Testing
4 articles about "Testing".
A Promise That Never Settles: How a Failed IndexedDB Write Left the MITRE ATT&CK Search Spinning
A new Promise(async (resolve) => ...) that never took a reject cannot fail. When the IndexedDB chunk write inside it threw, the promise handed to the caller did not reject, it never settled at all, so the .catch the authors had already written could never fire and the search spinner ran until the tab closed. Using mitre-attack/attack-website #637 to explain Promise executor semantics, why clearing ESLint's no-async-promise-executor would not have fixed it, and how to write a test that tells a hang apart from a rejection.
One Character Made 775 Reserve Rows Wrong: Inside chainladder's CapeCod.predict Bug
chainladder-python, maintained by the Casualty Actuarial Society, is the standard library actuaries use for loss reserving. CapeCod.predict() had a condition written as > 1 that should have been > 0, so the most common usage got the wrong apriori: the comauto line fitted 0.569, predict returned 1.252, and all 775 rows were off. An existing test covered the path and still missed it, because its dataset always walked the other branch. On what the Cape Cod method computes, why the line was wrong, how the test missed, and the AI-use disclosure filed under casact's policy.
A Named Parameter Never Reaches **kwargs: Why Every Disaster Photo in HOT's Drone System Was Stored as the Wrong Type
A function declared content_type in its signature and documented it, then called the downstream SDK with positional arguments plus **kwargs. Because content_type is a named parameter, Python bound the value to it and left kwargs empty, so every post-disaster aerial photo went into S3 as application/octet-stream and browsers downloaded it instead of showing it. Using hotosm/drone-tm #882 to explain Python's binding rules, why metadata in the same function was fine, and a test technique that binds mocks to the real SDK signature.
Seven PRs Merged Into Six Organizations in 24 Days: What the Maintainers Taught Me
Between August 12 and September 5, 2026, 24 days, maintainers at the Casualty Actuarial Society (twice), CERT/CC, the UK AI Security Institute, FINOS, NIST and Humanitarian OpenStreetMap merged seven of my pull requests. This is a line-by-line account: where each bug was, why the existing tests missed it, and what the reviewer corrected. Six unrelated projects, three root causes: Linux-only CI, tests that pass for the wrong reason, and sentinel or binding semantics that betray intuition. Every PR is linked.