GoCorrectness
Bind handlers must check the returned error before responding
← learned from gin-gonic/gin
- Repo
- gin-gonic/gin
- accepted fixes
- 4
Reviewers on gin keep flagging handlers that call ctx.ShouldBindJSON without inspecting the error, which silently 200s on malformed input. The rule fires whenever an agent writes a new handler that touches request bodies, so the bug is caught before the PR is opened.
Go
RustAsync runtime
Spawn long-lived tasks with tokio::spawn, not block_on inside async fns
← learned from tokio-rs/tokio
- Repo
- tokio-rs/tokio
- accepted fixes
- 3
A recurring review note in tokio: calling block_on from inside an async context deadlocks the runtime under load. difflore learned the pattern from three separate PR threads and now nudges agents toward spawn or spawn_blocking with a one-line rationale linked back to the original review.
Rust
TypeScriptPlugin API
Vite plugins should declare enforce: pre when they rewrite imports
← learned from vitejs/vite
- Repo
- vitejs/vite
- accepted fixes
- 5
Plugin authors routinely ship transforms that race with esbuild's default order, producing missing-import errors only on cold starts. The rule encodes the maintainer guidance from years of issue triage so an agent writing a new plugin gets the ordering right on the first commit.
TypeScript
TypeScriptRouting
Route loaders must return serialisable data, never class instances
← learned from tanstack/router
- Repo
- tanstack/router
- accepted fixes
- 6
TanStack Router serialises loader output across the SSR boundary, so returning a Date, Map, or class instance breaks rehydration in subtle ways. Reviewers ask for the same fix every few weeks; the rule shortcuts that round-trip and points to the canonical issue thread.
TypeScript
TypeScriptSecrets
Server actions that touch headers() must be marked dynamic
← learned from vercel/next.js
- Repo
- vercel/next.js
- accepted fixes
- 7
Caching surprises in the App Router come almost entirely from actions that read cookies or headers without opting out of static rendering. The Next.js review corpus is dense with this exact correction; difflore raises it the moment an agent edits a server action file.
TypeScript
PythonTesting
Dependency-injected sessions belong in a Depends, not a global
← learned from fastapi/fastapi
- Repo
- fastapi/fastapi
- accepted fixes
- 3
The FastAPI maintainers consistently steer contributors away from module-level database sessions toward Depends-scoped factories so tests stay isolated. The rule captures that guidance and links to the docs section reviewers cite, so agents adopt it without a back-and-forth.
Python