Hi,I'mEbrahim

Open Source

Bugs I tracked down and fixed in production codebases used by thousands of teams — each one reviewed and merged by the project’s own maintainers.

1. 01

   Twenty

   ★ 55.8k+Merged

   twentyhq/twenty · The open-source alternative to Salesforce, designed for AI.

   fix(mcp): echo the client's progressToken instead of fabricating one

   PR #24582 · merged Aug 2026

   The Problem

   Twenty's Model Context Protocol endpoint invented its own progress token for every tool call and streamed a progress notification whether or not the client had asked for one. The MCP spec only allows notifications that reference a token from an active request, so a fabricated token could never be matched by a client — one reporter hit 157 protocol errors in a single Cursor session, after which the client marked the transport failed and left the server permanently red in its MCP list.

   What I Did

   Read the client's own `params._meta.progressToken` and echo it back, sending nothing when no token was supplied — which the spec explicitly permits. A Zod schema does the extraction, so a token of the wrong JSON type, or a fractional number, is treated as absent rather than echoed as a notification no client could match. Shipped with integration tests over the real HTTP path plus unit coverage for the edge tokens a truthiness check would silently drop.

   +95 / −11 · 5 files changed

   TypeScriptNestJSMCPZodSSEJest

   View Merged PR →
2. 02

   Medusa

   ★ 36.1k+Merged

   medusajs/medusa · The world's most flexible commerce platform for agents and developers.

   fix(auth): await the OAuth state cache write

   PR #16571 · merged Aug 2026

   The Problem

   `setState` on the auth identity provider service wrote OAuth state to the cache fire-and-forget, while its own contract documented "resolves when the state is stored". All four providers — Google, GitHub, OIDC and Medusa Cloud — await it and then immediately redirect, so a user could be sent to the identity provider before the state was actually persisted. Worse, the unhandled rejection meant a transient cache error during login took the whole process down instead of surfacing as a failed sign-in.

   What I Did

   Awaited the cache write, bringing the method in line with the contract its four callers were already written against. Traced the inconsistency to the analogous MFA challenge write in the same file, which already awaited — evidence this was an oversight rather than a deliberate choice. Verified both failure modes by hand, and removed the accompanying test at the reviewer's request rather than claim coverage the PR did not ship.

   +6 / −1 · 2 files changed

   TypeScriptNode.jsOAuthCachingJest

   View Merged PR →
3. 03

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Stop lists crashing on a selection that outlived its rows

   PR #6873 · merged Aug 2026

   The Problem

   Selecting rows and then shrinking the list replaced the entire view with an error page across six different lists — products, collections, models, draft orders, shipping zones and gift cards. The data grid tracks its selection by row index, independently of the data behind it, and reported those indices verbatim; the list views then resolved them straight onto arrays that no longer had rows at those positions.

   What I Did

   Fixed the cause rather than the reported symptom: the grid is the authority on how many rows exist, so it no longer reports rows past the last one it renders. Index-to-id resolution moved into a shared helper, because the clamp alone was insufficient — the row count is not always the length of the data behind it. That also settled three divergent behaviours spread across nine lists, two of which had been leaking `undefined` into the bulk actions.

   +579 / −109 · 39 files changed

   TypeScriptReactGlide Data GridGraphQLVitest

   View Merged PR →