Pattern Library

This migration attempts to encode some of the Azure-specific details for migration to OpenAI Python SDK v1.x.

Convert OpenAI from openai version to the v1 version, while continuing to use the global client. This is a variant of the client-based version.

Convert OpenAI from openai version to the v1 version.

Upgrade the Langfuse SDK to v2 following this guide.

Migrate from CodeceptJS to Playwright.

This pattern converts React class components to functional components, with hooks.

Migrate from the legacy Hathora Cloud SDK to the TypeScript SDK.

Upgrade the OpenAI SDK to v4 following this guide.

Convert Jest tests to Vitest

Protractor to Playwright.

Convert Chai test assertions to Jest.

Knockout.js is an older JavaScript framework that is still used by many developers. This migration helps with migrating your Knockout code to React.

Converts require statements to ES6-style import.

Transform io-ts schemas to zod schema

Converts arrow function single expression to to block body

Creating a styled component inside the render method in React leads to performance issues because it dynamically generates a new component in the DOM on each render. This causes React to discard and recalculate that part of the DOM subtree every time, rather than efficiently updating only the changed parts. This can result in performance bottlenecks and unpredictable behaviour.

Converts function expressions to ES6 arrow functions

The 'schemaDirectives' option in Apollo GraphQL, which was effective in ApolloServer version v2, no longer functions in versions >=3 and above. This change can have significant implications, potentially exposing authenticated endpoints, disabling rate limiting, and more, depending on the directives used. To address this, it is recommended to consult the references on creating custom directives specifically for ApolloServer versions v3 and v4.

Upgrade the Langfuse SDK to v2 following this guide.

Upgrade the Mux SDK to v8 with Stainless

This pattern migrates from React Query v3 to React Query v4. It is the equivalent of the codemod.

Switch the OpenAI JS/TS SDK to use OpenRouter.

Migrate from Cypress to Playwright.

This pattern combines convert_default_exports and _convert_default_imports to replace default exports to named exports and replace default imports with named imports.

Converts CommonJS module.exports to ES6-style exports.

Prefer to use early returns to keep functions flat.

In Postgres, function and procedure bodies need to be wrapped in $$dollar quotes$$. This pattern wraps a PLSQL CREATE PROCEDURE body in dollar quotes and adds a language specifier.

PgTAP is a unit testing framework for Postgres. This pattern adds a unit test checking a procedure has been correctly defined.

This pattern combines several smaller patterns

Adds "strict": true, "allowJs": true, "checkJs": false from a tsconfig's compilerOptions, and then removes existing redundant options (such as noImplicitAny).

Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values.

This pattern reverses key-value pairs when the value is a string.

Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: arn:aws:iam::<account_id>:root.

An example illustrating the upgrade_dependency utility function, which upgrades a dependency to a specified semantic version in package.json, or adds it if it is not present.

Find a key-value pair in Terraform HCL.

Update a module by specifying its old source and the new one.

Identified the utilization of an insecure MD4 or MD5 hash function, both of which have well-documented vulnerabilities and are deemed deprecated. It is recommended to replace them with more secure options such as SHA256 or a comparable hash function for improved security.

Replaces an assignment to the same variable done across an if-else with a ternary operator when both are equivalent.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Disable skipping pytest tests without an explanation.

Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.

Detected hardcoded temp directory. Consider using tempfile.TemporaryFile instead

Replaces 2 individual bound checks with a single combined bound check.

Join multiple with statements into a single one. Rule SIM401 from flake8-simplify.

Replaces cases where deletions are made via for loops with comprehensions.

This pattern transforms a loop that computes the product of a list of numbers into a call to math.prod (introduced in Python 3.8).

Prefer using tempfile.NamedTemporaryFile instead. According to the official Python documentation, the tempfile.mktemp function is considered unsafe and should be avoided. This is because the generated file name may initially point to a non-existent file, and by the time you attempt to create it, another process may have already created a file with the same name, leading to potential conflicts.

To get the current time in UTC use a datetime object with the timezone explicitly set to UTC.

Airflow supports decorator syntax (@task, @dag) for defining workflows. It is recommended to use them over the legacy python classes.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Use list, set or dictionary comprehensions directly instead of calling list(), dict() or set().

Replaces dictionaries created with for loops with dictionary comprehensions.

When a boolean expression is used in an if-else to get a boolean value, use the boolean value directly.

Rewrite print statements using log.

flask.jsonify() simplifies returning JSON from Flask routes by automatically serializing Python objects into JSON format and setting the appropriate Content-Type header, resulting in cleaner and more readable code while ensuring consistency and compatibility with web standards.

Converts any() functions to simpler in statements.

Add thousands separator (1_000_000) to numbers (ints and floats, positive or negative).

The Mux Python SDK has been rewritten for v3 and contains significant changes.

We should close the file object opened without corresponding close.

Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data.

