Madan Kumar@winklemad

winklemad:~$git log --author=winklemad --state=merged

I find and fix real bugs in the code the world runs on.

79
merged pull requests
73
in review
59
organizations
6
languages

// where I work

across the AI-infrastructure stack

Distributed systems & networking — concurrency, RPC, fault tolerance · docker/cli service panic, carapaceproxy auth-bypass (CWE-436/863), google/adk-go data race; gRPC-Go & Cloudflare in review

AI inference & serving — batching, serving, latency · openai-agents-python/js, DeepSpeed inference config, xformers attention FLOPs, keras broadcasting; vLLM & SGLang in review

Observability — metrics, tracing, failure diagnosis · prometheus histogram compaction, opentelemetry-python View matching

Data infrastructure — vector DBs, storage, retrieval · qdrant-client ×2, txtai ANN ordering, mongo-python-driver, haystack; LanceDB & Chroma in review

ML systems — training, quantization, fine-tuning, export · NVIDIA/Megatron-LM, timm ×5 (optimizer + factory + augmentation), huggingface/peft LoRA, coremltools ×2, timesfm; llm-compressor pruning scheduler, google/or-tools enforced constraints; quantization in review

// merged fixes

filter by organization

SQLFluffsqlfluff#8392MERGED
-The CV11 shorthand-cast autofix assumed the SQL data type sat at a fixed child index, so sqlfluff fix rewrote a[1]::INT into cast(cast(a as [1]) as INT) — silently corrupting the array subscript in the linter's own fix output
+Locate the data_type child by type and preserve the full left operand
Googleor-tools#5303MERGED
-add_enforced_linear_constraint wrote the indicator constraint's name, bounds and terms through the non-enforced helper setters using the enforced constraint's index — but enforced constraints live in a disjoint proto index space, so the writes silently corrupted an unrelated linear constraint in Google's OR-Tools solver
+Route the writes through the enforced-constraint helper setters
vLLMllm-compressor#3096MERGED
-The polynomial_decay pruning scheduler used (t − 1)^exp + 1, correct only for odd exponents; at the default even exponent the sparsity curve inverted — starting above the final value and decreasing
+Use 1 − (1 − t)^exp, correct for every exponent
Hugging Facetimm#2754MERGED
-The optimizer registry crashed with TypeError when layer_decay was requested without an explicit min scale — the default None flowed into max(None, float)
+Default the layer-decay min scale to 0.0, matching create_optimizer_v2
Hugging Facetimm#2749MERGED
-A ported axis shift collapsed AdafactorBigVision's row factor to 1 for weights whose larger dimension comes first (e.g. an [out, in] layer with out > in), silently dropping the row normalization and making the update depend on the matrix orientation
+Reduce over the retained axis so the factored update is transpose-equivariant again
Hugging Facetimm#2750MERGED
-SGDW's foreach path decayed the full parameter list inside the per-(device, dtype) loop, so parameters spanning more than one partition were weight-decayed (1 − lr·wd)^N instead of once
+Decay each group's device_params, matching the single-tensor path
Hugging Facetimm#2747MERGED
-The three public auto-augment factory functions crashed with AttributeError on their documented default hparams=None — each function's own docstring example triggered it
+Normalize hparams before the setdefault calls, using a copy of the defaults so the shared dict isn't mutated across calls
Hugging Facetimm#2748MERGED
-The documented off-values inc0 / b0 silently enabled the flag, because bool('0') is True in Python
+Parse as bool(int(val)) so 0 disables and 1 enables, matching the docstrings
dbt-scoredbt-score#222MERGED
-The manifest formatter dropped meta.score and meta.badge for seeds and macros
+Write the score and badge to manifest meta for every entity type, not just models and sources
marimomarimo-team/marimo#10617MERGED
-The dataframe transform code printer emitted .str.contains(value) for the literal contains filter, so copied code searched by regex — returning different rows than the widget and crashing on an unbalanced metacharacter
+Print a literal match so the generated code matches the handler's own literal=True filtering for pandas and Polars
Molliemollie-api-php#907MERGED
-The request filter used PHP empty(), silently dropping fields whose value was 0, "0" or 0.0
+Strip only null, "" and [] so a payment field of "0" survives the request
EleutherAIlm-evaluation-harness#4003MERGED
-A scalar seed: in a YAML config crashed with TypeError, and seed: 0 was silently ignored
+Normalize a scalar seed the way the CLI does, accepting lengths 1, 3 and 4
McKinseyvizro#1837MERGED
-A time filter raised on a time-of-day column that was not datetime64
+Dispatch on the value's type so real times are handled and other values fall through
McKinseyvizro#1838MERGED
