Open Source Contributions

Every pull request I have had merged into a major open-source project — the bug behind it, the reasoning that fixed it, and a link to the review it went through.

1. 01

   Twenty

   ★ 56.8k+Merged

   twentyhq/twenty · The open-source alternative to Salesforce, designed for AI.

   fix(mcp): echo the client's progressToken instead of fabricating one

   PR #24582 · merged Aug 2026

   The Problem

   Twenty's Model Context Protocol endpoint invented its own progress token for every tool call and streamed a progress notification whether or not the client had asked for one. The MCP spec only allows notifications that reference a token from an active request, so a fabricated token could never be matched by a client — one reporter hit 157 protocol errors in a single Cursor session, after which the client marked the transport failed and left the server permanently red in its MCP list.

   What I Did

   Read the client's own `params._meta.progressToken` and echo it back, sending nothing when no token was supplied — which the spec explicitly permits. A Zod schema does the extraction, so a token of the wrong JSON type, or a fractional number, is treated as absent rather than echoed as a notification no client could match. Shipped with integration tests over the real HTTP path plus unit coverage for the edge tokens a truthiness check would silently drop.

   +95 / −11 · 5 files changed

   TypeScriptNestJSMCPZodSSEJest

   View Merged PR →
2. 02

   Medusa

   ★ 36.3k+Merged

   medusajs/medusa · The world's most flexible commerce platform for agents and developers.

   fix(auth): await the OAuth state cache write

   PR #16571 · merged Aug 2026

   The Problem

   `setState` on the auth identity provider service wrote OAuth state to the cache fire-and-forget, while its own contract documented "resolves when the state is stored". All four providers — Google, GitHub, OIDC and Medusa Cloud — await it and then immediately redirect, so a user could be sent to the identity provider before the state was actually persisted. Worse, the unhandled rejection meant a transient cache error during login took the whole process down instead of surfacing as a failed sign-in.

   What I Did

   Awaited the cache write, bringing the method in line with the contract its four callers were already written against. Traced the inconsistency to the analogous MFA challenge write in the same file, which already awaited — evidence this was an oversight rather than a deliberate choice. Verified both failure modes by hand, and removed the accompanying test at the reviewer's request rather than claim coverage the PR did not ship.

   +6 / −1 · 2 files changed

   TypeScriptNode.jsOAuthCachingJest

   View Merged PR →
3. 03

   Medusa

   ★ 36.3k+Merged

   medusajs/medusa · The world's most flexible commerce platform for agents and developers.

   fix(caching): reset the size accounting on a wildcard cache clear

   PR #16607 · merged Sep 2026

   The Problem

   Medusa's in-memory caching provider tracks an approximate memory usage and refuses new entries once it passes `maxSize`. Every removal path kept that figure in sync through the per-key `del` and `expired` events — except clearing with the wildcard tag. `NodeCache.flushAll()` emits a single `flush` and never a per-key `del`, so `clear({ tags: ["*"] })` emptied the cache while leaving the usage exactly where it was. A cache that had crossed its limit then rejected every later write on an empty store, logging "Cache is full" for the rest of the process, and because the rejection happened before any accounting, nothing could ever bring the number back down.

   What I Did

   Two lines in the wildcard branch reset the per-key size map and the usage counter alongside the tag index it already cleared, with a comment recording why the reset cannot come from the `del` handler. Added a provider unit test that fails without the fix, and explained why the existing max-size integration suite could never catch it: its runner builds a fresh provider for every test, so the accounting is always zero. The emitted `.d.ts` is byte-identical, so nothing about the public API moves.

   +60 / −0 · 3 files changed

   TypeScriptNode.jsCachingnode-cacheJest

   View Merged PR →
4. 04

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Stop lists crashing on a selection that outlived its rows

   PR #6873 · merged Aug 2026

   The Problem

   Selecting rows and then shrinking the list replaced the entire view with an error page across six different lists — products, collections, models, draft orders, shipping zones and gift cards. The data grid tracks its selection by row index, independently of the data behind it, and reported those indices verbatim; the list views then resolved them straight onto arrays that no longer had rows at those positions.

