Browser's convertToBlob() silently returns PNG when requested format fails

·1 views

A developer building client-side file tools discovered that the browser's canvas.convertToBlob() API does not throw an error or reject a promise when given an unsupported image format. Instead, it silently falls back to PNG while resolving successfully, meaning a file saved as photo.avif could actually contain PNG data. Testing in Chrome confirmed that AVIF encoding is unsupported via canvas, despite browsers widely supporting AVIF decoding. The recommended fix is a simple post-call check comparing blob.type against the requested type, throwing a clear error if they differ. The author advises against silent format substitution, arguing it replicates the same deceptive bug and that WebP already covers most practical conversion needs without extra dependencies.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Generative AI Gains Structured Outputs and Native Tool Calling for Developers

Recent advances in generative AI are making it more practical for developers to build reliable production features, moving beyond earlier frustrations with hallucinated outputs and fragile orchestration. Modern APIs from providers like OpenAI now support native constrained decoding, where a JSON schema or Pydantic model restricts token sampling at the logit level, making invalid structured outputs technically impossible. Open-weight models such as Llama 3 and Mistral have also integrated tool-calling syntax directly into their chat templates, enabling local function calling via tools like Ollama without complex workarounds. Developers can now pass structured function schemas and receive well-formed tool call payloads in return, significantly reducing integration overhead. However, constrained decoding comes with a performance trade-off, as schema validation at each token step makes generation slower than raw text output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Superpowers Brings Structured TDD Methodology to Major AI Coding Agents

Superpowers is an installable skills package developed by Jesse Vincent and Prime Radiant that enforces a structured software development methodology across AI coding agents. The tool mandates steps including brainstorming, planning, subagent review, and test-driven development, preventing developers from drifting back to unstructured prompting under deadline pressure. Unlike hand-rolled skill setups, Superpowers uses a bootstrap instruction that automatically prompts the agent to check for relevant skills before every task, removing the need for manual slash commands. The package supports over a dozen platforms including Claude Code, Cursor, Codex, GitHub Copilot CLI, Devin CLI, and others, with harness-specific installation commands for each. Its core philosophy prioritizes writing tests first, systematic processes over guesswork, simplicity, and evidence-based verification of results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds API Key Leak Detector That Caught Only 8 of 20 Synthetic Tests

A developer has built an open tool called Cerberus that monitors API key usage metadata to detect credential leaks by flagging keys used from many origins with low per-origin workload. The system relies on three signals — origin count, work per origin, and network spread — and triggers a single Slack alert after three consecutive hours of suspicious activity. In internal testing using synthetic leak scenarios, the tool correctly identified only 8 out of 20 cases, with most failures occurring around low-baseline-traffic keys that suddenly become distributed. The creator attributes the gaps to manually guessed detection thresholds and a lack of real-world traffic data to calibrate the system. To address this, the developer is seeking three API companies willing to share two weeks of anonymised traffic history in exchange for free, permanent access to the tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Autonomously Detected and Diagnosed AWS Production Failure While Developer Slept

A software developer's AWS ECS payment service silently failed over 7,000 times across four days starting August 13, cycling through crashed tasks every 60 seconds with no alerts configured. The developer slept through the entire incident because no alarms or PagerDuty notifications had been set up for the affected service. An AI orchestration system called Kiro Crew, integrated with AWS DevOps Agent via an MCP configuration, autonomously detected the failure at 3:17 AM and completed a root-cause investigation within seven minutes. The agent ran five parallel investigations across ECS, CodeBuild, CodePipeline, and Lambda, identifying a health check misconfiguration where the container served static content instead of the expected endpoint. The developer shared the case as part of a series exploring how proactive AI-driven monitoring can close the gap between silent infrastructure failures and human awareness.

0 comments Read more at DEV Community