Pattern Library

Upgrade the Langfuse SDK to v2 following this guide.

Convert OpenAI from openai version to the v1 version.

This migration attempts to encode some of the Azure-specific details for migration to OpenAI Python SDK v1.x.

Convert OpenAI from openai version to the v1 version, while continuing to use the global client. This is a variant of the client-based version.

Convert Chai test assertions to Jest.

Migrate from CodeceptJS to Playwright.

Migrate from Cypress to Playwright.

Converts arrow function single expression to to block body

Converts function expressions to ES6 arrow functions

Converts CommonJS module.exports to ES6-style exports.

Converts require statements to ES6-style import.

Migrate from the legacy Hathora Cloud SDK to the TypeScript SDK.

Transform io-ts schemas to zod schema

Convert Jest tests to Vitest

Knockout.js is an older JavaScript framework that is still used by many developers. This migration helps with migrating your Knockout code to React.

Upgrade the Langfuse SDK to v2 following this guide.

This pattern combines convert_default_exports and _convert_default_imports to replace default exports to named exports and replace default imports with named imports.

This pattern migrates from React Query v3 to React Query v4. It is the equivalent of the codemod.

Creating a styled component inside the render method in React leads to performance issues because it dynamically generates a new component in the DOM on each render. This causes React to discard and recalculate that part of the DOM subtree every time, rather than efficiently updating only the changed parts. This can result in performance bottlenecks and unpredictable behaviour.

Upgrade the Mux SDK to v8 with Stainless

Upgrade the OpenAI SDK to v4 following this guide.

Switch the OpenAI JS/TS SDK to use OpenRouter.

Protractor to Playwright.

This pattern converts React class components to functional components, with hooks.

The 'schemaDirectives' option in Apollo GraphQL, which was effective in ApolloServer version v2, no longer functions in versions >=3 and above. This change can have significant implications, potentially exposing authenticated endpoints, disabling rate limiting, and more, depending on the directives used. To address this, it is recommended to consult the references on creating custom directives specifically for ApolloServer versions v3 and v4.

Prefer to use early returns to keep functions flat.

Detected a channel guarded with a mutex. Channels already have an internal mutex, so this is unnecessary. Remove the mutex.

v2.x of the Go SDK is a ground-up rewrite, using code generation from the OpenAPI spec. There are significant breaking changes.

$VALUE serves as a loop pointer that might be exported from the loop. Since this pointer is shared across loop iterations, the exported reference will consistently point to the last loop value, potentially leading to unintended consequences. To address this issue, duplicate the pointer within the loop to ensure each iteration has its own distinct reference.

Grit includes standard patterns for declaratively adding or finding imports.

Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using go.

Using the none algorithm in a JWT token is risky because it assumes the token's integrity is already ensured. This could let a malicious actor create a fake JWT token that gets automatically verified. Avoid using none and go for a safer algorithm like HS256 instead.

The Go SDK has been rewritten for v5 and contains significant changes.

Identified a potential risk in converting the outcome of a strconv.Atoi command to int16. This may lead to integer overflow, possibly causing unforeseen issues and even privilege escalation. It is recommended to utilize strconv.ParseInt instead.

If statements that always evaluate to true or false are redundant and should be removed.

Utilize filepath.Join(...) instead of path.Join(...) as it accommodates OS-specific path separators, mitigating potential issues on systems like Windows that may employ different delimiters.

Identical statements found in both the if and else bodies of an if-statement. This results in the same code execution regardless of the if-expression outcome. To optimize, eliminate the if statement entirely.

PgTAP is a unit testing framework for Postgres. This pattern adds a unit test checking a procedure has been correctly defined.

In Postgres, function and procedure bodies need to be wrapped in $$dollar quotes$$. This pattern wraps a PLSQL CREATE PROCEDURE body in dollar quotes and adds a language specifier.

This pattern combines several smaller patterns

Airflow supports decorator syntax (@task, @dag) for defining workflows. It is recommended to use them over the legacy python classes.

Converts any() functions to simpler in statements.

To get the current time in UTC use a datetime object with the timezone explicitly set to UTC.

Some binary operations can be simplified into constants, this lint performs those simplifications.

When a boolean expression is used in an if-else to get a boolean value, use the boolean value directly.

Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data.

Use list, set or dictionary comprehensions directly instead of calling list(), dict() or set().

Replace constant collection with boolean in boolean contexts.

Replaces 2 individual bound checks with a single combined bound check.

Replace unneeded list comprehensions with direct generators.

Replaces cases where deletions are made via for loops with comprehensions.

Replaces dictionaries created with for loops with dictionary comprehensions.

Join multiple with statements into a single one. Rule SIM401 from flake8-simplify.

Rewrite in dict.keys() to in dict. Rule SIM118 from flake8-simplify.

