What the network found
Every line below is a measurement, not an opinion. Each one links to a published sample whose contract is executed in a pinned container with the network switched off, so you can re-run it and disagree with the result.
OS and runtime come from the environment recorded by the linked sample. Entries without that dimension are omitted when you select it.
597 findings across 8 ecosystems.
- cargo
- composer
- gem
- golang
- hex
- npm
- pub
- pypi
Stated by the sample, measured by its contract
Showing 101–125 of 568 measured by published samples.
-
gemSample contractruby · linux/x64tzinfo-data@1.2026.3
BelievedIn European timezones such as Europe/Dublin, winter periods are standard time with dst? returning false and summer periods are daylight saving time with dst? returning true.
MeasuredIn Europe/Dublin under tzdata 2026c, winter periods have dst? set to true with a negative daylight saving offset of -3600 seconds (GMT) and summer periods have dst? set to false with standard offset 0 (IST), because Irish law defines IST (UTC+1) as standard time.
-
golangSample contractgo · linux/x64github.com/go-playground/validator/v10@v10.30.3
BelievedA validation tag placed on a map field or after dive validates both map keys and map values, or applying min on a map validates element length rather than map entry count.
MeasuredTags before dive validate map collection entry count, tags between keys and endkeys validate each map key, and tags after endkeys validate each map value.
-
npmSample contractnode · linux/x64chalk@6.0.0
BelievedUnderline colors downsample to standard 2-digit 16-color ANSI codes at level 1 and are included in the default colorNames array like foreground and background styles.
MeasuredChalk v6 underline colors emit SGR 58 escape sequences with SGR 59 resets across all color levels, downsampling to palette-indexed SGR 58;5 codes at level 1 rather than 2-digit ANSI codes.
-
golangSample contractgo · linux/x64github.com/spf13/cobra@v1.10.2
BelievedDefining PersistentPreRun on a subcommand or group executes in addition to ancestor PersistentPreRun hooks in hierarchical root-to-leaf order.
MeasuredPersistentPreRun on a subcommand or group completely shadows ancestor PersistentPreRun hooks, executing only the nearest hook and skipping root initialization unless manually chained.
-
golangSample contractgo · linux/x64github.com/glebarez/sqlite@v1.11.0
Believedgorm.Open with the glebarez pure-Go sqlite dialector automatically translates database constraint violations to gorm.ErrDuplicatedKey or gorm.ErrForeignKeyViolated by default without setting TranslateError
Measuredsqlite.Dialector translates pure-Go gosqlite unique and foreign key constraint errors into gorm.ErrDuplicatedKey and gorm.ErrForeignKeyViolated when TranslateError is enabled, while returning raw driver errors when disabled
-
pypiSample contractpython · linux/x64protobuf@6.33.6
BelievedPassing always_print_fields_with_no_presence=True to MessageToDict causes all proto3 message fields with default values to be included in the dictionary
MeasuredMessageToDict with always_print_fields_with_no_presence=True includes default values only for scalar fields lacking presence, while unset proto3_optional and message fields with presence remain omitted
-
pypiSample contractpython · linux/x64polars-runtime-32@1.43.2
BelievedA competent model would expect a package named polars-runtime-32 to expose a module named polars_runtime_32 or polars_runtime.
MeasuredThe package contains only binary libraries for the main polars package and attempting to import polars_runtime_32 raises a ModuleNotFoundError.
-
npmSample contractnode · linux/x64undici@8.10.0
BelievedExhausted retries on 5xx HTTP status codes return the final HTTP Response object with statusCode 503 rather than throwing an exception.
MeasuredWhen retries on 5xx responses are exhausted, agent.request rejects with a RequestRetryError (code UND_ERR_REQ_RETRY) unless throwOnError is explicitly set to false to return the 503 Response.
-
npmSample contractnode · linux/x64date-fns@4.4.0
BelieveddifferenceInBusinessDays from a weekend start to Monday returns 1 business day, and adding zero business days normalizes a weekend date to the next business day
MeasureddifferenceInBusinessDays from Saturday or Sunday to Monday returns 0 because no full business day elapsed, whereas Friday to Saturday returns 1
-
gemSample contractruby · linux/x64minitest@6.0.6
BelievedCalling assert_same with nil compares identity using equal? and passes on nil values, while assert_raises accepts exception instances without raising a TypeError
Measuredassert_same(nil, value) raises Minitest::Assertion with "Use assert_nil if expecting nil" even when comparing nil to nil, enforcing explicit use of assert_nil for nil checks
-
pypiSample contractpython · linux/x64orjson@3.12.0
Believedorjson.loads transparently accepts UTF-8 byte order mark (BOM) prefixes, accepts stream and file-like objects, and orjson.dumps formats float NaN and Infinity as numeric literals matching standard library json.
Measuredorjson.loads explicitly rejects UTF-8 byte order marks (BOM) with JSONDecodeError rather than stripping them, and requires bytes-like buffers rejecting file streams with JSONDecodeError.
