@neralabs/rerail-pack-python 0.1.2 → 0.1.4

package/rules/bandit-b318-xml-bad-minidom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b318-xml-bad-minidom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect unsafe xml.dom.minidom parsing calls",
+  "description": "Use defusedxml instead of xml.dom.minidom to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b319-xml-bad-pulldom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b319-xml-bad-pulldom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect unsafe xml.dom.pulldom parsing calls",
+  "description": "Use defusedxml instead of xml.dom.pulldom to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b321-ftplib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b321-ftplib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect insecure ftplib.FTP construction",
+  "description": "Avoid opening ftplib.FTP connections; FTP sends credentials and data unencrypted, so use SFTP, SCP, or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B321",
         "anchor": "witness.span",
-        "message": "FTP is unencrypted and insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "message": "Replace this FTP connection with SFTP, SCP, or another encrypted protocol; FTP sends credentials in clear text.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b323-unverified-context.json

@@ -3,7 +3,7 @@
   "id": "bandit-b323-unverified-context",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect creation of unverified SSL contexts",
+  "description": "Don't create SSL contexts with ssl._create_unverified_context(); it turns off certificate and hostname verification and allows man-in-the-middle attacks.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B323",
         "anchor": "witness.span",
-        "message": "Creating an unverified SSL context disables certificate validation and hostname checks.",
+        "message": "Use ssl.create_default_context() instead, which verifies certificates and hostnames.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b401-import-telnetlib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b401-import-telnetlib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure telnetlib module.",
+  "description": "Remove imports of telnetlib; Telnet sends credentials and data unencrypted, so use SSH or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B401",
         "anchor": "witness.span",
-        "message": "A telnet-related module is being imported. Telnet is insecure; use SSH or another encrypted protocol.",
+        "message": "Remove this telnetlib import and use SSH or another encrypted protocol instead.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b402-import-ftplib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b402-import-ftplib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure ftplib module.",
+  "description": "Remove imports of ftplib; FTP sends credentials and data unencrypted, so use SFTP, SCP, or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B402",
         "anchor": "witness.span",
-        "message": "An FTP-related module is being imported. FTP is insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "message": "Remove this ftplib import and use SFTP, SCP, or another encrypted protocol instead.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b405-import-xml-etree.json

@@ -3,7 +3,7 @@
   "id": "bandit-b405-import-xml-etree",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.etree.cElementTree and xml.etree.ElementTree.",
+  "description": "Avoid importing xml.etree.ElementTree or cElementTree; use defusedxml instead, since the standard parsers are open to XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b407-import-xml-expat.json

@@ -3,7 +3,7 @@
   "id": "bandit-b407-import-xml-expat",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.expatbuilder.",
+  "description": "Avoid importing xml.dom.expatbuilder to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b408-import-xml-minidom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b408-import-xml-minidom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.minidom.",
+  "description": "Avoid importing xml.dom.minidom to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b409-import-xml-pulldom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b409-import-xml-pulldom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.pulldom.",
+  "description": "Avoid importing xml.dom.pulldom to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b411-import-xmlrpclib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b411-import-xmlrpclib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xmlrpc.",
+  "description": "Avoid importing xmlrpc unprotected; its XML parsing is open to XML attacks unless patched with defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b413-import-pycrypto.json

@@ -3,7 +3,7 @@
   "id": "bandit-b413-import-pycrypto",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of deprecated pyCrypto namespaces.",
+  "description": "Avoid importing the pyCrypto package; it is unmaintained and has known vulnerabilities, so use the cryptography package instead.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b415-import-pyghmi.json

@@ -3,7 +3,7 @@
   "id": "bandit-b415-import-pyghmi",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure pyghmi package.",
+  "description": "Avoid importing pyghmi; IPMI is an insecure protocol, so prefer an encrypted management protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B415",
         "anchor": "witness.span",
-        "message": "An IPMI-related module is being imported. IPMI is insecure; use an encrypted protocol.",
+        "message": "Replace this pyghmi import with a client for an encrypted management protocol such as Redfish over HTTPS; IPMI is insecure.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b502-ssl-with-bad-version.json

