Triage audit (round 3): 8 newer bugs + 22 older feature/refactor items (May 2026)

[bearomorphism]

This issue tracks an audit of 30 currently-open issues, checked against master (v4.15.1). It is the round-3 follow-up to #1964 (30 type: bug issues) and #1965 (30 untriaged non-bug issues). Together the three audits span 90 of the ~120 open issues.

This round picks up:

• 8 newer type: bug issues filed after Bug triage: audit of open "type: bug" issues (May 2026) #1964 was opened (Unstaged changes are lumped together with changelog + version updates for cz bump #1939, commitizen-branch fails with exit code: 23 and message fatal: ..: '..' is outside repository #1923, Discussion: Clarify / standardize behavior for negative message_length_limit (should it require >= 0?) #1909, Consider excluding pure typing modules from coverage (question.py) #1904, Fix: message_length_limit config is ignored when CLI flag is unset (commit/check) #1899, cz info does not read from info_path for non root directory #1897, Bug: test_invalid_command fails on Python 3.12 #1864, Version tags with patch version zero ignored if floating tags exist #1863).
• 22 older feature / refactor / documentation items that were not in Triage audit: 30 open untriaged non-bug issues (May 2026, follow-up to #1964) #1965's 30.

Findings are based on code inspection only — please confirm with a real reproduction or maintainer judgement before acting.

Note — the original "Likely fixed" entries (#1678, #1677) were re-validated by a claude-opus-4.7 pass and turned out to be partially fixed, not fully fixed. They have been moved into "Still valid" with the per-feature breakdown; per-issue comments link the unimplemented gaps. This means the round-3 backlog has 0 closeable items, not 2.

❌ Still valid — needs implementation / fix

• Introduce --next flag on cz version --project #1678 — --next on cz version --project. The forced-increment form --next MAJOR|MINOR|PATCH is implemented (commitizen/commands/version.py:93-103, tested by test_next_version). The default form (--next with no value, derive from commit history) is not implemented — explicit TODO at commitizen/commands/version.py:85-91 returns "USE_GIT_COMMITS is not implemented yet"; locked in by tests/commands/test_version_command.py:289-292. Per-feature breakdown posted as a comment.
• Add new capabilities to cz version #1677 — umbrella tracker for cz version capabilities. Shipped: manual_version, --tag, --major/--minor/--patch. Still missing: USE_GIT_COMMITS half of --next (Introduce --next flag on cz version --project #1678), --version deprecation (in flight via PR feat(cli): add cz --version back and add cz --report to separate them from cz version #1798 closing BREAKING: Add --version back and deprecate cz version --commitizen which is the default for cz version #1785), --hash (no implementation, no ticket), --prev (raised in comments, no ticket). Per-feature breakdown posted as a comment.
• Unstaged changes are lumped together with changelog + version updates for cz bump #1939 — cz bump lumps unstaged changes into the bump commit; commitizen/commands/bump.py:443 hard-codes ["-a"] in _get_commit_args().
• commitizen-branch fails with exit code: 23 and message fatal: ..: '..' is outside repository #1923 — commitizen-branch hook fails with '..' is outside repository when pre-commit's $PRE_COMMIT_FROM_REF..$PRE_COMMIT_TO_REF substitution produces a path-like value (.pre-commit-hooks.yaml:22).
• Version tags with patch version zero ignored if floating tags exist #1863 — find_tag_for() (commitizen/tags.py:232-247) returns the floating v1.0 tag instead of the full v1.0.0 tag when both exist.
• Update cz template page #1709 — docs/customization/python_class.md:70-93 still shows a setup.py-based plugin packaging example; the cookiecutter template was already migrated to pyproject.toml + src-layout (commitizen_cz_template PRs How to type multiple lines for body part? #6/Roadmap #7) but the docs were not.
• next step could be update it to pyproject.toml with maybe uv or poetry #1706 — same area as Update cz template page #1709: the plugin-development docs still use pip install . rather than uv/poetry workflows.
• [question] Pull request links and contributors in changelog? #1703 — PR/contributor links not exposed via the default changelog template; existing template fields (author, author_email, sha1, parents) at docs/customization/changelog_template.md:64-79 cover the data, but no example template ships.
• Review Exit codes before v5 release (if possible) #1661 — commitizen/exceptions.py:9-43 ExitCode and exception docstrings need a v5-era pass; e.g. NotAllowed docstring (line 212) still says --incremental cannot be combined with a rev_range despite broader usage.
• JSON Schema File #1565 — no JSON schema file for the configuration exists in the repo; woile's Feb-2026 implementation sketch in the comments has not been picked up.
• Highlight breaking changes in the changelog #1562 — breaking changes are not visually highlighted in the rendered changelog: commitizen/changelog.py:201-221 only sorts by change type; no !/section annotation. Active discussion in the comment thread.
• Discuss adding :meta private: to the doc string #1502 — discussion-only request to add :meta private: to internal docstrings; relates to Clarify what's a breaking change in commitizen #1446. No :meta private: usage in the codebase yet.
• Clarify what's a breaking change in commitizen #1446 — no documented breaking-change policy. PEP 562 __getattr__ deprecation infrastructure already exists at commitizen/defaults.py:174-200; the missing piece is policy + docs. Tagged for the v5 milestone (Release commitizen v5 #1481).
• Redesign how configuration, flag, and default are handled #1445 — single-comment design discussion (Pydantic for config?). commitizen/config/base_config.py:18-61 uses TypedDict + manual validation today; PR fix(commands/bump): prevent using incremental changelog when it is set to false in config #996 (open) addresses precedence by extending BaseConfig.
• cz bump generates broken commit when run from a subfolder. #1371 — cz bump from a subfolder writes the changelog to cwd instead of the repo root; commitizen/commands/bump.py and the changelog plumbing don't normalise via git.find_git_project_root(). Confirmed by maintainer reproduction.
• The --devrelease option in cz bump is not correctly incrementing the version #1367 — --devrelease cannot disambiguate dev releases from prereleases: commitizen/version_schemes.py:36 regex (?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))? collapses both into the same group. A user prototype against the PEP-440 regex exists but breaks tests.
• Configuring commitizen with uv - make "cz init" work with existing pyproject.toml #1361 — commitizen/commands/init.py:88-90 rejects existing pyproject.toml files that lack a [tool.commitizen] section instead of merging.
• ease the setup of prepare-commit-msg hook #1355 — no easy prepare-commit-msg setup: .pre-commit-hooks.yaml:1-29 exposes commit-msg and pre-push only. Ties to prepare-commit-msg pre-commit hook #1393 / Problem executing cz commit in prepare-commit-msg hook on Mac #1386.
• Filtering commits by path before version bump #1347 — no path filtering for monorepo bumps: commitizen/git.py:207 get_commits() has no path parameter; user has a working path_prefix prototype on a fork.

