codehound 1.4.1__tar.gz → 1.4.2__tar.gz

{codehound-1.4.1 → codehound-1.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codehound
-Version: 1.4.1
+Version: 1.4.2
 Summary: An AST-based static analyzer that hunts real correctness and async-safety bugs in Python code.
 Project-URL: Homepage, https://github.com/kratos0718/codehound
 Project-URL: Issues, https://github.com/kratos0718/codehound/issues
@@ -132,7 +132,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.4.1
+    rev: v1.4.2
     hooks:
       - id: codehound
 ```
@@ -225,6 +225,16 @@ have a regression test verified to fail pre-fix and pass post-fix.
 PRs: [optuna/optuna#6859](https://github.com/optuna/optuna/pull/6859),
 [run-llama/llama_index#23089](https://github.com/run-llama/llama_index/pull/23089).
 
+**A third CH011 shape needed a guard instead of a PR:** dspy's `Image` (a
+pydantic model) caches `format()` the same way, but `Image` is frozen
+(`model_config = ConfigDict(frozen=True)`), which makes it hashable and
+equal *by field value*, not identity. Checked directly rather than
+assumed: two separately constructed instances with equal fields hash
+equal, and the second one's call is served from the first's cache entry
+without ever being inserted itself — bounded, value-based memoization,
+not a leak. CH011 now recognizes a frozen `@dataclass` or a frozen
+pydantic model and skips it.
+
 **CH016 found and fixed its own false positive the day it shipped.** The
 first real-corpus scan of `unclosed-socket` turned up three hits in
 vllm's distributed process-group rendezvous code - all three sockets were

{codehound-1.4.1 → codehound-1.4.2}/README.md

@@ -112,7 +112,7 @@ Uploads findings to the repo's **Security → Code Scanning** tab via SARIF, in
 ```yaml
 repos:
   - repo: https://github.com/kratos0718/codehound
-    rev: v1.4.1
+    rev: v1.4.2
     hooks:
       - id: codehound
 ```
@@ -205,6 +205,16 @@ have a regression test verified to fail pre-fix and pass post-fix.
 PRs: [optuna/optuna#6859](https://github.com/optuna/optuna/pull/6859),
 [run-llama/llama_index#23089](https://github.com/run-llama/llama_index/pull/23089).
 
+**A third CH011 shape needed a guard instead of a PR:** dspy's `Image` (a
+pydantic model) caches `format()` the same way, but `Image` is frozen
+(`model_config = ConfigDict(frozen=True)`), which makes it hashable and
+equal *by field value*, not identity. Checked directly rather than
+assumed: two separately constructed instances with equal fields hash
+equal, and the second one's call is served from the first's cache entry
+without ever being inserted itself — bounded, value-based memoization,
+not a leak. CH011 now recognizes a frozen `@dataclass` or a frozen
+pydantic model and skips it.
+
 **CH016 found and fixed its own false positive the day it shipped.** The
 first real-corpus scan of `unclosed-socket` turned up three hits in
 vllm's distributed process-group rendezvous code - all three sockets were

{codehound-1.4.1 → codehound-1.4.2}/src/codehound/__init__.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 from codehound.checks import ALL_CHECKS, get_checks
 from codehound.core import Check, Finding, scan_file, scan_path
 
-__version__ = "1.4.1"
+__version__ = "1.4.2"
 
 __all__ = [
     "ALL_CHECKS",

{codehound-1.4.1 → codehound-1.4.2}/src/codehound/checks/lru_cache_on_method.py

@@ -12,6 +12,19 @@ instance alive), not a style nit.
 Only fires on a method - a plain module-level function decorated the same
 way is exactly what ``lru_cache`` is for, and caches correctly with no
 leak (nothing but the arguments themselves are held).
+
+Also doesn't fire on a *frozen* value class (a stdlib ``@dataclass(frozen=
+True)`` or a pydantic model with ``model_config = ConfigDict(frozen=True)``
+/ ``class Config: frozen = True``). A frozen class is hashable and equal by
+its field values, not by identity - verified directly: two separately
+constructed instances with the same field values hash equal, and a second,
+distinct instance's call is served straight from the first instance's
+cache entry without ever being inserted itself (dspy's `Image.format()`,
+checked this way, turned out to be exactly this - real, bounded-by-value
+memoization on an immutable type, not a leak). The cache still only ever
+holds as many distinct instances as there are distinct field-value
+combinations seen, capped at `maxsize`, which is the same bound an
+equivalent free function cached by value would have.