@@ -3,7 +3,7 @@
   "id": "bandit-b502-ssl-with-bad-version",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect calls whose method or ssl_version argument selects an insecure SSL/TLS protocol.",
+  "description": "Don't select SSLv2, SSLv3, TLS 1.0 or TLS 1.1 when configuring ssl or pyOpenSSL connections; these protocol versions are broken.",
   "scope": {
     "include": [
       "**/*.py"
@@ -76,7 +76,7 @@
       "violation": {
         "code": "B502",
         "anchor": "witness.span",
-        "message": "An SSL context is configured with an insecure protocol version.",
+        "message": "Select TLS 1.2 or newer here (e.g. ssl.PROTOCOL_TLS_CLIENT) instead of this SSLv2, SSLv3, TLS 1.0 or TLS 1.1 protocol.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b505-weak-cryptographic-key.json

@@ -3,7 +3,7 @@
   "id": "bandit-b505-weak-cryptographic-key",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Bandit 1.9.4's B505 weak_cryptographic_key: a DSA or RSA key below 2048 bits or an EC curve below 224 bits, by keyword or position (Bandit's medium thresholds). Port of the kernel test b505_weak_key_sizes_by_keyword_or_position. Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it.",
+  "description": "Use RSA and DSA keys of at least 2048 bits and elliptic curves of at least 224 bits; smaller keys can be broken.",
   "scope": {
     "include": [
       "**/*"
@@ -152,7 +152,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B505",
-        "message": "Bandit B505 (weak-cryptographic-key)",
+        "message": "Generate this key with at least 2048 bits for RSA or DSA, or a curve of at least 224 bits for EC; smaller keys can be broken.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b507-ssh-no-host-key-verification.json

@@ -3,7 +3,7 @@
   "id": "bandit-b507-ssh-no-host-key-verification",
   "revision": 4,
   "mode": "steer",
-  "description": "Once an import whose name contains paramiko has been walked (Bandit's substring test, in Bandit's source-order walk), flag a call whose function name is set_missing_host_key_policy (the attribute name, a bare name, or a name aliased by an earlier import to one ending in set_missing_host_key_policy) and whose first positional argument is a name, attribute, or call naming AutoAddPolicy or WarningPolicy.",
+  "description": "Don't let Paramiko auto-accept unknown SSH host keys with AutoAddPolicy or WarningPolicy; it opens the door to man-in-the-middle attacks.",
   "scope": {
     "include": [
       "**/*.py"
@@ -196,7 +196,7 @@
       "violation": {
         "code": "B507",
         "anchor": "witness.span",
-        "message": "Paramiko call with policy set to automatically trust the unknown host key.",
+        "message": "Set paramiko.RejectPolicy and load known host keys instead of auto-accepting unknown ones; that invites man-in-the-middle attacks.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b606-start-process-with-no-shell.json

@@ -3,7 +3,7 @@
   "id": "bandit-b606-start-process-with-no-shell",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect configured process APIs that execute without a command shell",
+  "description": "Validate input passed to the os exec, spawn and startfile functions; they start whatever program and arguments they receive.",
   "scope": {
     "include": [
       "**/*.py"
@@ -49,7 +49,7 @@
       "violation": {
         "code": "B606",
         "anchor": "witness.span",
-        "message": "Review input passed to a no-shell process API",
+        "message": "Validate any untrusted input passed to this os exec, spawn or startfile call; it starts whatever program and arguments it receives.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b615-huggingface-unsafe-download.json

@@ -3,7 +3,7 @@
   "id": "bandit-b615-huggingface-unsafe-download",
   "revision": 5,
   "mode": "steer",
-  "description": "Require a transformers, datasets, or huggingface_hub-like import; resolve the supported download/load APIs; allow nonliteral revisions, hexadecimal revisions of at least seven characters, or local-path first arguments, and flag all other unpinned downloads.",
+  "description": "Pin Hugging Face model and dataset downloads to a specific commit revision; an unpinned download can silently pull changed or tampered files.",
   "scope": {
     "include": [
       "**/*.py"
@@ -1138,7 +1138,7 @@
       "violation": {
         "code": "B615",
         "anchor": "witness.span",
-        "message": "Unsafe Hugging Face Hub download without revision pinning in ${API}()",
+        "message": "Pin ${API}() to a specific commit hash with revision=; an unpinned download can silently pull changed or tampered files.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/ruff-async100-cancel-scope-no-checkpoint.json

