PR Backlog Audit

airweave-ai/airweave

2026-05-1479 open PRs51 open issues
6
quick wins
0
high impact
2
contested
22
ai flagged
47
stale
0
risky

Quick wins 6

Small, passing CI, mergeable. Batch these this week.

PRTitleAuthorSizeCITestsAgeScoreAI summary
#1519chore(deps): bump python from 3.13.12-slim to 3.14.0-slim in /backend…dependabot[bot]tinypassing—71d7Dependabot-generated patch is mechanically sound, but Python 3.14.0 is too new to merge without explicit compatibility testing and
#1741chore(deps): bump node from 24.14.0-alpine to 24.15.0-alpine in /mcp …dependabot[bot]tinypassing—42d9Straightforward Dependabot Node.js patch bump with consistent pinned digests across Dockerfile stages; safe to merge following nor
#1767fix(teams): strip non-printable control characters from message bodyocto-patchsmallpassing✓17d9High-quality fix that solves the Vespa ingestion failure by sanitizing control characters at entity creation time, with comprehens
#1779security: remove hardcoded encryption key and credentials from manual…sebastiondevsmallpassing✓5d9Clean, well-tested security fix that removes hardcoded credentials from a manual dev script and replaces them with mandatory env v
#1784fix(embedders): use /.well-known/ready instead of /health for local e…awesome-protinypassing✓1d9Well-scoped bug fix with correct endpoint replacement across all locations and matching test updates; minor code clarity improveme

High impact 0

Closes high-demand issues. Worth dedicated review time.

No PRs in this bucket.

Contested 2

Multiple PRs are targeting the same issue. Pick one, close the others.

Issue #1735

#1758by qflenmediumpassing
20d
#1783by awesome-prosmallpassing
20d

AI flagged 22

LLM review surfaced blocking concerns. Review each before merging.

#1669feat: add MiniMax as agentic search LLM provider

approve
by octo-patch·score 6/10·medium·passing·30d old

Well-architected fallback LLM provider following repo patterns with solid test coverage; minor concerns about tokenizer approximation and local testing guidance do not block merge.

Concerns
API search rate-limited during review (unable to verify against past issues/discussions, but PR title/description appear self-contained)
Tokenizer approximation (o200k_harmony for undocumented MiniMax tokenizer) could cause budget estimation drift; no fallback strategy documented if estimate is wrong
Integration test skips silently without API key—no clear guidance in README on testing this provider locally
Schema cleaning via _clean_schema_basic inherited from BaseLLM; no override if MiniMax has different JSON schema requirements
Hardcoded temperature=0.3 in structured_output; no configurability (though consistent with other providers)
Think-tag stripping uses regex with DOTALL flag; edge case if response contains literal `</think>` outside actual tags unlikely but not impossible
Smell flags
hardcoded_secret:1disabled_test:1

#1627feat(embedders): Gemini Embedding 2 multimodal — native PDF, image, audio, video

needs changes
by 24601·score 6/10·medium·passing·30d old

High-quality feature with excellent architecture, documentation, and configurability, but diff truncation obscures ~40% of the implementation (embedder class, error handling, converters, tests)—maintainer must verify full code before merge.

Concerns
PR description truncated in diff (marked `...[truncated]...`); cannot verify full implementation of GeminiDenseEmbedder class, error handling, or test coverage
MediaChunker, video OCR deduplication, transcription backends, and file converters not visible in diff—cannot assess correctness or test quality for those critical paths
Offline character-based tokenization heuristic (~4 chars/token for 40K char limit) is conservative but unvalidated; Gemini may reject inputs sooner or accept more
Temporary keyframe JPEG cleanup relies on `finally` blocks; abnormal process termination could orphan files in system temp directory
Scene detection threshold (0.3) and deduplication threshold (0.8) are hardcoded magic numbers presented as empirical but not parameterized or tested against diverse video types
No visible integration tests for end-to-end embedding → Vespa storage → hybrid search workflows
Smell flags
disabled_test:3very_long_line:8

#1600feat: Enhance GitHub repository name handling

needs changes
by EwanTauran·score 6/10·medium·passing·30d old

Solid feature with good UX improvements, but needs test coverage for config validators and tighter validation after normalization to match repo's quality standards.

