🐛🧑‍💻 - Bugbot misidentifies Exposed SQLException inheritance despite compiled artifact and real SQL fault evidence

Is there an existing issue for this?

Searched upstream issues for ExposedSQLException; no matching report found. This is distinct from progress-scope#717 and staged-rollout#735.

Which actions are affected?

Pull Request

Which platforms are affected?

Linux, macOS

Description

Bugbot emitted two medium/88%-confidence findings claiming ExposedSQLException is not a SQLException. The actual packaged/resolved Exposed1.0.0 class extends java.sql.SQLException. Both findings contradict the compiled dependency and actual PostgreSQL failure tests.

Consumer source0fbb0afdfd8488e32292ec146dff5110a394d803, PR110:

Content-reference finding, fingerprintfp-bfac6b9b.
Item-scope finding, fingerprintfp-8287465b.
Both have semantic sf-a61a0b8e and claim the real DROP TABLE tests can throw instead of returning Either.Left because the wrapper is not caught by SQLException.
Review40424262287, job121925994462 onubuntu-runner-3: contextcoveragecomplete,61files,6partitions,83,954ms workflow. It correctly resolved the earlier retention issue but retained these two false premises.

The exact read-only runtime package mounted/tested locally contains org.jetbrains.exposed:exposed-core:1.0.0, SHA256 4e6b44f76b5dc69bb611d64474f2a34ac444e4ec156a96ac8cdcccda3b2a0b7a. All237 package files were checked against the manifest. javap on that actual JAR returns:

public final class org.jetbrains.exposed.v1.exceptions.ExposedSQLException extends java.sql.SQLException

The consumer had already verified this resolved contract on PR75, documented in immutable STORAGE_OWNERSHIP_73.md.

Reproducing the issue

Use the consumer0fbb0af source and its normal pinned Exposed1.0.0 dependency, without substituting another version.
Run javap -classpath exposed-core-1.0.0.jar org.jetbrains.exposed.v1.exceptions.ExposedSQLException. Observe the actual superclass above.
Run infrastructure tests selected by *Version*AdapterTest:8cases pass, zero failures/errors/skips. VersionScopeAdapterTest independently drops file_versions and asserts typed DatabaseException, and also checks coroutine cancellation propagation. VersionContentReferenceAdapterTest independently drops file_versions and asserts typed failure rather than unreferenced=false. These are real PostgreSQL/newSuspendedTransaction queries, not mocked wrapper classes.
Both adapters catch SQLException, return typed DatabaseException and preserve cancellation. The exact candidate's complete application CI40424262303 passes the backend on its merge-preview tree; selected local343cases include these8real adapter cases.
Observe both reviewer comments still stating that the wrapper does not extend SQLException and recommending a broader catch.

Expected: dismiss these specific findings for the resolved version, or demonstrate a failing counterexample against this actual artifact. Review dependency inheritance/version and executed fault tests before retaining generic wrapper advice. This report does not claim every SQL failure or every Exposed version shares this contract.

copilot Version

Official vypdev/copilot@v3, contemporaneous resolved source39679e26a22b40a5a4a40e8f167f46273157182e; review effortsmart, complete context. Source SHA is evidence only: consumer Action refs remain major tags. No core or protection change.

Relevant Log Output

LoadBugbotContext: selection=event, coverage=complete, existing findings=1, retained previous findings=1, diff files=61, diff partitions=6.
Bugbot reviewer completed partition6/6.
Actual bytecode: ExposedSQLException extends java.sql.SQLException
VersionScopeAdapterTest:4tests;0failures/errors/skips
VersionContentReferenceAdapterTest:4tests;0failures/errors/skips

Additional context and comments

Please ground this type-resolution claim in the actual resolved dependency. A broader catch is unnecessary and risks changing cancellation/programming-error handling. Keep the real error tests and targeted SQL catch. This is not a request to suppress SQL review globally, mark unexecuted checks green or waive protection. Genuine cleanup/documentation findings from the same review are being fixed separately. Source/artifact hashes, raw XML and javap output are retained; no credentials or raw secret-scanner matches are published.

@vypbot

Hi! I’m @vypbot, the Copilot assistant for this repository.

I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.

Try /copilot help to see the available commands, or mention @vypbot with your question.

Consumer follow-up: final sourcebc8ceed now has a successful Copilot Review: fixed=3,obsolete=2, no open findings. Both SQL comments were classified obsolete after the actual JAR/SQL-test evidence was provided. All five native threads are resolved.

The targeted SQLException catches remain unchanged; no broad wrapper catch or cancellation suppression was introduced. The separate cleanup/reference-set fix changed the reference port, but does not change Exposed1.0.0's inheritance. The original0fbb0af run and comments remain the reproducible false-positive observation, rather than a claim that every later review repeats it.

Final application CI40426022867 executes2,255backend+1,315desktop+1,191browser=4,761cases, zero failures/errors/skips, including the actual SQL error controls (now11adapter cases with extra batch checks). Local package/bytecode identity and source receipts remain preserved. Please retain the original version-grounding feedback for reviewer-quality triage; this follow-up is not evidence of a Copilot source fix.