Be cautious when using $F.name without preceding it with .flush() or .close(), as it may result in an error. This is because the file referenced by $F.name might not exist at the time of use. To prevent issues, ensure that you either call .flush() to write any buffered data to the file or close the file with .close() before referencing $F.name.

Replace unneeded list comprehensions with direct generators.

If you're generating a CSV file using the built-in csv module and incorporating user data, there's a potential security risk. An attacker might inject a formula into the CSV file, which, when imported into a spreadsheet application, could execute a malicious script, leading to data theft or even malware installation on the user's computer. To enhance security, consider using defusedcsv as a direct substitute for csv. defusedcsv maintains the same API but aims to thwart formula injection attempts, providing a safer way to create CSV files.

Join nested with statements into a single one. Rule SIM117 from flake8-simplify.

Avoid using null on string-based fields such as CharField and TextField. If a string-based field has null=True, that means it has two possible values for no data: NULL, and the empty string. In most cases, it's redundant to have two possible values for "no data" the Django convention is to use the empty string, not NULL.

Some binary operations can be simplified into constants, this lint performs those simplifications.

We should remove debugger from production code

Replace constant collection with boolean in boolean contexts.

Use the walrus operator for snippets with a match followed by an if.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

Rewrite in dict.keys() to in dict. Rule SIM118 from flake8-simplify.

Grit includes standard patterns for declaratively finding, adding, and updating imports in Python.

JsonResponse in Django offers a concise and efficient way to return JSON responses compared to using json.dumps along with HttpResponse. It simplifies the process by automatically handling serialization and setting the correct content type.

JUnit silently ignores private classes and private methods, static methods, and methods returning a value without being a TestFactory.

Simplify redundant self-comparison ($var == $var) to achieve clearer code logic and avoid unnecessary repetition.

Assignment inside a condition is usually accidental, this is likely meant to be a comparison.

Creating a new Throwable without actually throwing or binding it is useless and is probably due to a mistake.

Unused private methods, excepting methods with annotations and special methods overriding Java's default behaviour, constitute dead code and should therefore be removed.

Unused private fields constitute dead code and should therefore be removed.

Because of floating point imprecision, the BigDecimal(double) constructor can be somewhat unpredictable. It is better to use BigDecimal.valueOf(double).

It is redundant and usually a bug when a variable is assigned to itself.

Assignment inside a condition like this $x = false is usually accidental, this is likely meant to be a comparison $x == false.

This pattern replaces Markdown links with their bare text.

Redundant layers of nesting add undesirable complexity.

Finds nested match expressions where the patterns may be combined to reduce the number of branches.

It is more idiomatic to remove the return keyword and the semicolon.

Checks for the use of format!("string literal with no argument") and format!("{}", foo) where foo is a string.

str::bytes().count() is longer and may not be as performant as using str::len().

The hashing functions md2, md4, md5, and sha1 are detected as cryptographically insecure due to known vulnerabilities. It is advisable to use more secure hashing algorithms for cryptographic purposes.

Standardize on a GitHub Actions runner.

This pattern helps with upgrading Concourse pipelines to version 7.

Grit includes standard patterns for declaratively adding or finding imports.

$VALUE serves as a loop pointer that might be exported from the loop. Since this pointer is shared across loop iterations, the exported reference will consistently point to the last loop value, potentially leading to unintended consequences. To address this issue, duplicate the pointer within the loop to ensure each iteration has its own distinct reference.

The Go SDK has been rewritten for v5 and contains significant changes.

Utilize filepath.Join(...) instead of path.Join(...) as it accommodates OS-specific path separators, mitigating potential issues on systems like Windows that may employ different delimiters.

Using the none algorithm in a JWT token is risky because it assumes the token's integrity is already ensured. This could let a malicious actor create a fake JWT token that gets automatically verified. Avoid using none and go for a safer algorithm like HS256 instead.

Detected a channel guarded with a mutex. Channels already have an internal mutex, so this is unnecessary. Remove the mutex.

If statements that always evaluate to true or false are redundant and should be removed.

Identified a potential risk in converting the outcome of a strconv.Atoi command to int16. This may lead to integer overflow, possibly causing unforeseen issues and even privilege escalation. It is recommended to utilize strconv.ParseInt instead.

Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using go.

Identical statements found in both the if and else bodies of an if-statement. This results in the same code execution regardless of the if-expression outcome. To optimize, eliminate the if statement entirely.

v2.x of the Go SDK is a ground-up rewrite, using code generation from the OpenAPI spec. There are significant breaking changes.

The {} literal form is a more concise way of creating an object.

This matches the eslint rule.

Avoid hard-coding secrets, such as credentials and sensitive data, directly into your application's source code. This practice poses a security risk as the information may be inadvertently leaked.

arguments.caller and arguments.called have been deprecated.

