two existing judge prompts.

packetcraft/llm-sec-workbench #2

Map degraded Little Canary results to ERROR instead of PASS while preserving fail-open behavior, structural-block precedence, raw status fields, and compatibility with older verdict objects.

Roelzz/mcs-agent-analyser #34

Add a bounded, deterministic, offline Instruction Audit section to reports over analysed Copilot Studio bot instructions.

tensorchord/Awesome-LLMOps #725

Add hermeneutic to Observability section

tensorchord/Awesome-LLMOps #726

Add hermes-rubric to Observability section

punkpeye/awesome-mcp-servers #11590

Add hermes-labs-ai/fidelis to Knowledge & Memory.

igorbarinov/awesome-data-engineering #335

Add csv-quality-gate to Testing

cleder/awesome-python-testing #108

docs: add quick-gate-python to Tools

scadastrangelove/awesome-ai-security-tools #38

Add little-canary to LLM Red-Teaming & Guardrails

TalEliyahu/Awesome-AI-Security #125

Add hermes-jailbench to Prompt Injection & Jailbreak Detection

dustinspecker/awesome-eslint #300

Add quick-gate-js to Tools

ZeroPointRepo/awesome-hermes-skills #37

Refresh LintLang listing

ProjectRecon/awesome-ai-agents-security #89

Add LintLang to Static Analysis & Linters

0xarkstar/awesome-hermes-agent #7

Update LintLang entry

analysis-tools-dev/static-analysis #1865

Add LintLang

e2b-dev/awesome-ai-sdks #324

Add HermesGate

ai-boost/awesome-harness-engineering #185

Add LintLang to verification tools

caramelomartins/awesome-linters #151

Add LintLang for Language Agnostic

ml-tooling/best-of-python-dev #286

Add project: lintlang

caramelomartins/awesome-linters #152

Add LintLang for Language Agnostic.

Benjamin-KY/open-harness-atlas #2

fix(registry): correct Hermes Rubric license and metadata

punkpeye/awesome-mcp-servers #13513

List Fidelis Memory in Knowledge & Memory with its repository, Glama badge, PyPI installation, initialization, and MCP-client registration paths.

cline/marketplace #97

Add Fidelis Memory MCP

oxsecurity/megalinter #8899

Add lintlang (AI_LINTLANG) to External Plugins Catalog

efij/awesome-claude-code-security #29

Add Agent Gorgon audit-only guardrail

UKGovernmentBEIS/inspect_ai #5265

List the released Hermes Rubric Inspect scorer in the Inspect AI extensions gallery with a link to its installation and usage documentation.

NousResearch/hermes-agent #105639

Add Fidelis Memory to Hermes Agent's optional MCP catalog with a version-pinned uvx launch command and documented local-daemon setup and data-sharing boundaries.

benchflow-ai/awesome-evals #72

Add Precise Records on agent telemetry validity

yzhao062/awesome-auditable-ai #6

Add two Hermes Labs papers on auditability and model self-report

MukundaKatta/awesome-prompt-injection-defense #10

Add Behavioral Canarying technical note (Little Canary)

ruizheliUOA/Awesome-Interpretability-in-Large-Language-Models #16

Add The Generative Horizon to Position Papers

tjunlp-lab/Awesome-LLMs-Evaluation-Papers #50

Add two epistemic-failure papers to Truthfulness (Bosch, 2026)

microsoft/autogen #7313

Add NoHandoffTermination condition for Swarm teams

openai/openai-python #2925

fix: extend output_text to include code_interpreter and shell output

Proposed extension of output_text beyond message output; the existing message-only API behavior is explicit. Counted as a feature proposal, not a verified framework defect.

travisennis/cake #504

Add cake debug skills to report selected skill-catalog XML size, approximate token count, and description lengths with advisory thresholds, without changing prompt rendering or skill filtering.