-Slider step validation raised TypeError when max was set without min
+Require both bounds before comparing the step against the range
Sveltesvelte#18645MERGED
-The printer dropped the space before a {#await ... catch} binding, so output did not re-parse
+Print a space before the catch binding
OpenAIopenai-agents-python#3763MERGED
-Chat Completions dropped logprobs=True when top_logprobs was set → API returned a 400
+Forward logprobs=True whenever top_logprobs is present, matching the Responses path
OpenAIopenai-agents-js#1451MERGED
-Deserializing a RunState lost token usage → resumed runs silently under-reported usage (billing)
+Restore the serialized usage when rebuilding the run context
Metafacebookresearch/xformers#1402MERGED
-The attention profiler over-counted softmax@V FLOPs for non-square causal masks
+Count the Q@K and A@V components symmetrically
Microsoftdeepspeedai/DeepSpeed#8145MERGED
-DeepSpeedInferenceConfig crashed on a legacy boolean MoE value its own back-compat path was meant to accept
+Accept the legacy value instead of asserting on it
Googlegoogle-research/timesfm#463MERGED
-Quantile-flip invariance skipped the autoregressive branch → corrupted forecast bands past horizon 128
+Flip the AR outputs too, matching the reference flax implementation
carapaceproxydiennea/carapaceproxy#614MERGED
-Absolute-form request URIs bypassed a path-anchored ACL deny rule — an auth bypass (CWE-436 / CWE-863)
+Match ACL rules on the normalized forwarded path
pydanticpydantic/pydantic#13428MERGED
-__hash__ on WithJsonSchema / Examples ignored the mode value → distinct schemas collided
+Include mode in the hash
Unslothunslothai/unsloth#7073MERGED
-SyntheticDataKit.chunk_data emitted chunks over the requested max_tokens
+Respect the token limit when splitting
Mistralmistralai/mistral-common#262MERGED
-The seed field was dropped when bridging a SpeechRequest into the OpenAI format
+Carry seed through the conversion
Vuevuejs/pinia#3162MERGED
-Hydrating a store merged incoming reactive Set / Map state into the existing value instead of replacing it → stale entries survived
+Replace the reactive Set / Map on hydration
PrefectPrefectHQ/fastmcp#4492MERGED
-compress_schema mutated the caller's schema object in place → side effects on the passed-in data
+Copy before modifying, leaving the caller's schema untouched
uutils · Rustuutils/coreutils#13439MERGED
-paste -s -d didn't restart the delimiter cycle per file → output diverged from GNU coreutils
+Reset the delimiter list at the start of each file
htop · Chtop-dev/htop#2046MERGED
-A reset-on-fork scheduling flag was &=-ed instead of |=-ed → the policy was zeroed on every set
+OR the SCHED_RESET_ON_FORK bit into the policy
psycopg · Pythonpsycopg/psycopg#1373MERGED
-Two DataError messages were missing the f prefix → {...} placeholders printed as literal braces
+Add the f-string prefix so the offending values interpolate
Novunovuhq/novu#11984MERGED
-The digest name filter rendered "and 0 others" when maxNames already covered every item
+Omit the suffix when no names remain
jq · Cjqlang/jq#3586MERGED
-A zero-width global regex match advanced one code unit, not the whole Unicode codepoint — ["🚀" | match(""; "g")] | length miscounted multi-byte chars
+Advance past the full codepoint after a zero-width match
Appleapple/coremltools#2760MERGED
-Constant folding an exclusive cumulative sum could crash during Core ML graph optimization
+Handle the exclusive case correctly during folding
Keraskeras-team/keras#23265MERGED
-ops.select inferred the wrong output shape or dtype when its inputs required broadcasting
+Apply broadcasting rules consistently during symbolic inference
Google DeepMindgoogle-deepmind/mujoco#3418MERGED
-least_squares stopped on the xtol step tolerance before committing the accepted step, returning the previous, higher-objective iterate
+Accept the Armijo-approved candidate before terminating on xtol
Redisredis/node-redis#3344MERGED
-hScanValuesIterator yielded hash field names instead of their values
+Yield the value component promised by the iterator API
Qdrantqdrant/qdrant-client#1259MERGED
-Local-mode filters treated booleans and integers as interchangeable values
+Respect value types when matching local payload filters
Scrapyscrapy/scrapy#7728MERGED
-Repeated curl -d / --data options were not combined when creating a request
+Merge every supplied data segment like curl does
marimomarimo-team/marimo#10211MERGED
-Editing int8, uint8, or float16 columns could corrupt their numeric dtype
+Preserve narrow numeric dtypes through data-editor updates
SQLGlottobymao/sqlglot#7895MERGED
-TIMESTAMP_DIFF and DATETIME_DIFF produced incorrect Presto / Trino SQL
+Translate argument order and units to the target dialect correctly
Haystackdeepset-ai/haystack#12062MERGED
-Ellipsis was lost when round-tripping variadic tuple and callable type annotations
+Preserve the marker through type serialization and deserialization