 """
 
 from __future__ import annotations
@@ -32,6 +45,62 @@ def _is_cache_decorator(node: ast.expr) -> bool:
     return False
 
 
+def _is_frozen_dataclass(decorators: list[ast.expr]) -> bool:
+    for d in decorators:
+        if not isinstance(d, ast.Call):
+            continue
+        target = d.func
+        name = target.id if isinstance(target, ast.Name) else getattr(target, "attr", None)
+        if name != "dataclass":
+            continue
+        for kw in d.keywords:
+            if kw.arg == "frozen" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+                return True
+    return False
+
+
+def _is_frozen_pydantic_model(cls: ast.ClassDef) -> bool:
+    for stmt in cls.body:
+        # model_config = ConfigDict(..., frozen=True, ...) or {"frozen": True}
+        if (
+            isinstance(stmt, ast.Assign)
+            and len(stmt.targets) == 1
+            and isinstance(stmt.targets[0], ast.Name)
+            and stmt.targets[0].id == "model_config"
+        ):
+            value = stmt.value
+            if isinstance(value, ast.Call):
+                for kw in value.keywords:
+                    if kw.arg == "frozen" and isinstance(kw.value, ast.Constant) and kw.value.value is True:
+                        return True
+            elif isinstance(value, ast.Dict):
+                for k, v in zip(value.keys, value.values):
+                    if (
+                        isinstance(k, ast.Constant)
+                        and k.value == "frozen"
+                        and isinstance(v, ast.Constant)
+                        and v.value is True
+                    ):
+                        return True
+        # Old-style pydantic v1: `class Config: frozen = True`
+        if isinstance(stmt, ast.ClassDef) and stmt.name == "Config":
+            for inner in stmt.body:
+                if (
+                    isinstance(inner, ast.Assign)
+                    and len(inner.targets) == 1
+                    and isinstance(inner.targets[0], ast.Name)
+                    and inner.targets[0].id == "frozen"
+                    and isinstance(inner.value, ast.Constant)
+                    and inner.value.value is True
+                ):
+                    return True
+    return False
+
+
+def _is_frozen_value_class(cls: ast.ClassDef) -> bool:
+    return _is_frozen_dataclass(cls.decorator_list) or _is_frozen_pydantic_model(cls)
+
+
 def _is_static_or_classmethod(decorators: list[ast.expr]) -> bool:
     for d in decorators:
         target = d.func if isinstance(d, ast.Call) else d
@@ -56,6 +125,8 @@ class LruCacheOnMethod(Check):
                 continue
             if _is_static_or_classmethod(node.decorator_list):
                 continue
+            if _is_frozen_value_class(parent):
+                continue
             if not node.args.args or node.args.args[0].arg not in ("self",):
                 continue
             for dec in node.decorator_list:

{codehound-1.4.1 → codehound-1.4.2}/tests/test_checks.py

@@ -517,6 +517,92 @@ def test_ch011_ignores_uncached_instance_method():
     assert _run(code, ["CH011"]) == []
 
 
+def test_ch011_ignores_frozen_dataclass():
+    # A frozen dataclass is hashable and equal by field value, not identity -
+    # verified empirically: two separately constructed instances with the
+    # same field values hash equal, and lru_cache serves the second one
+    # straight from the first's cache entry without ever storing it. Bounded
+    # by maxsize the same way an equivalent free function cached by value
+    # would be - not a leak.
+    code = (
+        "from dataclasses import dataclass\n"
+        "from functools import lru_cache\n"
+        "@dataclass(frozen=True)\n"
+        "class Point:\n"
+        "    x: int\n"
+        "    @lru_cache\n"
+        "    def scaled(self, factor):\n"
+        "        return self.x * factor\n"
+    )
+    assert _run(code, ["CH011"]) == []
+
+
+def test_ch011_ignores_frozen_pydantic_model():
+    # Real false positive found in dspy: Image (model_config =
+    # ConfigDict(frozen=True)) caches format() with @lru_cache(maxsize=32) -
+    # confirmed via a REPL check that this is value-based memoization, not a
+    # per-instance leak.
+    code = (
+        "import pydantic\n"
+        "from functools import lru_cache\n"
+        "class Image(pydantic.BaseModel):\n"
+        "    url: str\n"
+        "    model_config = pydantic.ConfigDict(frozen=True)\n"
+        "    @lru_cache(maxsize=32)\n"
+        "    def format(self):\n"
+        "        return self.url.upper()\n"
+    )
+    assert _run(code, ["CH011"]) == []
+
+
+def test_ch011_ignores_frozen_pydantic_model_v1_style_config():
+    code = (
+        "import pydantic\n"
+        "from functools import lru_cache\n"
+        "class Image(pydantic.BaseModel):\n"
+        "    url: str\n"
+        "    class Config:\n"
+        "        frozen = True\n"
+        "    @lru_cache\n"
+        "    def format(self):\n"
+        "        return self.url.upper()\n"
+    )
+    assert _run(code, ["CH011"]) == []
+
+
+def test_ch011_still_flags_mutable_dataclass():
+    # Guard against the frozen-class check over-suppressing: a plain (not
+    # frozen) dataclass is not hashable by value, so this must still flag.
+    code = (
+        "from dataclasses import dataclass\n"
+        "from functools import lru_cache\n"
+        "@dataclass\n"
+        "class Point:\n"
+        "    x: int\n"
+        "    @lru_cache\n"
+        "    def scaled(self, factor):\n"
+        "        return self.x * factor\n"
+    )
+    findings = _run(code, ["CH011"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH011"
+
+
+def test_ch011_still_flags_pydantic_model_without_frozen_config():
+    code = (
+        "import pydantic\n"
+        "from functools import lru_cache\n"
+        "class Image(pydantic.BaseModel):\n"
+        "    url: str\n"
+        "    @lru_cache\n"
+        "    def format(self):\n"
+        "        return self.url.upper()\n"
+    )
+    findings = _run(code, ["CH011"])
+    assert len(findings) == 1
+    assert findings[0].code == "CH011"
+
+
 # --- CH012 floating-process ----------------------------------------------------------