This rule hoists the assignments out of return. Because an assignment, = is easy to confuse with a comparison, ==, The best practice is not to use any assignments in return statements.

The Apollo GraphQL server lacks the 'csrfPrevention' option. This option is 'false' by the default in v3 of the Apollo GraphQL v3, which can enable CSRF attacks.

It is a good practice to throw Error objects on exceptions because they automatically keep track of where they were created.

Some template engines allow disabling HTML escaping, which can allow XSS vulnerabilities.

JavaScript’s prompt function is widely considered to be obtrusive as UI elements and should be replaced by a more appropriate custom UI implementation.

ES7 introduced the exponentiation operator ** so that using Math.pow is no longer necessary.

Migrate Link component children to Next13

If $condition ? $answer:$answer then this expression returns $answer. This is probably a human error.

The code in production should not contain a debugger. It causes the browser to stop executing the code and open the debugger.

The literal notation avoids the single-argument pitfall or the Array global being redefined.

Use _iterator_ instead of __iterator__. __iterator__ is obsolete and is not implemented by all browsers.

Converts ES6-style import to require statements.

Prefer natural language style conditions in favour of Yoda style conditions.

Add any type annotation to caught errors. It is a common source of tsc errors.

The Promise is already executed asynchronously and exceptions thrown by the function will be lost.

Find uncaught HTTP requests and wrap it with try {} catch{ }

If a useEffect depends on layout etc. it should switch to useLayoutEffect.

Split a tRPC router into multiple files, one per route.

Replaces export default function () { } with export default function main () { } and export default () => { } with const main = () => { }; export default main

React suggest to use React.Fragment besides <>

Convert non-strict equality checking, using ==, to the strict version, using ===.

Convert any equality check with -0 to the more precise Object.is.

Bitwise operators & or | are often used by mistake instead of && or ||, which can cause unexpected errors.

JavaScript’s alert is often used while debugging code, which should be removed before deployment to production.

Convert comparisons to NaN (e.g., x == NaN) to use isNaN (e.g., isNaN(x)).

Components without children can be self-closed to avoid unnecessary extra closing tag.

Replaces replaceAll with replace, when it uses a regex pattern.

Disable skipping Jest tests without an explanation.

Negates key instead of the entire expression, which is likely a bug.

Call hasOwnProperty, isPrototypeOf, propertyIsEnumerable methods only from Object.prototype.
Otherwise it can cause errors.

The Apollo GraphQL server sets the 'csrfPrevention' option to false. This can enable CSRF attacks.

The group_blocks function takes a target list and returns a list of lists, where each sublist is a block of items that are adjacent to each other in the original program.

The if and else statements should not be used inline. Instead, use a block statement.

Comparing to null needs a type-checking operator (=== or !==), to avoid incorrect results when the value is undefined.

Replaces innerHtml with innerText, which is safer in most cases.

If a PureComponent has the shouldComponentUpdate method, convert it to a regular Component.

Use explicit conversions between types, e.g., '' + x => String(s).

This pattern removes unused imports of top level modules like import React from "react" or import * as lodash from "lodash".

Remove console.log statements.

Files containing JSX should have a .jsx extension.

ES7 introduced the includes method for arrays so bitwise and comparisons to -1 are no longer needed.

JavaScript’s confirm function is widely considered to be obtrusive as UI elements and should be replaced by a more appropriate custom UI implementation.

expect.arrayContaining can be used to validate an array containing multiple different elements, so multiple statements are not required.

Calling setState on the current state is always a no-op. Did you mean to change the state like $Y(!$X) instead?

This tests the shadows_identifier pattern by finding all cases where a variable is shadowed.

Grit includes standard patterns for declaratively adding, removing, and updating imports.

The upsert pattern can be used to update a value in an object, or insert it if the key doesn't already exist.

Remove unreachable code found after return / throw / continue or break statements.

Creating and using a large number of zlib objects simultaneously can cause significant memory fragmentation. It is strongly recommended that the results of compression operations be cached or made synchronous to avoid duplication of effort

serialize-javascript used with unsafe parameter, this could be vulnerable to XSS.

Calling Symbol with the new operator throws a TypeError exception.

Utility patterns for matching literals.

Replace wildcard imports with explicit imports.

Migrate the Drizzle DB schema from MySQL to PostgreSQL.

If a for counter moves in the wrong direction the loop will run infinitely. Mostly, an infinite for loop is a typo and causes a bug.

Older code often uses the function prototype to create "classes" out of functions. This upgrades those to ES6 class syntax.

If the noAssert flag is set, offset can go beyond the end of the Buffer, which is a security vulnerability.

Remove the shouldComponentUpdate method from PureComponent. PureComponent already has an implementation.

Say we do not want mulDivRoundUp.

Looking for variations of the upgradable proxy pattern.

Inspect nested loops.

Unusued variables should not be defined on contracts, either as state variables or as local variables. This corresponds to SWC-103.