🔧 Has open PR

• Bug: test_invalid_command fails on Python 3.12 #1864 — tests/test_cli/test_invalid_command_py_3_12_invalidCommand_.txt baseline reflects 3.12.10+ argparse output; older 3.12.x patches (3.12.3-3.12.6) print quoted choices. PR test(cli): skip invalid-command snapshot on Python 3.12.0-3.12.6 #1982 (CI green, awaiting review) — added a precise pytest.mark.skipif for 3.12.0-3.12.6 (CPython gh-129019 backport).
• Make uv.lock optional bump #1383 — commitizen/providers/uv_provider.py:36 reads lock_file.read_text() unconditionally and crashes with FileNotFoundError on a fresh uv project that has never been synced. PR fix(providers/uv): treat uv.lock as optional #1979 (CI green, awaiting review) — guards set_lock_version() with is_file() from set_version(), matching the cargo/npm convention.
• Discussion: Clarify / standardize behavior for negative message_length_limit (should it require >= 0?) #1909 — commitizen/commands/commit.py:93 checks <= 0 rather than == 0, treating negative message_length_limit as "no limit" — PR feat: validate message_length_limit is non-negative #1916.
• Fix: message_length_limit config is ignored when CLI flag is unset (commit/check) #1899 — commitizen/commands/commit.py:88-89 falls back to None instead of the configured value when the CLI flag is unset — PR Fix and improve test: message_length_limit #1900.
• cz info does not read from info_path for non root directory #1897 — commitizen/cz/customize/customize.py:72 reads info_path relative to cwd rather than the config root — PR fix(customize): resolve info_path relative to root config #1898 (draft).
• BREAKING: Add --version back and deprecate cz version --commitizen which is the default for cz version #1785 — top-level cz --version / cz --report and deprecation of cz version --commitizen — PR feat(cli): add cz --version back and add cz --report to separate them from cz version #1798.
• Use ChainMap to rewrite the cmd options <- configuration file <- default configuration chain #1672 — ChainMap-based options/config/default chain — PR fix: try to use ChainMap to chain settings, fix message_length_limit inconsistency #1812 (draft).
• Add option for body line length #1597 — body line-length option for cz commit — PR Feature/ add a tag(--body-length-limit) for command commit #1849.
• Add support for PEP 751 lockfiles #1397 — PEP 751 pylock.toml support (new Pep751Provider extending Pep621Provider) — PR feat: add PEP 751 version provider with pylock.toml support #1896 (draft).
• Deprecate the cz_customize convention and allow for overriding functionality #1385 — overrideable [tool.commitizen.customize] for cz_conventional_commits — PR feat(conventional_commits): add ability to overide settings from tool… #1570.

🎁 Mislabeled — relabel and remove issue-status: needs-triage

• Consider excluding pure typing modules from coverage (question.py) #1904 — request to omit commitizen/question.py (pure typing module) from coverage; configuration/maintenance request, not a bug. Relabeled type: bug → type: feature, needs-triage → wait-for-implementation.

---

Round-3 summary (after claude-opus-4.7 re-validation): 0 likely fixed · 19 still valid (2 of which now have PRs from this round) · 10 have open PRs (8 pre-existing + 2 new) · 1 mislabeled (actioned).

Cumulative across #1964, #1965, #1976: 90 issues audited; 1 closed as fixed (#1249), 52 actionable bugs/features (5 of which now have PRs from this triage), 15 already have open PRs awaiting review, 7 mislabels (4 actioned), 5 by-design / config, 2 unclear.

Round-3 follow-up actions (May 2026)

PRs opened from this round, plus external review.

• Make uv.lock optional bump #1383 → PR fix(providers/uv): treat uv.lock as optional #1979 (fix(providers/uv): treat uv.lock as optional). CI green across the matrix. GitHub Copilot review flagged that Path.exists() is also true for directories and that the existing convention in cargo_provider.py:42 and npm_provider.py:53,62 is is_file(); fixup commit f204942e hoists the guard from set_lock_version() to set_version() and switches to is_file().
• Bug: test_invalid_command fails on Python 3.12 #1864 → PR test(cli): skip invalid-command snapshot on Python 3.12.0-3.12.6 #1982 (test(cli): skip invalid-command snapshot on Python 3.12.0-3.12.6). CI green. Internal sonnet-4.6 review verified the version-tuple comparison and confirmed Python 3.10/3.11 are in security-only maintenance so the argparse change won't be back-ported there; no fixup needed.
• Consider excluding pure typing modules from coverage (question.py) #1904 mislabeled type: bug → type: feature, needs-triage → wait-for-implementation (the issue is a coverage/config maintenance request, not a runtime bug).
• Introduce --next flag on cz version --project #1678 / Add new capabilities to cz version #1677 re-validated by claude-opus-4.7: both turn out to be partially fixed, not fully fixed. Per-issue comments now list which sub-features ship and which are still missing (USE_GIT_COMMITS half of --next, --hash, --prev, plus BREAKING: Add --version back and deprecate cz version --commitizen which is the default for cz version #1785 / PR feat(cli): add cz --version back and add cz --report to separate them from cz version #1798 for the --version deprecation).

Issues that were inspected but deliberately not PR'd in this round:

• Unstaged changes are lumped together with changelog + version updates for cz bump #1939 — cz bump always passes git commit -a. Adding an opt-out flag is straightforward but the right default (preserve historical -a, or stage only changelog/version files like Unstaged changes are lumped together with changelog + version updates for cz bump #1939 wants) is a UX call for the maintainers.
• Release after dev release results in error #1180-class bugs (The --devrelease option in cz bump is not correctly incrementing the version #1367 dev-release, Version tags with patch version zero ignored if floating tags exist #1863 floating-tag matching) — all involve SequenceMatcher / version-regex heuristics. Reasonable fixes exist (exact-match-first fallback, separate dev/prerelease groups in the regex), but each rewrites a hot path; deserve a maintainer call before a PR.
• Update cz template page #1709 / next step could be update it to pyproject.toml with maybe uv or poetry #1706 — doc PR migrating plugin packaging examples from setup.py to pyproject.toml + uv is mechanical but cross-cuts several pages; left for the next pass.

Happy to take individual items off this list — please comment with which # you're picking up.