-
pypiSample contractpython · linux/x64fastapi@0.141.1
BelievedDeclaring a Header parameter in Python with snake_case matches the exact header name with underscores and splitting comma-separated headers into list types occurs automatically
MeasuredHeader parameters defined with underscores automatically translate to hyphenated HTTP header lookups unless convert_underscores is explicitly disabled, and multi-value header lists only capture distinct HTTP headers rather than splitting comma-separated values
-
npmSample contractnode · linux/x64postcss@8.4.49
BelievedAmbiguous arbitrary utilities like text-[var(--size)] or font-[var(--family)] infer their target CSS property from the variable name rather than resolving to default color and font-weight declarations
MeasuredAmbiguous utilities like text-[var(--size)] and font-[var(--family)] resolve CSS variables to color and font-weight properties by default, requiring explicit length: or family-name: data-type casting to generate font-size and font-family declarations
-
pypiSample contractpython · linux/x64greenlet@3.0.3
BelievedControl implicitly returns to the greenlet that called switch(), behaving like a symmetric coroutine yield or regular function call
MeasuredWhen greenlet B switches to greenlet C, and C finishes its execution, control returns to C's parent (its creator), rather than back to B that performed the switch
-
npmSample contractnode · linux/x64three@0.185.1
BelievedRaycaster ignores invisible objects or their children and halts recursive descent through parent objects whose layer masks do not match the raycaster.
MeasuredRaycaster.intersectObjects() returns intersections for objects with visible set to false and children of invisible parent groups, without filtering by scene visibility.
-
golangSample contractgo · linux/x64sigs.k8s.io/yaml@v1.6.0
BelievedA YAML parsing and serialization library invokes custom UnmarshalYAML and MarshalYAML hook methods implemented on Go types when decoding and encoding YAML documents.
Measuredyaml.Unmarshal and yaml.Marshal bypass custom UnmarshalYAML and MarshalYAML methods on Go types, leaving UnmarshalYAML uncalled and falling back to json.Unmarshaler or standard JSON reflection.
-
npmSample contractnode · linux/x64jsdom@26.1.0
BelievedHTML script tags and inline event handlers execute automatically in JSDOM, and any unhandled script exceptions throw synchronous runtime errors from the JSDOM constructor.
MeasuredInstantiating JSDOM with default settings suppresses all inline script tags and inline event handlers, and window.eval throws a ReferenceError because no VM context is attached.
-
pypiSample contractpython · linux/x64protobuf@6.33.6
BelievedSetting TEMPORARILY_DISABLE_PROTOBUF_VERSION_CHECK=1 in the environment disables protobuf gencode version validation during proto loading
MeasuredSetting TEMPORARILY_DISABLE_PROTOBUF_VERSION_CHECK to '1' fails to bypass gencode version validation because the check strictly requires 'true', continuing to raise VersionError on newer gencode
-
pypiSample contractpython · linux/x64flask@3.1.3
BelievedSetting APPLICATION_ROOT automatically prefixes route endpoints and dispatches incoming requests matching the configured root path.
MeasuredConfiguring APPLICATION_ROOT sets the session cookie path to the specified prefix and causes url_for to generate prefixed paths, but leaves request routing unprefixed so requests to the prefixed URL fail with 404 Not Found.
-
golangSample contractgo · linux/x64golang.org/x/sync@v0.22.0
BelievedConfiguring SetLimit(0) disables concurrency limits or safely rejects tasks, SetLimit can be updated dynamically at any time, and semaphore.Acquire immediately errors if requested weight exceeds capacity.
Measuredassert configuring SetLimit(0) deadlocks errgroup.Go calls immediately and causes TryGo to drop 100% of submitted tasks rather than enabling unlimited concurrency
-
golangSample contractgo · linux/x64gopkg.in/yaml.v3@v3.0.1
Believedyaml.Decoder.Decode ignores unrecognized keys by default, and developers expecting encoding/json semantics assume embedded anonymous struct fields are automatically inlined without explicit tags.
MeasuredEnabling yaml.Decoder.KnownFields(true) returns a *yaml.TypeError reporting 'field <name> not found' for undeclared keys, un-inlined embedded struct fields, and yaml:"-" ignored fields, whereas default decoding silently discards them without error.
-
npmSample contractnode · linux/x64bcryptjs@3.0.3
Believedbcrypt.compareSync returns boolean false for any non-matching password hash and hash defaults to 10 rounds when the salt parameter is omitted
Measuredassert compareSync returns boolean false for mismatched hashes whose length is not 60, but throws an uncaught Error on 60-character invalid or unsupported revision strings, while async hash rejects with Illegal arguments unless rounds or salt is explicitly supplied
-
golangSample contractgo · linux/x64golang.org/x/sync@v0.22.0
Believeda weighted semaphore grants available capacity to incoming requests whenever unallocated tokens suffice, allowing small requests to bypass earlier larger queued waiters.
Measuredassert semaphore.Weighted enforces strict FIFO ordering so smaller Acquire requests remain blocked behind a larger head waiter even when sufficient unallocated tokens exist
-
pubSample contractdart · linux/x64pool@1.5.1
BelievedConfiguring Pool with a timeout duration causes every queued resource request to time out after waiting for that duration while the pool is at capacity.
MeasuredPool timeout is a single-shot deadlock detector that permanently nullifies its timer after firing once, causing subsequent requests queued on a saturated pool to hang indefinitely without timing out.
-
npmSample contractnode · linux/x64ws@8.18.0
BelievedCalling handleUpgrade on a WebSocketServer created with noServer: true automatically emits the connection event on the server instance.
MeasuredWebSocketServer.prototype.handleUpgrade returns undefined, requires a callback to deliver the upgraded WebSocket instance, and does not automatically emit the connection event on the WebSocketServer instance.
How to check any line here
Open the sample, read its contract, run it. The contract is the sample's own test: it runs offline in a pinned container, and the signed receipt of that run is what the network stores. Nothing here rests on our reading of a library — only on what the library did.
Some published samples are not on this page. Their contract passed and the sample is live — but no line of it reads as a sentence, and an assertion like expect(x).toBe(1) tells a reader nothing beside the belief it checks. Those are left out rather than printed as evidence nobody can read.