Z.ai · GLM-Vzai-org/GLM-V#266MERGED
-ensure_list split valid string and byte values into individual elements
+Treat strings and bytes as scalar values when normalizing to a list
txtaineuml/txtai#1154MERGED
-IVFSparse returned sparse nearest-neighbor results out of score order
+Sort sparse ANN results before returning them
Twentytwentyhq/twenty#23010MERGED
-Multi-select “contains any” filters required every selected value instead of any one match
+Use OR semantics for the “contains any” matcher
Googlegoogle/adk-go#1139MERGED
-SearchMemory scanned the session store without holding the read lock → data race
+Hold the read lock for the whole scan
MongoDBmongodb/mongo-python-driver#2961MERGED
-Extended JSON $timestamp accepted extra keys and non-document values → malformed input parsed silently
+Reject anything but a single well-formed $timestamp document
Metafacebook/lexical#8873MERGED
-Unrestricted CSS selector groups were never dispatched during HTML conversion
+Dispatch every selector in the group
pytestpytest-dev/pytest#14754MERGED
-approx() with an infinite relative tolerance broke on timedelta values
+Handle infinite relative tolerance for timedeltas
Difylanggenius/dify#39215MERGED
-The RAG document cleaner stripped valid characters out of indexed text
+Strip only the intended control characters
Graphitigetzep/graphiti#1637MERGED
-The MCP server built its cross-encoder outside the provider configuration
+Configure the cross-encoder from providers
Qdrantqdrant/qdrant-client#1260MERGED
-Falsy values lost proto3 field presence across REST/gRPC → explicitly-set fields dropped
+Preserve field presence for falsy values
ColibriJustVugg/colibri#568MERGED
-Anthropic thinking output was emitted as one merged response block
+Split thinking blocks apart
Dockerdocker/cli#7145MERGED
-docker service update panicked when a value was passed twice — makeEnv/updateHosts deleted from a slice while ranging over it
+Fix the in-place deletion so duplicate env vars and hosts no longer crash the update
Appleapple/coremltools#2762MERGED
-noop_elimination stripped floor_div(x, 1) even for floats, silently dropping the flooring
+Keep floor_div(x, 1) for float inputs so the truncation semantics are preserved
ColibriJustVugg/colibri#567MERGED
-At the NGEN limit the final token was emitted but never written to the stateful KV cache, so :more resumed a token early and dropped the answer's tail
+Forward the capped token into the KV cache before advancing so stateful resumes stay in sync
Prometheusprometheus/prometheus#19312MERGED
-A second span merge inside Compact spliced its zero fill at a stale index, relocating real buckets and underflowing integer counts — a histogram that passed Validate() failed it straight after compaction
+Advance the bucket index past the span just absorbed, not only past the gap it filled
OpenTelemetryopentelemetry-python#5430MERGED
-The SDK lower-cases instrument names but matched views against the raw pattern, so a View built with an instrument’s real mixed-case name never matched — and fnmatch’s normcase made it match on Windows but not Linux/macOS
+Match instrument names case-insensitively and identically on every platform, so the view’s aggregation actually applies
Hugging Facehuggingface/peft#3425MERGED
-if layers_pattern and not layers_to_transform rejected the valid index 0 because zero is falsy, so the first layer could never be targeted — the same check was copy-pasted across 19 tuner configs
+Test for None explicitly, swept through every tuner config at once
MLXml-explore/mlx#3846MERGED
-log_cosh_loss’s docstring documented a mean-reduced scalar, but the function defaults to reduction="none" and returns a per-element loss
+Document the element-wise loss the default actually returns
Redisredis/redis-py#4209MERGED
-Both URL parsers documented that every querystring value is passed through unquote, but parse_qs already decodes them and no second pass happens — so the documented decoding behaviour was wrong
+Document the single decode that actually occurs, in the sync and async parsers
Anthropicclaude-code-action#1647MERGED
-Restoring trusted config ran an unconditional --depth=1 fetch, turning a fetch-depth: 0 checkout shallow: git log base..HEAD then listed already-merged commits and git diff base...HEAD died with "no merge base" — the two commands the action tells Claude to run
+Only limit the depth when the checkout is already shallow, keeping the speed-up where it was intended
NVIDIAMegatron-LM#5726MERGED
-Multimodal add_document derived its default modes from the wrong length, so documents were built against a mismatched count
+Use len(lengths) for the default modes
Rustrust-lang/cargo#17274MERGED
-A closing frontmatter fence one - short consumed a byte past the dashes, panicking when the next byte began a multi-byte char, and under-reported the difference by counting the newline as a dash
+Derive the dash count from the slice length so the span ends on a char boundary
Cloudflarecloudflare/chanfana#346MERGED
-Numeric request parameters were coerced loosely, so values that were not valid numbers passed validation and reached handlers
+Validate numeric parameters strictly so invalid input is rejected at the boundary
Pionpion/webrtc#3520MERGED
-A VP8 RTP payload carrying only the descriptor is legal, and VP8Packet.Unmarshal returns an empty payload for it without error — the IVF writer then read Payload[0] and panicked, so any remote peer could crash a recording process
+Skip the packet when the depacketized payload is empty, matching the guard the AV1 branch already had
Netflixmetaflow#3357MERGED
-Service metadata patterns were matched unanchored, so a foreach task path prefix-matched a different task and the client resolved the wrong parent and child tasks
+Anchor the patterns so a path matches only the task it names
Apache Arrowarrow-go#1219MERGED
-Concatenating a sliced RunEndEncoded array carried run ends past the end of the slice, and the arithmetic ran through int, so a run end near MaxInt64 overflowed
+Clamp run ends to the input length and keep the arithmetic in the run-end type
gRPCgrpc-go#9353MERGED
-xDS route header matchers compared header names case-sensitively, so a control plane sending a capitalised name silently matched nothing and traffic fell through to the wrong route
+Lowercase RDS route header matcher names before matching, as HTTP/2 requires
Jestjest#16345MERGED
-jest-each built a RegExp straight from the table's keys, so a key containing regex metacharacters produced a corrupted title or threw while naming the test
+Escape the keys, drop empty ones and match the longest first so overlapping names interpolate correctly
Streamlinkstreamlink#7075MERGED
-A DASH SegmentTimeline honoured the @t start time only on the first segment, so a timeline with a mid-stream discontinuity kept counting from the old base and requested segments that do not exist
+Honour @t wherever it appears, so the timeline follows the manifest across a gap
cattrscattrs#771MERGED
-Structuring and unstructuring code is generated as source text, and a field renamed to a value containing a quote was interpolated raw — producing code that either failed to compile or silently read the wrong key
+Escape rename keys when generating the code so any legal rename round-trips
Qdrantqdrant-client#1377MERGED
-Local mode sorted facet values and point ids directly, so a collection mixing integer and string ids — which the server accepts — raised TypeError instead of returning results
+Order heterogeneous values through the same key the rest of the client already uses
Qdrantqdrant-client#1379MERGED
-Recommend, discovery, context and feedback queries in local mode ranked results with the wrong score orientation, so the in-memory backend disagreed with the server on which matches were best
+Derive the orientation per query type so local mode matches the server
SQLFluffsqlfluff#8419MERGED
-Duplicate-whitespace fixes were anchored on a neighbouring segment rather than the whitespace actually removed, so sqlfluff fix reported edits at the wrong position
+Anchor each fix on the whitespace it removes
Hugging Facetimm#2758MERGED
---model-kwargs split each value on every = and parsed it as a literal, so a value containing = or a plain string crashed the training script during argument parsing
+Split once and fall back to the raw string when the value is not a literal
marimomarimo#10653MERGED
-ui.dictionary and .batch were typed against an invariant mapping, so passing a dictionary of a concrete element subclass — the ordinary usage — failed type checking
+Accept a covariant Mapping of elements, with a type-level test pinning it
McKinseyvizro#1849MERGED
-Building a single-select selector whose options list was empty indexed the first option unconditionally and raised IndexError, so a dashboard filtered down to no options crashed instead of rendering empty
+Guard the empty case and leave the selector with no value
Narwhalsnarwhals#3891MERGED
-str.slice(..., length=0) returned the whole remainder of each string on the pandas and dask backends, because a length of zero was treated as unset — the other backends returned an empty string
+Distinguish a zero length from an absent one so every backend agrees
Googleadk-go#1138MERGED
-Schema comparison treated required and the other set-valued keywords as ordered, so two schemas that differ only in the order they list the same fields compared as unequal
+Normalise the unordered keywords before comparing
ByteDancedeer-flow#4867MERGED
-A skill written with a blank SKILL.md description was accepted at the write gate, producing a skill the loader could never surface
+Reject a blank description where the skill is written, not where it is read

