Open Source Contributions

Every pull request I have had merged into a major open-source project — the bug behind it, the reasoning that fixed it, and a link to the review it went through.

1. 01

   Twenty

   ★ 55.6k+Merged

   twentyhq/twenty · The open-source alternative to Salesforce, designed for AI.

   fix(mcp): echo the client's progressToken instead of fabricating one

   PR #24582 · merged Aug 2026

   The Problem

   Twenty's Model Context Protocol endpoint invented its own progress token for every tool call and streamed a progress notification whether or not the client had asked for one. The MCP spec only allows notifications that reference a token from an active request, so a fabricated token could never be matched by a client — one reporter hit 157 protocol errors in a single Cursor session, after which the client marked the transport failed and left the server permanently red in its MCP list.

   What I Did

   Read the client's own `params._meta.progressToken` and echo it back, sending nothing when no token was supplied — which the spec explicitly permits. A Zod schema does the extraction, so a token of the wrong JSON type, or a fractional number, is treated as absent rather than echoed as a notification no client could match. Shipped with integration tests over the real HTTP path plus unit coverage for the edge tokens a truthiness check would silently drop.

   +95 / −11 · 5 files changed

   TypeScriptNestJSMCPZodSSEJest

   View Merged PR →
2. 02

   Medusa

   ★ 36k+Merged

   medusajs/medusa · The world's most flexible commerce platform for agents and developers.

   fix(auth): await the OAuth state cache write

   PR #16571 · merged Aug 2026

   The Problem

   `setState` on the auth identity provider service wrote OAuth state to the cache fire-and-forget, while its own contract documented "resolves when the state is stored". All four providers — Google, GitHub, OIDC and Medusa Cloud — await it and then immediately redirect, so a user could be sent to the identity provider before the state was actually persisted. Worse, the unhandled rejection meant a transient cache error during login took the whole process down instead of surfacing as a failed sign-in.

   What I Did

   Awaited the cache write, bringing the method in line with the contract its four callers were already written against. Traced the inconsistency to the analogous MFA challenge write in the same file, which already awaited — evidence this was an oversight rather than a deliberate choice. Verified both failure modes by hand, and removed the accompanying test at the reviewer's request rather than claim coverage the PR did not ship.

   +6 / −1 · 2 files changed

   TypeScriptNode.jsOAuthCachingJest

   View Merged PR →
3. 03

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Stop lists crashing on a selection that outlived its rows

   PR #6873 · merged Aug 2026

   The Problem

   Selecting rows and then shrinking the list replaced the entire view with an error page across six different lists — products, collections, models, draft orders, shipping zones and gift cards. The data grid tracks its selection by row index, independently of the data behind it, and reported those indices verbatim; the list views then resolved them straight onto arrays that no longer had rows at those positions.

   What I Did

   Fixed the cause rather than the reported symptom: the grid is the authority on how many rows exist, so it no longer reports rows past the last one it renders. Index-to-id resolution moved into a shared helper, because the clamp alone was insufficient — the row count is not always the length of the data behind it. That also settled three divergent behaviours spread across nine lists, two of which had been leaking `undefined` into the bulk actions.

   +579 / −109 · 39 files changed

   TypeScriptReactGlide Data GridGraphQLVitest

   View Merged PR →
4. 04

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Fix Navigator (Ctrl+K) combobox ARIA pattern

   PR #6858 · merged Aug 2026

   The Problem

   The command palette shipped combobox-style ARIA attributes on an abstract `role="input"`, so none of them took effect and the role overrode the native input's own. axe-core reported three critical violations on the open palette: screen readers announced neither the field as a combobox, nor the popup as a list, nor which result was currently highlighted. Two option nodes had no id at all, so highlighting them wrote an empty `aria-activedescendant`.

   What I Did

   Rebuilt the accessibility tree with no visual change at all: the field became a real combobox controlling a labelled listbox, with `role="option"`, the id and `aria-selected` consolidated onto a single node so `aria-activedescendant` always resolves to an option the listbox actually owns. Kept action items as anchors to preserve middle-click, and documented the one interaction trade-off in the PR rather than leaving the reviewer to find it.

   +390 / −40 · 18 files changed

   TypeScriptReactWAI-ARIAaxe-coreAccessibility

   View Merged PR →
5. 05

   Saleor Dashboard

   ★ 1k+Merged

   saleor/saleor-dashboard · The GraphQL-powered dashboard for the Saleor commerce platform.

   Keep decimals in discount rule reward values

   PR #6860 · merged Aug 2026

   The Problem

   A discount rule's reward value silently dropped everything after the decimal point — entering `12.55` saved `12`. `parseInt` truncated the input, and because the field is controlled, React wrote the rounded number straight back as you typed, with no error and nothing to indicate the cents had been discarded. A separate validation guard then rejected every sub-unit reward with "Rule reward value is required", pointing at entirely the wrong problem.

   What I Did

   Three lines of production change, no visual change: `parseInt` became `parseFloat`, `step="any"` declared the field as decimal so the spinner and its validity state finally agreed, and the schema's `.min(1)` became `.gt(0)` so a 0.5% or $0.99 rule passes while zero and negatives stay rejected under the same message. Deliberately left currency rounding to the server, matching how the maintainers had scoped precision validation in the issue thread.

   +180 / −2 · 5 files changed

   TypeScriptReactZodReact Hook Form

   View Merged PR →