dirsql 0.4.11__tar.gz → 0.4.12__tar.gz

{dirsql-0.4.11 → dirsql-0.4.12}/Cargo.lock

@@ -500,7 +500,7 @@ dependencies = [
 
 [[package]]
 name = "dirsql-py-ext"
-version = "0.4.11"
+version = "0.4.12"
 dependencies = [
  "dirsql",
  "pyo3",

{dirsql-0.4.11 → dirsql-0.4.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.4.11
+Version: 0.4.12
 Requires-Dist: tomli>=2 ; python_full_version < '3.11'
 Summary: Ephemeral SQL index over a local directory
 Keywords: sql,filesystem,directory,sqlite,index

{dirsql-0.4.11 → dirsql-0.4.12}/packages/python/Cargo.toml

@@ -4,7 +4,7 @@ name = "dirsql-py-ext"
 # pypi/maturin handler can rewrite it via `write-version` before
 # `maturin build`. `pyproject.toml` declares `dynamic = ["version"]`
 # and maturin reads this field. Mirrors `packages/rust/Cargo.toml`.
-version = "0.4.11"
+version = "0.4.12"
 # abi3 note: the `abi3-py310` pyo3 feature (below) builds ONE stable-ABI
 # `cp310-abi3` wheel per platform that loads on every CPython >= 3.10
 # (matching `pyproject.toml`'s `requires-python = ">=3.10"`), instead of
@@ -25,6 +25,18 @@ crate-type = ["cdylib", "rlib"]
 dirsql.workspace = true
 pyo3 = { version = "0.28", features = ["extension-module", "generate-import-lib", "abi3-py310"], optional = true }
 
+# Opted in per-crate rather than via `[lints] workspace = true`: the workspace
+# block also carries `clippy::pedantic`, which currently reports 475 warnings
+# across the three crates and would fail `clippy -D warnings` immediately
+# (#763).
+#
+# `deny`, not the workspace's aspirational `forbid`: pyo3's proc macros emit `#[allow(unsafe_code)]`, which `forbid`
+# rejects outright (E0453).
+# `deny` still blocks new hand-written `unsafe` unless a site opts in
+# explicitly, which is the guarantee we want.
+[lints.rust]
+unsafe_code = "deny"
+
 [features]
 default = []
 extension-module = ["pyo3/extension-module"]

dirsql-0.4.12/packages/python/e2e-attestations/claude-763-forbid-unsafe.json

@@ -0,0 +1,7 @@
+{
+  "command": "uv run python -m pytest tests/e2e/ -x -q",
+  "ran_at": 1785791343,
+  "exit_code": 0,
+  "commit": "b1b8d2b6b2a200ba4d4aa844221dd7b8e85da92c",
+  "branch": "claude/763-forbid-unsafe"
+}

{dirsql-0.4.11 → dirsql-0.4.12}/packages/rust/Cargo.toml

@@ -74,6 +74,20 @@ toml = "0.8"
 wait-timeout = "0.2"
 walkdir = "2"
 
+# Opted in per-crate rather than via `[lints] workspace = true`: the workspace
+# block also carries `clippy::pedantic`, which currently reports 475 warnings
+# across the three crates and would fail `clippy -D warnings` immediately
+# (#763). This is the lint whose absence actually mattered -- it forbids
+# nothing until a crate opts in.
+[lints.rust]
+# `deny`, not `forbid`: rusqlite's API imposes five unavoidable `unsafe`
+# sites (the `load_extension` guard and four `unsafe impl VTab`/`VTabCursor`).
+# `forbid` cannot be overridden at all, so it would make the crate
+# uncompilable; `deny` blocks new `unsafe` unless a site opts in explicitly
+# with `#[expect(unsafe_code, reason = ...)]`, which is the guarantee we
+# actually want (#763).
+unsafe_code = "deny"
+
 [[bin]]
 name = "dirsql"
 path = "src/bin/dirsql.rs"

{dirsql-0.4.11 → dirsql-0.4.12}/packages/rust/src/db.rs

@@ -327,6 +327,10 @@ impl Db {
     /// call via [`rusqlite::LoadExtensionGuard`] and disabled again on return,
     /// so the SQL `load_extension()` function is never left exposed to later
     /// queries. A missing or unloadable file surfaces as [`DbError::Sqlite`].
+    #[expect(
+        unsafe_code,
+        reason = "rusqlite's load_extension API is unsafe by design"
+    )]
     pub fn load_extension(&self, path: &Path, entrypoint: Option<&str>) -> Result<()> {
         // SAFETY: loading an extension executes native code from `path`. The
         // path is operator-supplied configuration (a `[[dirsql.extension]]`

{dirsql-0.4.11 → dirsql-0.4.12}/packages/rust/src/parsed_vtab.rs

@@ -198,6 +198,7 @@ struct ParsedTab {
     rows: Vec<JsonRow>,
 }
 
+#[expect(unsafe_code, reason = "rusqlite requires VTab to be an unsafe trait")]
 unsafe impl<'vtab> VTab<'vtab> for ParsedTab {
     type Aux = ();
     type Cursor = ParsedTabCursor;
@@ -271,6 +272,10 @@ struct ParsedTabCursor {
     index: usize,
 }
 
+#[expect(
+    unsafe_code,
+    reason = "rusqlite requires VTabCursor to be an unsafe trait"
+)]
 unsafe impl VTabCursor for ParsedTabCursor {
     fn filter(
         &mut self,

{dirsql-0.4.11 → dirsql-0.4.12}/packages/rust/src/vtab.rs

@@ -197,6 +197,7 @@ struct PathTab {
     spec: Arc<ScanSpec>,
 }
 
+#[expect(unsafe_code, reason = "rusqlite requires VTab to be an unsafe trait")]
 unsafe impl<'vtab> VTab<'vtab> for PathTab {
     type Aux = ();
     type Cursor = PathTabCursor;
@@ -250,6 +251,10 @@ struct PathTabCursor {
     index: usize,
 }
 
+#[expect(
+    unsafe_code,
+    reason = "rusqlite requires VTabCursor to be an unsafe trait"
+)]
 unsafe impl VTabCursor for PathTabCursor {
     fn filter(
         &mut self,