PullLight found 4 issues

supabase/sdk #51 — feat(smithy): add canonical Smithy models for APIs by @grdsdev Jul 14, 2026

2 high 2 medium

🔍

// convert to your repo

PullLight caught 4 2 high, 2 medium on this PR.

Install on supabase/sdk to get this on every PR automatically — 60 seconds.

Install on supabase/sdk → Tweet this

Findings

4 issues

medium other

This file contains an absolute local filesystem path (`/Users/guilherme/src/github.com/supabase/sdk/.claude/worktrees/...`) and is a Gradle build artifact that should not be committed. It leaks the developer's local directory structure and username. The `smithy/extensions/.gradle/` and `smithy/extensions/build/` directories should be covered by `.gitignore`, but the `smithy/.gitignore` only ignores `extensions/.gradle/` and `extensions/build/` relative to the `smithy/` directory — verify those patterns actually match and remove all committed build artifacts.

// smithy/extensions/build/kotlin/compileKotlin/cacheable/dirty-sources.txt:1

high null-deref

`d["components"]["schemas"]` is accessed without checking that `d["components"]` exists. If the generated OpenAPI file has no `components` key (e.g. for a minimal or malformed output), this will raise a `KeyError`. Use `d.get("components", {}).get("schemas")` or guard with an explicit check before writing.

// smithy/patch-openapi.py:33

⚡ Suggested fix

if service_title == "Supabase Database API":
    components = d.setdefault("components", {})
    schemas = components.setdefault("schemas", {})
    schemas["FilterOperator"] = {
        "type": "string",
        "description": (
            "PostgREST column filter operators. "
            "Format a filter value as \"{operator}.{value}\", e.g. \"eq.5\". "
            "Prefix with \"not.\" to negate: \"not.eq.5\". "
            "For logical grouping use keys \"or\" / \"and\" in the filters map."
        ),
        "enum": [
            "eq", "neq", "lt", "lte", "gt", "gte",
            "like", "ilike", "match", "imatch",
            "is", "isdistinct", "in",
            "cs", "cd", "ov",
            "sl", "sr", "nxl", "nxr", "adj",
            "fts", "plfts", "phfts", "wfts",
        ],
    }

high null-deref

`d["components"]["schemas"].get("UploadChunkInputPayload", {})` will raise `KeyError` if `d["components"]` or `d["components"]["schemas"]` is absent in the Storage OpenAPI output. Use `d.get("components", {}).get("schemas", {}).get("UploadChunkInputPayload", {})` instead.

// smithy/patch-openapi.py:76

⚡ Suggested fix

schema = d.get("components", {}).get("schemas", {}).get("UploadChunkInputPayload", {})
if schema.get("format") == "byte":
    schema["format"] = "binary"

medium other

The static initializer and the `updateOperation` method both write to `System.err` unconditionally. These debug `println` statements will appear in every Smithy build invocation's stderr output for all users of this library. They should be removed or replaced with a proper logging mechanism before this is used as a shared build dependency.

// smithy/extensions/src/main/java/io/supabase/smithy/MultipartFormOpenApiMapper.java:31

model: claude-sonnet-4-5 input: 27768 tokens output: 1262 tokens

PullLight found 4 issues

Want this on every PR in supabase/sdk?