New recurrence on VaultStadio PR117, analyzed head d619fa258f68df354f64fbba013f99821c9bc6be; the earlier consumer findings becoming obsolete did not establish an upstream source fix.

New finding4388655926: “Exposed SQL failures bypass database error mapping”, medium/77%, fingerprint fp-b3aea683, semantic sf-2535e3a6, StorageDatabaseResult.kt:19–20.
Review run40503612760, source vypdev/copilot@v3 resolved by Actions to 39679e26a22b40a5a4a40e8f167f46273157182e. The consumer still references the major Action tag; this SHA identifies the observed implementation only.
Context log: selection=event, coverage=complete, existing findings=0, retained previous findings=0, diff files=54, diff partitions=5.
The new finding explicitly claims that org.jetbrains.exposed.v1.exceptions.ExposedSQLException is not a java.sql.SQLException and recommends adding the wrapper catch. This is the same false type premise at a new consumer location, rather than a new database failure reproduced by the reviewer.

The actual packaged/resolved dependency is still org.jetbrains.exposed:exposed-core:1.0.0, SHA256 4e6b44f76b5dc69bb611d64474f2a34ac444e4ec156a96ac8cdcccda3b2a0b7a. javap on that exact JAR, using the installed checksum-verified Temurin17 SDK, returns:

public final class org.jetbrains.exposed.v1.exceptions.ExposedSQLException extends java.sql.SQLException

Therefore the existing catch (failure: SQLException) already captures this wrapper and constructs DatabaseException(message, failure), preserving the wrapper and original JDBC cause chain. No additional/broader catch or cancellation change is needed. The original9 provider-boundary tests still assert cause identity, explicit cancellation propagation and unexpected/fatal failure propagation.

I added two real PostgreSQL regressions without changing the adapter:

Insert an actual duplicate primary key through ExposedStorageItemRepository.create. Assert Either.Left/DatabaseException, actual ExposedSQLException wrapper, assignability to java.sql.SQLException, underlying JDBC SQLState23505, original row and stored bytes retained after rollback.
Rename storage_items only inside the test's migrated PostgreSQL container, send the actual authenticated folder HTTP request through production composition, and assert500/DATABASE_ERROR with safe context and no SQL table/driver diagnostics in the response. Restore the table in finally; assert successful200 recovery with row/bytes retained.

Both targeted cases pass with zero failures/errors/skips, along with strict changed-source ktlint/Detekt maxIssues0. Reproduction selector: :api:test --tests '*SelectionExposedFailureTest'. No mocked exception type or catch-all handler is used to establish the class relation or SQL mapping.

The original-head application CI40503612712 is green:3247backend+1324desktop+1200browser=5771cases, all failures/errors/skips0. Four artifact hashes and1091XML reports reconcile; actual merge-preview b4ab0e7d2fa3c08fae71a3a0249de9d87f68aef7 has parents c9f1ac5/d619fa2 and the same candidate tree d2c9cc4e982ffbbf475e12cf69330177b13625ab. The two new regression cases receive fresh consumer CI on publication; original-head results are not represented as that later head's CI.

Please ground SQL inheritance claims in the resolved version and executed fault evidence, or provide a failing counterexample against this actual artifact. This is not a request to suppress SQL review globally, approve this PR, change protections or ignore real provider/cancellation defects. No Copilot code/configuration was changed in the consumer; source hashes, actual JAR signature, raw XML and the original finding are retained for reviewer-quality triage.

Implementation plan

Current status: Ready to start. No action is required from maintainers before implementation.

Verify the resolved Exposed contract
- Inspect the pinned exposed-core:1.0.0 dependency and confirm ExposedSQLException inherits from java.sql.SQLException.
- Use the resolved artifact as the basis for evaluating the two findings.
Review the adapter error paths
- Confirm both adapters catch SQLException and return typed DatabaseException results.
- Check that cancellation propagation remains intact and the catch does not broaden to unrelated exceptions.
Retain and run the PostgreSQL fault tests
- Keep the real DROP TABLE tests for VersionScopeAdapterTest and VersionContentReferenceAdapterTest.
- Verify they assert typed failures rather than success-shaped fallback results.
Correct the targeted review findings
- Dismiss the two findings if they rely on the disproven inheritance claim; otherwise provide a failing counterexample against the resolved artifact.
- Do not apply a broader catch solely to address these findings.
Document the verified dependency behavior
- Record the resolved dependency contract and the relevant test evidence in project documentation.

Acceptance: Against the pinned Exposed 1.0.0 artifact, ExposedSQLException is verified as a subclass of SQLException, and both real PostgreSQL adapter fault tests pass with typed DatabaseException results and cancellation propagation preserved; the two findings are resolved based on that evidence.

Need something else? Mention the bot with a question or use /copilot help.

Issue closed — historical progress

Current status: closed as completed.

The last estimate is retained below as history. Closure does not certify a new percentage, tests, or branch alignment.