Identified the utilization of an insecure MD4 or MD5 hash function, both of which have well-documented vulnerabilities and are deemed deprecated. It is recommended to replace them with more secure options such as SHA256 or a comparable hash function for improved security.

Join nested with statements into a single one. Rule SIM117 from flake8-simplify.

JsonResponse in Django offers a concise and efficient way to return JSON responses compared to using json.dumps along with HttpResponse. It simplifies the process by automatically handling serialization and setting the correct content type.

Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.

This pattern transforms a loop that computes the product of a list of numbers into a call to math.prod (introduced in Python 3.8).

The Mux Python SDK has been rewritten for v3 and contains significant changes.

Avoid using null on string-based fields such as CharField and TextField. If a string-based field has null=True, that means it has two possible values for no data: NULL, and the empty string. In most cases, it's redundant to have two possible values for "no data" the Django convention is to use the empty string, not NULL.

Disable skipping pytest tests without an explanation.

We should close the file object opened without corresponding close.

Rewrite print statements using log.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

We should remove debugger from production code

Use the walrus operator for snippets with a match followed by an if.

Prefer using tempfile.NamedTemporaryFile instead. According to the official Python documentation, the tempfile.mktemp function is considered unsafe and should be avoided. This is because the generated file name may initially point to a non-existent file, and by the time you attempt to create it, another process may have already created a file with the same name, leading to potential conflicts.

Be cautious when using $F.name without preceding it with .flush() or .close(), as it may result in an error. This is because the file referenced by $F.name might not exist at the time of use. To prevent issues, ensure that you either call .flush() to write any buffered data to the file or close the file with .close() before referencing $F.name.

Replaces an assignment to the same variable done across an if-else with a ternary operator when both are equivalent.

Add thousands separator (1_000_000) to numbers (ints and floats, positive or negative).

If you're generating a CSV file using the built-in csv module and incorporating user data, there's a potential security risk. An attacker might inject a formula into the CSV file, which, when imported into a spreadsheet application, could execute a malicious script, leading to data theft or even malware installation on the user's computer. To enhance security, consider using defusedcsv as a direct substitute for csv. defusedcsv maintains the same API but aims to thwart formula injection attempts, providing a safer way to create CSV files.

flask.jsonify() simplifies returning JSON from Flask routes by automatically serializing Python objects into JSON format and setting the appropriate Content-Type header, resulting in cleaner and more readable code while ensuring consistency and compatibility with web standards.

Detected hardcoded temp directory. Consider using tempfile.TemporaryFile instead

This pattern replaces Markdown links with their bare text.

Add any type annotation to caught errors. It is a common source of tsc errors.

Calling setState on the current state is always a no-op. Did you mean to change the state like $Y(!$X) instead?

If a PureComponent has the shouldComponentUpdate method, convert it to a regular Component.

React suggest to use React.Fragment besides <>

Convert any equality check with -0 to the more precise Object.is.

This matches the eslint rule.

Migrate the Drizzle DB schema from MySQL to PostgreSQL.

Convert non-strict equality checking, using ==, to the strict version, using ===.

Converts ES6-style import to require statements.

Use explicit conversions between types, e.g., '' + x => String(s).

Find uncaught HTTP requests and wrap it with try {} catch{ }

Files containing JSX should have a .jsx extension.

If a for counter moves in the wrong direction the loop will run infinitely. Mostly, an infinite for loop is a typo and causes a bug.

The Apollo GraphQL server lacks the 'csrfPrevention' option. This option is 'false' by the default in v3 of the Apollo GraphQL v3, which can enable CSRF attacks.

The Apollo GraphQL server sets the 'csrfPrevention' option to false. This can enable CSRF attacks.

Grit includes standard patterns for declaratively adding, removing, and updating imports.

ES7 introduced the includes method for arrays so bitwise and comparisons to -1 are no longer needed.

Replaces innerHtml with innerText, which is safer in most cases.

If a useEffect depends on layout etc. it should switch to useLayoutEffect.

expect.arrayContaining can be used to validate an array containing multiple different elements, so multiple statements are not required.

Disable skipping Jest tests without an explanation.

Migrate Link component children to Next13

JavaScript’s alert is often used while debugging code, which should be removed before deployment to production.

Replaces export default function () { } with export default function main () { } and export default () => { } with const main = () => { }; export default main

The literal notation avoids the single-argument pitfall or the Array global being redefined.

The Promise is already executed asynchronously and exceptions thrown by the function will be lost.

Bitwise operators & or | are often used by mistake instead of && or ||, which can cause unexpected errors.

arguments.caller and arguments.called have been deprecated.

JavaScript’s confirm function is widely considered to be obtrusive as UI elements and should be replaced by a more appropriate custom UI implementation.

Remove console.log statements.

Remove unreachable code found after return / throw / continue or break statements.