@@ -3,7 +3,7 @@
  "id": "ruff-async100-cancel-scope-no-checkpoint",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC100 (cancel-scope-no-checkpoint): a `with` statement whose last timeout-context item (`asyncio.timeout[_at]`, `anyio.move_on_after`/`fail_after`/`CancelScope`, `trio.move_on_after`/`move_on_at`/`fail_after`/`fail_at`/`CancelScope` calls) is the last item when the statement is `async with`, and whose body has no `yield` (nested scopes included) and no `await`, `async with`, `async for` or async comprehension outside nested functions and classes. Reported on the whole statement. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Add an await inside asyncio, anyio or trio timeout and cancel-scope blocks; without a checkpoint the timeout can never fire.",
  "scope": {
   "include": [
    "**/*"
@@ -343,7 +343,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC100",
-    "message": "A `with $CALLEE(...):` context does not contain any `await` statements. This makes it pointless, as the timeout can only be triggered by a checkpoint.",
+    "message": "Add an await inside this `with $CALLEE(...):` block; without a checkpoint the timeout can never fire.",
     "suppress": {
       "noqa": {
         "codes": [

package/rules/ruff-async105-trio-sync-call.json

@@ -3,7 +3,7 @@
  "id": "ruff-async105-trio-sync-call",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC105 (trio-sync-call): a call to one of trio's async functions (Ruff's MethodName::is_async list) that is not the operand of an `await` (parentheses ignored), in any context. Reported on the call. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Await calls to trio's async functions such as trio.sleep; without await the call only creates a coroutine that never runs.",
  "scope": {
   "include": [
    "**/*"

package/rules/ruff-async115-async-zero-sleep.json

@@ -3,7 +3,7 @@
  "id": "ruff-async115-async-zero-sleep",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC115 (async-zero-sleep): a call to `trio.sleep` or `anyio.sleep` with exactly one argument, an int literal whose value is zero (any radix; parentheses allowed) as `seconds=` (trio), `delay=` (anyio) or the first positional argument, in any context, reported on the call. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Use lowlevel.checkpoint() instead of sleep(0) in trio and anyio code; it states the intent of yielding to the scheduler.",
  "scope": {
   "include": [
    "**/*"

package/rules/ruff-async116-long-sleep-not-forever.json

@@ -3,7 +3,7 @@
  "id": "ruff-async116-long-sleep-not-forever",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC116 (long-sleep-not-forever): a call to `trio.sleep` or `anyio.sleep` with exactly one argument, an int or float literal (any spelling; not complex, not signed; parentheses allowed) whose value is greater than 86400 as `seconds=` (trio), `delay=` (anyio) or the first positional argument, in any context, reported on the call. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Use sleep_forever() instead of trio or anyio sleep calls longer than 24 hours; a sleep that long is almost always meant to never end.",
  "scope": {
   "include": [
    "**/*"

package/rules/ruff-async210-blocking-http-call-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async210-blocking-http-call-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC210 (blocking-http-call-in-async-function): a call to `urllib.request.urlopen`, `urllib3.request` or an `httpx`/`requests` module-level HTTP method inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't make blocking HTTP calls with requests, httpx, urllib or urllib3 inside async functions; they stall the event loop.",
  "scope": {
   "include": [
    "**/*"
@@ -147,7 +147,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC210",
-    "message": "Async functions should not call blocking HTTP methods",
+    "message": "Replace this blocking HTTP call with an awaited async client call, such as `httpx.AsyncClient` or `aiohttp`.",
     "suppress": {
       "noqa": {
         "codes": [

package/rules/ruff-async221-run-process-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async221-run-process-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC221 (run-process-in-async-function): a call to `os.system`, `os.posix_spawn[p]`, `subprocess.run`/`call`/`check_call`/`check_output`/`getoutput`/`getstatusoutput`, or an `os.spawn*` function whose mode (Ruff's find_argument_value(\"mode\", 0): `arguments` in syntactic mode) is absent or `os.P_WAIT` (directly, or through a name whose value, read as find_assigned_value's lookup_symbol does (`resolves.binding` with `stopAtGlobal`), is `os.P_WAIT`) inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't run processes with subprocess.run, os.system or other blocking process calls inside async functions; they block the event loop until the process exits.",
  "scope": {
   "include": [
    "**/*"

package/rules/ruff-async222-wait-for-process-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async222-wait-for-process-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC222 (wait-for-process-in-async-function): a call to `os.wait`, `os.wait3`, `os.wait4`, `os.waitid` or `os.waitpid` inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't call os.wait, os.waitpid or the other blocking os.wait functions inside async functions; they block the event loop.",
  "scope": {
   "include": [
    "**/*"
@@ -130,7 +130,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC222",
-    "message": "Async functions should not wait on processes with blocking methods",
+    "message": "Replace this blocking `os.wait` call by awaiting the async process object, such as `await proc.wait()`.",
     "suppress": {
       "noqa": {
         "codes": [

package/rules/ruff-async230-blocking-open-call-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async230-blocking-open-call-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC230 (blocking-open-call-in-async-function): a call to the builtin `open` (`builtins.open`, `io.open`, `io.open_code`), or `.open()` on a `pathlib.Path(...)` call or on a name whose binding holds one (Ruff's find_binding_value through `resolves.binding`: a plain name assignment, annotated assignment or walrus value, an unpacked name's element of a tuple or list display, or a `with` item's context expression; and, as Ruff's match_value, an unpacked name paired with a display element by index where the engine gives no value: a set display, unequal arities, a position after a starred value), inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't open files with open(), io.open or Path.open() inside async functions; use an async file API so file I/O doesn't block the event loop.",
  "scope": {
   "include": [
    "**/*"
@@ -325,7 +325,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC230",
-    "message": "Async functions should not open files with blocking methods like `open`",
+    "message": "Open this file with an async file API, such as `anyio.open_file()`, `trio.open_file()` or `aiofiles.open()`.",
     "suppress": {
       "noqa": {
         "codes": [

package/rules/ruff-async250-blocking-input-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async250-blocking-input-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC250 (blocking-input-in-async-function): a call to the builtin `input` (the unshadowed name, or `builtins.input`) inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't call input() inside async functions; it blocks the event loop while waiting for the user.",
  "scope": {
   "include": [
    "**/*"
@@ -129,7 +129,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC250",
-    "message": "Blocking call to `input()` in async context",
+    "message": "Read input in a worker thread, such as `await asyncio.to_thread(input)`, instead of calling `input()` directly.",
     "suppress": {
       "noqa": {
         "codes": [

package/rules/ruff-async251-blocking-sleep-in-async-function.json

@@ -3,7 +3,7 @@
  "id": "ruff-async251-blocking-sleep-in-async-function",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC251 (blocking-sleep-in-async-function): a call to `time.sleep` inside an `async def` body whose function is the nearest enclosing function, lambda body or class, reported on the callee. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Don't call time.sleep() inside async functions; await the async library's sleep so other tasks keep running.",
  "scope": {
   "include": [
    "**/*"

package/rules/ruff-b002-unary-prefix-increment-decrement.json

@@ -3,7 +3,7 @@
   "id": "ruff-b002-unary-prefix-increment-decrement",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B002 (unary-prefix-increment-decrement): a unary `+` whose operand is a unary `+`, or a unary `-` whose operand is a unary `-` (parentheses around the operand are transparent, as in Ruff's AST). Reported on the outer unary expression.",
+  "description": "Don't write a doubled plus or minus prefix to increment or decrement a value; Python has no such operators, so the value is left unchanged.",
   "scope": { "include": ["**/*"], "exclude": [] },
   "clauses": [
     {
@@ -26,7 +26,7 @@
           }
         }
       },
-      "violation": { "anchor": "witness.span", "code": "B002", "message": "Python does not support the unary prefix increment operator (`++`)", "suppress": { "noqa": { "codes": ["B002"] } } }
+      "violation": { "anchor": "witness.span", "code": "B002", "message": "Replace this `++` prefix with `+= 1`; Python reads `++x` as `x`, so nothing is incremented.", "suppress": { "noqa": { "codes": ["B002"] } } }
     },
     {
       "id": "unary-prefix-decrement",
@@ -48,7 +48,7 @@
           }
         }
       },
-      "violation": { "anchor": "witness.span", "code": "B002", "message": "Python does not support the unary prefix decrement operator (`--`)", "suppress": { "noqa": { "codes": ["B002"] } } }
+      "violation": { "anchor": "witness.span", "code": "B002", "message": "Replace this `--` prefix with `-= 1`; Python reads `--x` as `x`, so nothing is decremented.", "suppress": { "noqa": { "codes": ["B002"] } } }
     }
   ]
 }