Action required: none for this closed issue. If work continues, reopen the issue; a fresh assessment can update this same card.

Last assessment before closure (historical)

Progress: 40% — in progress

> Current status: [R1] Expected: dismiss these specific findings for the resolved version, or demonstrate a failing counterexample against this actual artifact. Review dependency inheritance/version and executed fault tests before retaining generic wrapper advice. This report does not claim every SQL failure or every Exposed version shares this contract. — The changes add guidance to verify dependency inheritance and fault evidence before retaining wrapper findings, but do not resolve the two specific findings or provide a counterexample against the resolved artifact.
[R2] Please ground this type-resolution claim in the actual resolved dependency. A broader catch is unnecessary and risks changing cancellation/programming-error handling. Keep the real error tests and targeted SQL catch. This is not a request to suppress SQL review globally, mark unexecuted checks green or waive protection. Genuine cleanup/documentation findings from the same review are being fixed separately. Source/artifact hashes, raw XML and javap output are retained; no credentials or raw secret-scanner matches are published. — The prompt guidance requires exact type, version, platform, and fault-path evidence; it rejects broader catches based only on a wrapper claim and preserves cancellation and unrelated-error concerns.
[R3] "title": "Verify the resolved Exposed contract", — The changes document a process for checking dependency contracts, but do not independently verify the pinned Exposed d
[untrusted content truncated]

Next: [R1] Expected: dismiss these specific findings for the resolved version, or demonstrate a failing counterexample against this actual artifact. Review dependency inheritance/version and executed fault tests before retaining generic wrapper advice. This report does not claim every SQL failure or every Exposed version shares this contract. — Resolve the two specific findings using verified evidence for the resolved version, or provide a failing counterexample against that artifact.
[R3] "title": "Verify the resolved Exposed contract", — Verify the pinned dependency contract as required by R4.
[R4] "Inspect the pinned exposed-core:1.0.0 dependency and confirm ExposedSQLException inherits from java.sql.SQLException.", — Independently verify the inheritance relationship against the pinned exposed-core:1.0.0 artifact.
[R5] "Use the resolved artifact as the basis for evaluating the two findings." — Apply verified resolved-artifact evidence to the two specific findings.
[R6] "title": "Review the adapter error paths", — Verify the adapter behaviors described in R7 and R8.
[R7] "Confirm both adapters catch SQLException and return typed DatabaseException results.", — Verify both adapters' catches and typed failure results against consumer source or execution evidence.
[R8] "Check that cancellation propagation remains intact and the catch does not broaden to unrelated exceptions." — Verify cancellation propagation and that the catches exclude unrelated exceptions.
[R9] "title": "Retain and run the PostgreSQL fault tests", — Verify the required PostgreSQL fault tests were retained and run.
[R10] "Keep the real DROP TABLE tests for VersionScopeAdapterTest and VersionContentReferenceAdapterTest.", — Verify the named PostgreSQL tests remain present and execute against the required fault paths.
[R11] "Verify they assert typed failures rather than success-shaped fallback results." — Verify both tests assert typed DatabaseException failures rather than success-shaped fallback results.
[R12] "title": "Correct the targeted review findings", — Resolve the findings as specified in R13.
[R13] "Dismiss the two findings if they rely on the disproven inheritance claim; otherwise provide a failing counterexample against the resolved artifact.", — Resolve both findings based on verified inheritance evidence, or provide a failing counterexample against the resolved artifact.
[R16] "acceptance": "Against the pinned Exposed 1.0.0 artifact, ExposedSQLException is verified as a subclass of SQLException, and both real PostgreSQL adapter fault tests pass with typed DatabaseException results and cancellation propagation preserved; the two findings are resolved based on that evidence." — Verify the pinned artifact contract and both real adapter fault tests, including typed failures and cancellation propagation, then resolve the two findings based on that evidence.

Merge pull request #756 from vypdev/bugfix/736-bugbot-misidentifies-e…

Issue closed: synchronization recommendation retired

No branch synchronization is required for this closed issue.

The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.

Navigation Menu

Repository navigation

🐛🧑‍💻 - Bugbot misidentifies Exposed SQLException inheritance despite compiled artifact and real SQL fault evidence #736

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

3 remaining items

Implementation plan

Issue closed — historical progress

Last assessment before closure (historical)

Progress: 40% — in progress

Issue closed: synchronization recommendation retired

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

🐛🧑‍💻 - Bugbot misidentifies Exposed SQLException inheritance despite compiled artifact and real SQL fault evidence #736

Description

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

Activity

vypbot commented on Oct 27, 2026

efraespada commented on Oct 27, 2026

efraespada commented on Oct 27, 2026

3 remaining items

vypbot commented on Oct 28, 2026

Implementation plan

vypbot commented on Oct 28, 2026

Issue closed — historical progress

Last assessment before closure (historical)

Progress: 40% — in progress

vypbot commented on Oct 28, 2026

Issue closed: synchronization recommendation retired

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions