SShortSingh.
Back to feed

Developer finds idempotency guard fails open on the exact error it was built to catch

0
·3 views

A developer discovered two bugs in a duplicate-publish guard added to their DEV.to publishing script just days after it was written. The first flaw was a missing pagination parameter, limiting duplicate checks to only the 30 most recent articles on an account with over 100 posts. The more critical issue was in the exception handler: when the verification GET request hit a URLError — the exact network failure the guard was built to handle — the function returned None, telling the caller to proceed with publishing anyway. This caused the guard to fail open precisely when a retry was most likely to create a duplicate live article. The incident also revealed that an internal bug log had incorrectly documented the function as already handling pagination, underscoring how documentation can become unreliable without regular cross-checking against actual code.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Codename One Adds Cross-Platform Health API With Privacy-Aware Design

Codename One, an open-source framework for building native apps from a single Java or Kotlin codebase, has merged a cross-platform health API via PR #5475 into its core. The API covers HealthKit, Health Connect, recorded workouts, nutrition, Bluetooth health sensors, and deterministic simulation across four dedicated packages. A key design decision reflects iOS HealthKit's privacy model: when a user denies read access, the API returns no data rather than an error, making it indistinguishable from an empty store. Developers are guided to display 'no data available' instead of assuming denial, avoiding accidental disclosure of a user's privacy choices. All results and sensor events are delivered on the Codename One Event Dispatch Thread, ensuring consistent behavior across phones, simulators, and desktop environments.

0
ProgrammingDEV Community ·

Developer Builds Mood-Based Pakistani Comfort Food Landing Page for Frontend Challenge

A developer created Dastarkhwan, an interactive landing page celebrating Pakistani comfort food, as a submission for the DEV Community Frontend Challenge 2026. The site allows visitors to select their current mood and receive a comfort-food recommendation based on it. Featured dishes include Biryani, Nihari, Daal Chawal, and Paratha & Chai, all presented through a warm, nostalgic visual design. Built using HTML, CSS, and JavaScript, the project emphasizes responsive design, accessibility, and simple interactions. The live demo is hosted on Vercel, with food imagery sourced from free-to-use platforms Pexels and Unsplash.

0
ProgrammingDEV Community ·

Microsoft 365 Agents SDK Shifts Bot Control From Developers to AI Planning

A technical comparison between Microsoft's Bot Framework SDK and the Microsoft 365 Agents SDK reveals a fundamental shift in how bots handle logic and control flow. The Bot Framework requires developers to manually write branching logic, with every possible input enumerated at compile time. The Microsoft 365 Agents SDK instead lets developers register tools and define a goal, allowing the AI model to determine the sequence of steps at runtime. This distinction becomes critical for complex, multi-step tasks — such as checking deployment status and triggering a rollback — where hand-written branching quickly becomes impractical. The choice between the two frameworks ultimately determines where bugs appear, what testing must cover, and whether human-in-the-loop safeguards are needed.

0
ProgrammingDEV Community ·

Eight Webhook Providers, Four Hidden Ways They Each Sign Requests Differently

A developer integrating webhooks across Stripe, GitHub, Shopify, Slack, Paddle, Twilio, Telegram, and Standard Webhooks documented key differences in how each provider signs and verifies requests. While most use HMAC-SHA256, they diverge on encoding (hex vs. base64), timestamp validation windows, and exactly what data gets signed. Twilio stands out as the biggest outlier, using the older SHA-1 algorithm and signing the request URL rather than the payload, requiring an extra body digest check for JSON deliveries. Stripe and Standard Webhooks share a visually identical secret prefix but decode their keys differently, causing silent verification failures if confused. A common pitfall across all providers is framework-level JSON re-parsing, which can strip whitespace or reorder keys and silently invalidate signatures before verification even begins.