coretrace-python-analyzer 0.24.0__tar.gz → 0.25.0__tar.gz

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.25.0 (2026-11-01)
+
+### Compatibility and migration
+
+- The filters a template's render reaches change, and with them the advisories reported
+  as `exploitable-vulnerability` through a filter, which may appear or disappear: a
+  render now follows a cycle of includes as far as Django may render it (#284), and
+  places a template's blocks where its chain of extends places them (#285).
+- Plugin API, additive: `coretrace_python.source.LineIndex` gives the line and column of
+  each offset of a text, lines counted as `lines_of` counts them (#288).
+
+### Templates
+
+- A cycle of includes no longer stops the collection of the filters a render reaches
+  (#284). A template reached again on the way contributes what it reaches, its names
+  mapped through each include, as Django renders it when the project's conditions let
+  the cycle turn: a template including itself with other bindings, a recursive tree, or
+  a parent including the child that extends it. A filter reached this way may be
+  reported as `exploitable-vulnerability` where it was not. Where no cycle is reached,
+  the filters and their order do not change.
+- A template's render is put together over its extends chain as Django places its
+  blocks (#285). A filter in a block no template of the chain places, or in a block
+  whose only placeholder a child replaces, is no longer reached, and an advisory naming
+  it is no longer `exploitable-vulnerability` through it. A block a child redefines with
+  `{{ block.super }}` inside a block it replaces now renders the parent's definition and
+  what it includes. Where the chain cannot be followed to a root, every block counts as
+  placed, as before.
+
+### Performance
+
+- Templates in a cycle of includes are no longer walked again on every path (#284): 20
+  levels of doubled includes closed into a cycle took 56 s, and 40 templates including
+  one another more than a minute; both now take less than a second.
+- The positions in a template are no longer counted from its start, for each filter,
+  include, extends and load (#288): a template of 2 MB applying 160,000 filters took
+  50 s to analyse, and now takes 3 s.
+
+### Documentation
+
+- `docs/usage.md` documents how a cycle of includes is followed (#284) and where the
+  chain of extends places a template's blocks (#285).
+
 ## 0.24.0 (2026-10-23)
 
 ### Compatibility and migration

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.24.0
+Version: 0.25.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/docs/usage.md