// currently in review

73 open
Meta Anthropic Atlassian Cloudflare OpenAI Google DeepMind Google Cloud Firebase pytest NVIDIA Apple Hugging Face Qdrant Spotify scikit-learn vLLM MLflow Microsoft OpenSearch Supabase see all →

// shipped solo

product · < 90 days
PhantomAI multichannel LLM gateway SHIPPED

One workspace and a REST API that route across 9 model providers — OpenAI, Anthropic, Google, Mistral, DeepSeek, xAI, Azure, OpenRouter, and Ollama — with streaming responses, isolated per-user API keys, and a Stripe-metered, per-model credit-billing system. Built end to end, solo, in under 90 days.

Frontend
React 18 · Vite · TypeScript · shadcn-ui / Tailwind · Next.js
Backend
Supabase (Postgres · row-level security · Edge Functions) · Stripe · Vercel

// how i work

Languages
Python · TypeScript / JavaScript · Rust · Go · Java · C
Domains
AI / ML infrastructure · LLM & agent tooling · databases · backend APIs · data engineering · systems · application security
Method
Read the source → reproduce red → fix the whole bug class → prove it with a test → ship.

Get in touch.

Always happy to talk shop about debugging, systems, and open source.

✉ Email me GitHub ↗ LinkedIn ↗ X ↗ ♥ Sponsor ↗ All pull requests ↗