AI Structured Outputs Have Two Depth Limits — Only One Is Documented

·1 views

When using structured JSON schema outputs with AI models like OpenAI's, developers face two distinct depth constraints that behave very differently. The first is a hard, documented limit enforced at request time with a 400 error, covering nesting depth, total object properties, and character lengths — figures that have already been revised since the feature launched in August 2024. The second is an undocumented soft limit where the model silently places correct values in the wrong location, producing responses that still validate but are semantically wrong. This happens because constrained decoding prevents malformed JSON but cannot stop a model from drifting context at deep nesting levels, relocating errors rather than eliminating them. Developers are advised to probe each provider's actual limits programmatically and to treat any published depth figures as upper bounds rather than reliable targets for real-world schemas.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The 'void' Keyword in C Has Four Uses — More Than You Might Expect

The 'void' keyword in C has four distinct uses, which is one more than the often-cited three uses of 'static'. The keyword was not part of the original K&R dialect of C, where functions with no return value simply omitted the return type and were assumed to return int. Stephen Bourne, creator of the Bourne Shell, pushed for its addition after finding this ambiguity frustrating, and Dennis Ritchie agreed since explicitly returning nothing could save a machine instruction. Later, 'void' was reused to indicate that a function takes no parameters when C adopted function prototypes back-ported from C++, ensuring backward compatibility with older code. The keyword has since influenced several other programming languages, including Java, C#, D, and Swift.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers Debate Best Practices for Structuring Frontend Projects

A discussion has emerged in the developer community around how frontend projects should be organized, a topic seen as less explored than its backend counterpart. Common approaches include organizing code by file type, by feature, or following framework-specific conventions such as Angular's predefined structure. The conversation also touches on whether advanced methodologies like Domain-Driven Design and Clean Architecture are practical for frontend applications or represent unnecessary complexity. Some developers suggest that a straightforward feature-based structure may be sufficient for most use cases. The debate highlights a broader need for clearer, widely accepted architectural guidance in frontend development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI-generated service wiped database on startup yet passed all 18 automated tests

A software developer testing an AI-generated billing service discovered it dropped and recreated all database tables on every startup, effectively destroying existing data. Despite this critical flaw, the service passed all 18 automated test scenarios because each test built its own state from scratch in an empty database. Since repeatable tests always start clean, the destructive startup behavior was indistinguishable from a normal fresh start, leaving the defect completely untested. The root cause was the AI agent interpreting a schema description as an instruction to create tables at launch, unaware that existing rows might already be present. The author concludes the fix is not writing more tests, but asking a different question — one that verifies behavior against a pre-populated database rather than an empty one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CircuitVerse Implements LTI 1.3 Login Endpoint, Fixes Security Gaps Found by CodeQL

CircuitVerse shipped the first stage of its LTI 1.3 integration this week, implementing the /lti/login endpoint that handles the OpenID Connect initiation request from a Learning Management System. The controller, built in around 64 lines of code with 150 lines of tests, redirects the LMS to an authorization URL after resolving the incoming credentials to a registered deployment. A CodeQL scan flagged a potential CSRF vulnerability caused by broadly skipping token verification, which was resolved by overriding the verification predicate to apply only to the specific parameters expected in an LTI login request. Code review surfaced three additional issues — ambiguous deployment lookups, unvalidated authorization URLs that could allow redirects to malicious endpoints, and registered query parameters being silently dropped — all of which were addressed before merging. A separate debugging session traced a database schema mismatch to an abandoned proof-of-concept migration from earlier in the project, highlighting the risk of leaving experimental migrations applied to a development database.

0 comments Read more at DEV Community