Concerns
No test coverage added despite config validation being critical infrastructure; repo patterns show unit tests exist for similar validators
Validator order: `normalize_repo_name` (mode='before') runs first, then `validate_repo_name` runs second—this works but is implicit coupling between two validators
Removed inline comments ('Split by commas...', 'Accept both YYYY/MM/DD...') without replacement; reduced documentation for other validators
Type ignore comments (`# type: ignore[no-any-return]`) suggest the return type annotation may not match actual behavior—worth reviewing if these are legitimate or indicate a deeper type issue
Frontend validation removes trailing slashes but doesn't validate format after normalization—could accept invalid input like `https://github.com/invalid`
No validation of owner/repo segments after normalization (e.g., no check that neither is empty after splitting)

#1580feat: GitHub connector OAuth

discuss
by felixschmetz·score 6/10·medium·passing·30d old

Well-structured credential unification and OAuth validation refactor that aligns with domain/adapter patterns, but requires clarification on SourceLifecycleService integration, migration impact, and test coverage before merging.

Concerns
Critical: `SourceLifecycleService.validate(source_name, token_string)` signature unclear—does it internally instantiate source and config? Diff doesn't show the implementation or its integration tests, making it hard to verify the token flows correctly through the lifecycle
Missing test coverage for the new `source_lifecycle` injection in factory.py and its integration with OAuth callback flow
Frontend auth method selection logic now harder to follow (nested ternaries in loop) vs. previous explicit checks; readability trade-off for ordering support not discussed
No migration guide for external sources or plugins that may have directly instantiated `GitHubSource(personal_access_token=...)` or relied on that field name
Monke broker's `access_token` → `token` normalization (line added) only runs if `token` is missing; unclear if this handles all provider-specific field mappings or could mask credential bugs
VSCode launch.json adds `--reload-exclude` flags but doesn't explain why `local_storage` reload was problematic (performance? test pollution?)
Smell flags
hardcoded_secret:6

#1544feat: browse tree node selection with targeted sync

needs changes
by marc-rutzou·score 6/10·medium·passing·30d old

Strong architectural alignment with repo conventions, but diff truncation prevents full verification of domain internals; credential leakage in manual test and missing async Factory pattern need fixing before merge.

Concerns
Diff truncated—cannot verify complete domain implementation (protocols, service.py, repository.py, types.py all missing from visible diff)
No visible database migrations for NodeSelection model—how is schema being created?
Manual test script uses hardcoded credentials (AD_PASSWORD, SP passwords) in source control—security risk
BrowseTreeServiceProtocol dependency injection in container.py but no visible protocol definition or concrete implementation in diff
Frontend SupportsBrowseTree flag added to Store and Source but no visible API endpoint documenting how sources declare this capability
No error handling visible for lazy-loaded tree nodes or timeout scenarios
Smell flags
debug_print:59

… and 14 more in pr_data.json

Stale 47

60+ days idle, dirty merge state, or failing CI for weeks. Close or revive.

PRTitleAuthorSizeCITestsAgeScoreAI summary
#1441[code blue] cursor rules v1felixschmetzmediumpassing—83d8This is a high-quality, actionable refactoring guide that accurately codifies the Code Blue architecture already visible in the re
#1408feat: add Google Document AI OCR adapterfelixschmetzmediumpassing✓91d8Strong architectural fit with solid fallback tests, but GoogleDocumentAIOcrAdapter lacks unit tests and auth/wiring documentation;
#1406fix(search): skip non-filterable source fields in query interpretationmarc-rutzousmallfailing—91d8Solid defensive fix that solves the Vespa 500 error by whitelisting filterable fields and updating the LLM prompt; clean implement
#1262feat(sync): add collection-level deduplication with per-sync entity r…orhanrauflargefailing✓121d7Solid feature implementation with good handler tests and clear intent, but lacks tests for the core resolver logic, has test fixtu
#1199feat(app): New TanStack frontend app with component libraryAnandChowdharyxlargefailing✓132d5Large, feature-rich frontend v2 PR lacks a viewable diff and raises architectural/security questions; maintainer should request th

… and 39 more in pr_data.json

Risky 0

Large diffs without tests or with failing CI. Need deeper review.

No PRs in this bucket.

Patterns

Recurring signals across the backlog worth a CONTRIBUTING.md note or workflow change.

Generated by pr-auditRead-only, public data onlyLLM reviews via Claude Haiku 4.5Maintainer judgment is the final word