Dev Tools · 5h ago
Data-loss fix sat in green PR for 4 days; 1,400 weekly users exposed
A critical bug in the Safari-MCP tool allowed an AI agent to access user tabs after a tab was closed. The fix was submitted and passed CI on July 17 but wasn't merged until July 21 due to manual release steps. During that window, roughly 1,400 weekly npm installs received the buggy version.
Meridian48 take
The story highlights a common DevOps failure: CI tells you code is correct, but nothing tells you it's stuck in a manual release pipeline.
Read the full reporting
My fix for a data-loss bug sat in a green PR for four days. Every install in that window still had the bug. →
DEV Community
devopsrelease-pipeline