@@ -374,7 +374,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.24.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.25.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -438,7 +438,7 @@ bytes. A single-file check lists no components.
 
 ```json
 "tool": {
-  "name": "coretrace-python-analyzer", "version": "0.24.0",
+  "name": "coretrace-python-analyzer", "version": "0.25.0",
   "components": [
     {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"},
     {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"}
@@ -601,10 +601,18 @@ certain of it:
 - The filter's value is a context variable, directly or through `{% for %}` and
   `{% with %}`, the templates the template includes or extends by a constant name, the
   arguments of the filters before it, or the output of a `{% filter %}` block. A name a
-  tag binds shadows the context, and `{% include ... only %}` passes none of it.
-- The filter renders: a template extending another renders only its blocks, which
-  replace the blocks of that name in what it extends, unless the block renders
-  `{{ block.super }}`, which keeps the parent's content and the filters it applies.
+  tag binds shadows the context, and `{% include ... only %}` passes none of it. A cycle
+  of includes is followed as far as Django may render it: a template reached again on
+  the way applies its filters to what each include binds at every level, as a template
+  including itself with other bindings, or a recursive tree, does (#284).
+- The filter renders: a template extending another renders only its blocks, and only
+  where its chain of parents places them (#285). The root's blocks are placed; a placed
+  block renders its most derived definition, and through `{{ block.super }}` the next
+  ones up, which keep the parent's content and the filters it applies; the blocks a
+  rendered definition holds are placed in turn. A block no template of the chain
+  places never renders, nor does a block whose only placeholder a child replaces. When
+  the chain cannot be followed to a root (a parent named by an expression, not found or
+  in several files, or an extends cycle), every block of the chain counts as placed.
 - One file has the template's name; of two files of the same name, which one renders
   depends on the loaders.
 
@@ -815,7 +823,7 @@ project's behalf would go unseen. Without a lock file, a package is never
 `not_affected`. The document's `@id` derives from its statements, so two runs with the
 same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
 cannot know it. Its `tooling` names the analyzer and each component with its digest
-(`coretrace-python-analyzer 0.24.0; curated-advisories 2026.09.25 (sha256:…)`), so the
+(`coretrace-python-analyzer 0.25.0; curated-advisories 2026.09.25 (sha256:…)`), so the
 `@id` changes with the advisory data a statement was decided with.
 
 ## Large projects

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.24.0"
+version = "0.25.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.24.0"
+__version__ = "0.25.0"
 

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/src/coretrace_python/source/__init__.py

@@ -1,6 +1,12 @@
 """Source storage and location primitives."""
 
-from coretrace_python.source.manager import LINE_BREAK, SourceManager, decode_text, lines_of
+from coretrace_python.source.manager import (
+    LINE_BREAK,
+    LineIndex,
+    SourceManager,
+    decode_text,
+    lines_of,
+)
 from coretrace_python.source.model import (
     FileLocation,
     ImportName,
@@ -14,6 +20,7 @@ __all__ = [
     "LINE_BREAK",
     "FileLocation",
     "ImportName",
+    "LineIndex",
     "Location",
     "SourceFile",
     "SourceId",

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/src/coretrace_python/source/manager.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import re
+from bisect import bisect_right
 from pathlib import Path
 
 from coretrace_python.source.model import ImportName, SourceFile, SourceId
@@ -86,6 +87,26 @@ def lines_of(text: str) -> list[str]:
     return lines
 
 
+class LineIndex:
+    """The line and column of each offset of a text, lines counted as ``lines_of``
+    counts them. The start of each line is found once; the line of an offset is then
+    found by bisection, in time logarithmic in the lines."""
+
+    def __init__(self, text: str) -> None:
+        self._starts = [0, *(match.end() for match in LINE_BREAK.finditer(text))]
+
+    def position(self, offset: int) -> tuple[int, int]:
+        """The one-based line and column of ``offset``."""
+
+        line = bisect_right(self._starts, offset)
+        return line, offset - self._starts[line - 1] + 1
+
+    def offset(self, line: int, column: int) -> int:
+        """The offset of the one-based ``line`` and ``column``."""
+
+        return self._starts[line - 1] + column - 1
+
+
 class SourceManager:
     """Own source text and return one canonical object for each source ID."""
 

{coretrace_python_analyzer-0.24.0 → coretrace_python_analyzer-0.25.0}/src/coretrace_python/source/positions.py

@@ -16,9 +16,8 @@ import hashlib
 import json
 import re
 import tomllib
-from bisect import bisect_right
 
-from coretrace_python.source.manager import LINE_BREAK, lines_of
+from coretrace_python.source.manager import LineIndex, lines_of
 from coretrace_python.source.model import FileLocation, SourceId
 
 Pointer = tuple[str | int, ...]
@@ -54,22 +53,6 @@ def pointer_text(path: Pointer) -> str:
     return "".join("/" + str(part).replace("~", "~0").replace("/", "~1") for part in path)
 
 
-class _Lines:
-    def __init__(self, text: str) -> None:
-        self._starts = [0, *(match.end() for match in LINE_BREAK.finditer(text))]
-
-    def position(self, offset: int) -> tuple[int, int]:
-        """The one-based line and column of ``offset``."""
-
-        line = bisect_right(self._starts, offset)
-        return line, offset - self._starts[line - 1] + 1
-
-    def offset(self, line: int, column: int) -> int:
-        """The offset of the one-based ``line`` and ``column``."""
-
-        return self._starts[line - 1] + column - 1
-
-
 def _same(found: object, value: object) -> bool:
     return type(found) is type(value) and found == value
 
@@ -87,7 +70,7 @@ class JsonPositions:
                 raise ValueError("trailing text")
         except (ValueError, IndexError, RecursionError):
             self._values = {}
-        self._lines = _Lines(text)
+        self._lines = LineIndex(text)
 
     def locate(self, path: Pointer, value: object) -> tuple[int, int] | None:
         """The line and column ``value`` starts at under ``path``, or None when the text
@@ -183,7 +166,7 @@ class TomlPositions:
         self._lines = lines_of(text)
         # The text with one line feed per line break, where arrays are read, once each.
         self._text = "\n".join(self._lines)
-        self._offsets = _Lines(self._text)
+        self._offsets = LineIndex(self._text)
         self._arrays: dict[int, list[tuple[int, int]]] = {}
         state = _LexState()
         for number, line in enumerate(self._lines, start=1):