package/rules/ruff-b003-assignment-to-os-environ.json

@@ -3,7 +3,7 @@
   "id": "ruff-b003-assignment-to-os-environ",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B003 (assignment-to-os-environ): a plain assignment statement with exactly one target, that target being the attribute `os.environ` (the name `os`, not resolved; parentheses around the target are transparent). Chained assignments (several targets), annotated and augmented assignments are not checked, as in Ruff. Reported on the attribute.",
+  "description": "Don't assign a new value to os.environ; it doesn't change the real process environment, so update or clear the existing mapping instead.",
   "scope": { "include": ["**/*"], "exclude": [] },
   "clauses": [
     {
@@ -48,7 +48,7 @@
           }
         }
       },
-      "violation": { "anchor": "witness.span", "code": "B003", "message": "Assigning to `os.environ` doesn't clear the environment", "suppress": { "noqa": { "codes": ["B003"] } } }
+      "violation": { "anchor": "witness.span", "code": "B003", "message": "Update `os.environ` in place with `.clear()` and `.update()` instead of assigning a new mapping to it.", "suppress": { "noqa": { "codes": ["B003"] } } }
     }
   ]
 }

package/rules/ruff-b004-unreliable-callable-check.json

@@ -3,7 +3,7 @@
   "id": "ruff-b004-unreliable-callable-check",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B004 (unreliable-callable-check): `hasattr(x, \"__call__\")` with exactly two positional arguments, or `getattr(x, \"__call__\")` / `getattr(x, \"__call__\", default)` with two or three, no keyword arguments, the second argument a str literal (not bytes, an f- or t-string; parentheses transparent) whose value is `__call__` (escapes decoded, implicit concatenations joined). The callee (parentheses transparent) resolves to the builtin `hasattr`/`getattr` (Ruff's `resolve_builtin_symbol`, via `resolves`): the unshadowed name, or that attribute of the `builtins` module through the file's imports. Reported on the call.",
+  "description": "Use callable() instead of checking hasattr() or getattr() for __call__; the attribute check gives wrong answers for some objects.",
   "scope": {
     "include": [
       "**/*"

package/rules/ruff-b005-strip-with-multi-characters.json

@@ -3,7 +3,7 @@
   "id": "ruff-b005-strip-with-multi-characters",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B005 (strip-with-multi-characters): `.strip`/`.lstrip`/`.rstrip` called with exactly one positional argument that is a str literal (not bytes, an f- or t-string; escapes decoded, implicit concatenations joined) whose value repeats a character, tested with a backreference (`(.).*\\1`). Reported on the call.",
+  "description": "Avoid strip, lstrip or rstrip with a multi-character string that repeats a character; the argument is a set of characters, not a substring to remove.",
   "scope": {
     "include": [
       "**/*"
@@ -117,7 +117,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B005",
-        "message": "Using `.strip()` with multi-character strings is misleading",
+        "message": "List each character once in this strip argument, or use `removeprefix()`/`removesuffix()` to remove a substring.",
         "suppress": {
           "noqa": {
             "codes": [

package/rules/ruff-b007-unused-loop-control-variable.json

@@ -3,7 +3,7 @@
   "id": "ruff-b007-unused-loop-control-variable",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B007 (unused-loop-control-variable) with the default `dummy-variable-rgx`: a name bound by a `for` loop's target (itself, or inside tuple/list/starred targets) that does not match `^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$` and never occurs as a name expression in the loop body (the `else` clause does not count; attribute members, keyword-argument names, def/class names, parameters, import and global/nonlocal names and except-handler names are not name expressions). The message says `may not be used` when the body calls `locals`/`globals`/`vars`/`exec`/`eval` (by spelling; Ruff checks they are builtins). Match-statement capture, keyword-pattern, star and `as` names are not name expressions either. Reported on the target name.",
+  "description": "Rename for-loop variables the loop body never uses to start with an underscore; it shows the value is deliberately ignored.",
   "scope": {
     "include": [
       "**/*"

