The bugs already sitting in popular lockfiles.

Every project

Scanned on 2026-10-23 at the commit shown. Open issues: distinct open GitHub issues that name the exact version the lockfile pins. Runtime: in dependencies the lockfile doesn't mark as dev-only. API-specific: tied to named functions or options, which the pre-edit hook watches. Workaround: the thread has one.

Coding agents (median 430.5)

Apps and libraries (median 343.5)

Across all 28 projects: 6,622 distinct issues, 4,788 of them API-specific. browser-use/browser-use commits no lockfile, so there was nothing to scan.

Checked examples

The 14 below were each read in full and kept only if the issue is open, is a bug report, was confirmed on the exact version pinned, and is in the package named. They come from the three most-discussed API-specific runtime issues per project: 41 of those 84 candidates passed. Heavily discussed issues fail more often than average, because long threads collect "fixed in X" and other versions.

• sympy@1.14.0, sympy/sympy#28169. sympy.discrete.transforms.fft uses the opposite sign in the exponent, so it effectively computes the inverse DFT (e.g. fft([0,1,0,0]) returns [1, I, -1, -I] instead of [1, -I, -1, I]). Pinned by Aider-AI/aider
• vaul@1.1.2, emilkowalski/vaul#492. A controlled Drawer with modal={false} that is opened from outside (via the open prop) leaves pointer-events: none on the body, blocking interaction with the rest of the page. Pinned by cline/cline, QwenLM/qwen-code, supabase/supabase, shadcn-ui/ui, Significant-Gravitas/AutoGPT, outline/outline, dubinc/dub
• next-auth@5.0.0-beta.25, nextauthjs/next-auth#7558. When the jwt callback refreshes an access token, next-auth does not persist the returned token, so later requests keep using the old, expired one. Pinned by vercel/chatbot
• react-dom@19.3.1, react/react#37899. When an element's type changes from a React.lazy wrapper to the plain component it resolved to, React remounts it and discards its state (e.g. RSC client components later rendered from plain JSX). Pinned by mastodon/mastodon, langgenius/dify, immich-app/immich
• next@16.3.8, vercel/next.js#87737. Turbopack production builds reference external modules by hashed aliases (e.g. require-in-the-middle-<hash>) that fail with "Cannot find module" when node_modules is reinstalled or laid out differently at runtime; next build --webpack works. Pinned by Kilo-Org/kilocode, twentyhq/twenty
• node-fetch@3.3.2, node-fetch/node-fetch#1801. Aborting a node-fetch request with a body via AbortSignal can crash the process with an unhandled 'error' event, because the request body stream has no error listener when destroyed. Pinned by continuedev/continue, dubinc/dub, lobehub/lobehub
• @phosphor-icons/react@2.1.10, phosphor-icons/react#135. Recent releases mislabel the CommonJS build as ESM (type: module with a .js CJS file), so tools such as Vitest, Playwright and Sanity fail with "ReferenceError: exports is not defined"; 2.1.8 works. Pinned by mastodon/mastodon, shadcn-ui/ui, Significant-Gravitas/AutoGPT
• vite@8.0.16, vitejs/vite#21903. Production builds can link auto-imported component CSS chunks in a different order than dev (e.g. a component stylesheet before index.css), so the CSS cascade differs between dev and production and the wrong rules win. Pinned by OpenHands/OpenHands, twentyhq/twenty
• @modelcontextprotocol/sdk@1.32.1, modelcontextprotocol/typescript-sdk#2721. McpServer always emits tool outputSchema as JSON Schema draft-07 with no way to choose 2020-12, so clients that accept only 2020-12 reject every tool that declares an outputSchema. Pinned by shadcn-ui/ui, lobehub/lobehub
• pytube@15.0.0, pytube/pytube#1678. pytube raises RegexMatchError: get_throttling_function_name: could not find match for multiple when fetching streams because its regex no longer matches YouTube's player JS. Pinned by crewAIInc/crewAI
• react-data-grid@7.0.0-beta.47, Comcast/react-data-grid#3463. In production builds, react-data-grid header cells collapse when columns are resizable, sortable or frozen, because the minifier merges its nested @layer CSS rules. Pinned by supabase/supabase, vercel/chatbot
• next@16.4.0, vercel/next.js#82117. Next.js emits duplicate Location headers for redirect()/permanentRedirect() on static/ISR routes, which some proxies and clients turn into a broken /target,/target redirect. Pinned by documenso/documenso
• exceljs@4.4.0, exceljs/exceljs#683. The streaming XLSX reader sometimes returns { sharedString: n } placeholder objects instead of the actual cell strings. Pinned by cline/cline, QwenLM/qwen-code
• @tanstack/react-table@9.2.4, TanStack/table#6601. In TanStack Table v9 with React Compiler, replacing data from an external source does not re-render components built with createTableHook, so they keep showing stale rows. Pinned by fastapi/full-stack-fastapi-template

How many are real

We drew 40 issues at random (seed 20261023) from the 4,788 distinct API-specific issues and had each one read in full by an agent that didn't build the tool.

• Where the version was wrong. Four were a sibling package from the same repository (an @xterm/xterm bug counted against @xterm/headless). Two took the version of another package in a dependency list. Two read "6.0.3 is fine" as the affected version. One was a semver range, not an installed version, and one was unclear.
• Consistent with the earlier measurement. ACCURACY.md found 78% and 82.5% on two held-out samples.
• One labeller per issue, an AI agent. Every label, with the quote that decided it, is in audit.json.

Method

• Projects. 10 open-source coding agents and 19 widely used apps and libraries, chosen before scanning.
• Lockfiles. Every pnpm-lock.yaml, yarn.lock, bun.lock, package-lock.json, uv.lock, poetry.lock, Pipfile.lock or requirements*.txt at most three folders deep, outside tests, fixtures, examples and docs. Folders that don't ship (evals, sandboxes, scratch artifacts, integration-test projects) were dropped afterwards and are listed in the data.
• Counting. Exactly what landmine scan prints: weak mentions and non-bugs left out, and each issue counted once per project even when several packages or lockfiles pin it.
• Reproduce. scripts/showcase/run.sh, aggregate.py and sample.py in the repository, with landmine 0.2.1. Issues get opened, closed and edited, so a rerun on another day will differ.

Caveats

• An open issue in a dependency is not a bug in the project. The project may never call the affected API, may already work around it, or may not meet the conditions.
• Dev tooling is included. TypeScript, Prettier and test runners carry many issues. The runtime column leaves dev-only dependencies out.
• Precision is about 75%, measured above; the raw counts are what the tool reports, not audited totals.
• Recall is not measured. Bugs whose reports don't name a version are missed entirely.

Scan yours

npx landmines scan                 # what's in your lockfile
npx landmines install --rules      # put it where your agent reads it
npx landmines share                # one postable line and a README badge