   What I Did

   Fixed the cause rather than the reported symptom: the grid is the authority on how many rows exist, so it no longer reports rows past the last one it renders. Index-to-id resolution moved into a shared helper, because the clamp alone was insufficient — the row count is not always the length of the data behind it. That also settled three divergent behaviours spread across nine lists, two of which had been leaking `undefined` into the bulk actions.

   +579 / −109 · 39 files changed

   TypeScriptReactGlide Data GridGraphQLVitest

   View Merged PR →
5. 05

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Restore link behaviour on datagrid rows

   PR #6868 · merged Aug 2026

   The Problem

   Right clicking a product in the catalogue offered no "Open link in new tab", and middle clicking navigated in the current tab instead of opening a new one — still reproducing on dashboard 3.23.19, leaving Ctrl/Cmd + click as the only way to open a row in a new tab. Each list grid moves a single anchor over the hovered cell so rows can behave like ordinary links, but that anchor was placed in document coordinates while the grid reports cell bounds in viewport coordinates. It never sat on the cell it pointed at, so native link gestures landed on the grid canvas, which has no handling for them.

   What I Did

   Positioned the anchor with `position: fixed` against the bounds the grid already reports, so it lands exactly over the cell under the cursor. Pointer events then reach the anchor, which made its visibility the harder half of the fix: parked over a cell it swallows the pointer returning there and the row silently loses its hover highlight. Wheel deltas are forwarded to the grid's own scroller, because the previous workaround of hiding on wheel could not work — React registers `onWheel` passively, so the gesture is already latched by the time the handler runs. Driven in Chromium against a real product list with the grid offset from the document origin and the page scrolled, and the regression test fails on `main`.

   +551 / −65 · 12 files changed

   TypeScriptReactGlide Data GridDOM EventsPlaywright

   View Merged PR →
6. 06

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Fix Navigator (Ctrl+K) combobox ARIA pattern

   PR #6858 · merged Aug 2026

   The Problem

   The command palette shipped combobox-style ARIA attributes on an abstract `role="input"`, so none of them took effect and the role overrode the native input's own. axe-core reported three critical violations on the open palette: screen readers announced neither the field as a combobox, nor the popup as a list, nor which result was currently highlighted. Two option nodes had no id at all, so highlighting them wrote an empty `aria-activedescendant`.

   What I Did

   Rebuilt the accessibility tree with no visual change at all: the field became a real combobox controlling a labelled listbox, with `role="option"`, the id and `aria-selected` consolidated onto a single node so `aria-activedescendant` always resolves to an option the listbox actually owns. Kept action items as anchors to preserve middle-click, and documented the one interaction trade-off in the PR rather than leaving the reviewer to find it.

   +390 / −40 · 18 files changed

   TypeScriptReactWAI-ARIAaxe-coreAccessibility

   View Merged PR →
7. 07

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Keep decimals in discount rule reward values

   PR #6860 · merged Aug 2026

   The Problem

   A discount rule's reward value silently dropped everything after the decimal point — entering `12.55` saved `12`. `parseInt` truncated the input, and because the field is controlled, React wrote the rounded number straight back as you typed, with no error and nothing to indicate the cents had been discarded. A separate validation guard then rejected every sub-unit reward with "Rule reward value is required", pointing at entirely the wrong problem.

   What I Did

   Three lines of production change, no visual change: `parseInt` became `parseFloat`, `step="any"` declared the field as decimal so the spinner and its validity state finally agreed, and the schema's `.min(1)` became `.gt(0)` so a 0.5% or $0.99 rule passes while zero and negatives stay rejected under the same message. Deliberately left currency rounding to the server, matching how the maintainers had scoped precision validation in the issue thread.

   +180 / −2 · 5 files changed

   TypeScriptReactZodReact Hook Form

   View Merged PR →