package/rules/ruff-b009-get-attr-with-constant.json

@@ -3,7 +3,7 @@
   "id": "ruff-b009-get-attr-with-constant",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B009 (getattr-with-constant): `getattr(obj, \"name\")` with exactly two positional arguments and no keyword arguments, `obj` not starred, the second a str literal (not bytes, an f- or t-string; escapes decoded, implicit concatenations joined) whose value is a Python identifier (Unicode XID, not a keyword) and not a mangled private name (`__x` without a trailing `__`). The callee (parentheses transparent) resolves to the builtin `getattr` (Ruff's `match_builtin_expr`): the unshadowed name, or `getattr` of the `builtins` module through the file's imports. Reported on the call.",
+  "description": "Use plain attribute access instead of getattr() with a constant attribute name; it is no safer and harder to read.",
   "scope": {
     "include": [
       "**/*"

package/rules/ruff-b010-set-attr-with-constant.json

@@ -3,7 +3,7 @@
   "id": "ruff-b010-set-attr-with-constant",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B010 (set-attr-with-constant): `setattr(obj, \"name\", value)` used as an expression statement, with exactly three positional arguments and no keyword arguments, `obj` not starred, the name a str literal (not bytes, an f- or t-string; escapes decoded, implicit concatenations joined) whose value is a Python identifier (Unicode XID, not a keyword), not `__debug__` and not a mangled private name. The callee (parentheses transparent) resolves to the builtin `setattr` (Ruff's `match_builtin_expr`): the unshadowed name, or `setattr` of the `builtins` module through the file's imports. Reported on the call.",
+  "description": "Use plain attribute assignment instead of setattr() with a constant attribute name; it is no safer and harder to read.",
   "scope": {
     "include": [
       "**/*"
@@ -205,7 +205,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B010",
-        "message": "Do not call `setattr` with a constant attribute value. It is not any safer than normal property access.",
+        "message": "Replace this `setattr` call with a plain assignment, such as `obj.name = value`.",
         "suppress": {
           "noqa": {
             "codes": [

package/rules/ruff-b011-assert-false.json

@@ -3,7 +3,7 @@
   "id": "ruff-b011-assert-false",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B011 (assert-false): an `assert` statement whose test is the literal `False` (Ruff's `is_const_false`; parentheses transparent), reported on the literal. Ported from the Ruff conformance suite (rerail/conformance/ruff/rules/B011.json at 3f102adcb), with Ruff's `# noqa` honoured as the Ruff CLI honours it.",
+  "description": "Raise AssertionError instead of assert False; assertions are stripped when Python runs with optimizations enabled.",
   "scope": {
     "include": [
       "**/*"

package/rules/ruff-b013-redundant-tuple-in-exception-handler.json

@@ -3,7 +3,7 @@
   "id": "ruff-b013-redundant-tuple-in-exception-handler",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B013 (redundant-tuple-in-exception-handler): the type of an `except` (or `except*`) handler is a parenthesized tuple with exactly one element that is not starred. Parentheses around the tuple are transparent, and an `as` name does not matter. Reported on the tuple.",
+  "description": "Remove the one-element tuple around a single exception type in an except clause; the parentheses and comma are redundant.",
   "scope": {
     "include": [
       "**/*"

package/rules/ruff-b014-duplicate-handler-exception.json

@@ -3,7 +3,7 @@
   "id": "ruff-b014-duplicate-handler-exception",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Ruff's B014 (duplicate-handler-exception): the type of an `except` (or `except*`) handler is a tuple in which the same dotted name (a name or an attribute chain of names, Ruff's `UnqualifiedName`) occurs more than once (parentheses around an element are transparent). Reported once on the tuple, whatever the number of duplicates.",
+  "description": "Remove duplicate exception types from an except clause's tuple; naming one twice adds nothing.",
   "scope": {
     "include": [
       "**/*"