The code in production should not contain a debugger. It causes the browser to stop executing the code and open the debugger.

Comparing to null needs a type-checking operator (=== or !==), to avoid incorrect results when the value is undefined.

The if and else statements should not be used inline. Instead, use a block statement.

Use _iterator_ instead of __iterator__. __iterator__ is obsolete and is not implemented by all browsers.

The {} literal form is a more concise way of creating an object.

Calling Symbol with the new operator throws a TypeError exception.

JavaScript’s prompt function is widely considered to be obtrusive as UI elements and should be replaced by a more appropriate custom UI implementation.

Call hasOwnProperty, isPrototypeOf, propertyIsEnumerable methods only from Object.prototype.
Otherwise it can cause errors.

This rule hoists the assignments out of return. Because an assignment, = is easy to confuse with a comparison, ==, The best practice is not to use any assignments in return statements.

It is a good practice to throw Error objects on exceptions because they automatically keep track of where they were created.

Negates key instead of the entire expression, which is likely a bug.

Prefer natural language style conditions in favour of Yoda style conditions.

Convert comparisons to NaN (e.g., x == NaN) to use isNaN (e.g., isNaN(x)).

Components without children can be self-closed to avoid unnecessary extra closing tag.

Older code often uses the function prototype to create "classes" out of functions. This upgrades those to ES6 class syntax.

Some template engines allow disabling HTML escaping, which can allow XSS vulnerabilities.

If the noAssert flag is set, offset can go beyond the end of the Buffer, which is a security vulnerability.

Remove the shouldComponentUpdate method from PureComponent. PureComponent already has an implementation.

serialize-javascript used with unsafe parameter, this could be vulnerable to XSS.

Replaces replaceAll with replace, when it uses a regex pattern.

Replace wildcard imports with explicit imports.

Creating and using a large number of zlib objects simultaneously can cause significant memory fragmentation. It is strongly recommended that the results of compression operations be cached or made synchronous to avoid duplication of effort

Split a tRPC router into multiple files, one per route.

This tests the shadows_identifier pattern by finding all cases where a variable is shadowed.

This pattern removes unused imports of top level modules like import React from "react" or import * as lodash from "lodash".

The group_blocks function takes a target list and returns a list of lists, where each sublist is a block of items that are adjacent to each other in the original program.

ES7 introduced the exponentiation operator ** so that using Math.pow is no longer necessary.

If $condition ? $answer:$answer then this expression returns $answer. This is probably a human error.

Utility patterns for matching literals.

The upsert pattern can be used to update a value in an object, or insert it if the key doesn't already exist.

Avoid hard-coding secrets, such as credentials and sensitive data, directly into your application's source code. This practice poses a security risk as the information may be inadvertently leaked.

Inspect nested loops.

Say we do not want mulDivRoundUp.

Unusued variables should not be defined on contracts, either as state variables or as local variables. This corresponds to SWC-103.

Looking for variations of the upgradable proxy pattern.

An example illustrating the upgrade_dependency utility function, which upgrades a dependency to a specified semantic version in package.json, or adds it if it is not present.

Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.

This pattern reverses key-value pairs when the value is a string.

Adds "strict": true, "allowJs": true, "checkJs": false from a tsconfig's compilerOptions, and then removes existing redundant options (such as noImplicitAny).

Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: arn:aws:iam::<account_id>:root.

Assignment inside a condition like this $x = false is usually accidental, this is likely meant to be a comparison $x == false.

Assignment inside a condition is usually accidental, this is likely meant to be a comparison.

JUnit silently ignores private classes and private methods, static methods, and methods returning a value without being a TestFactory.

Because of floating point imprecision, the BigDecimal(double) constructor can be somewhat unpredictable. It is better to use BigDecimal.valueOf(double).

It is redundant and usually a bug when a variable is assigned to itself.

Creating a new Throwable without actually throwing or binding it is useless and is probably due to a mistake.

Simplify redundant self-comparison ($var == $var) to achieve clearer code logic and avoid unnecessary repetition.

Unused private fields constitute dead code and should therefore be removed.

Unused private methods, excepting methods with annotations and special methods overriding Java's default behaviour, constitute dead code and should therefore be removed.

str::bytes().count() is longer and may not be as performant as using str::len().

Redundant layers of nesting add undesirable complexity.

Finds nested match expressions where the patterns may be combined to reduce the number of branches.

It is more idiomatic to remove the return keyword and the semicolon.

Checks for the use of format!("string literal with no argument") and format!("{}", foo) where foo is a string.

The hashing functions md2, md4, md5, and sha1 are detected as cryptographically insecure due to known vulnerabilities. It is advisable to use more secure hashing algorithms for cryptographic purposes.

Update a module by specifying its old source and the new one.

Find a key-value pair in Terraform HCL.

This pattern helps with upgrading Concourse pipelines to version 7.