pyselfupdate 0.4.0__tar.gz → 0.4.1__tar.gz

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: pyselfupdate
-Version: 0.4.0
+Version: 0.4.1
 Summary: Self-update and update notification for Python CLIs installed with uv tool
 Keywords: uv,cli,self-update,update-notifier,release
 Author: Chris Birch
@@ -234,7 +234,7 @@ atomically:
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
@@ -263,6 +263,6 @@ names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/README.md

@@ -210,7 +210,7 @@ atomically:
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
@@ -239,6 +239,6 @@ names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.4.0"
+version = "0.4.1"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 readme = "README.md"
 keywords = [
@@ -66,6 +66,9 @@ skips = [
 [tool.codespell]
 skip = "*.lock"
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 [tool.mypy]
 pretty = true
@@ -212,6 +215,18 @@ managed = [
     [
     "codespell",
     "check-filenames",
+],
+    [
+    "codespell",
+    "check-hidden",
+],
+    [
+    "codespell",
+    "builtin",
+],
+    [
+    "codespell",
+    "uri-ignore-words-list",
 ],
     [
     "pytest",

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.4.0"
+version = "0.4.1"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 authors = [{ name = "Chris Birch", email = "datapointchris@gmail.com" }]
 license = { text = "MIT" }
@@ -58,6 +58,9 @@ skips = ["B311", "B404", "B603"]
 [tool.codespell]
 skip = '*.lock'
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 
 [tool.mypy]
@@ -138,7 +141,7 @@ typeCheckingMode = "standard"
 analyzeUnannotatedFunctions = true  # or pylance stops analyzing in vscode
 
 [tool.forge]
-# Keys the standard owns, written by `forge repos apply pyproject`.
+# Keys the shared toolchain standard owns, written by its generator.
 # Dropping one from the template removes it here on the next sync; a key absent
 # from this list belongs to the project and is never touched. Do not hand-edit.
 managed = [
@@ -159,6 +162,9 @@ managed = [
     ["pyright", "typeCheckingMode"],
     ["pyright", "analyzeUnannotatedFunctions"],
     ["codespell", "check-filenames"],
+    ["codespell", "check-hidden"],
+    ["codespell", "builtin"],
+    ["codespell", "uri-ignore-words-list"],
     ["pytest", "ini_options", "verbosity_assertions"],
     ["pytest", "ini_options", "minversion"],
     ["pytest", "ini_options", "testpaths"],

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/errors.py

@@ -18,7 +18,7 @@ class LocalInstallError(SelfUpdateError):
     """The tool was installed from a local path or as an editable checkout.
 
     Reinstalling would discard a working copy for a release that may be older,
-    with no way to tell which is newer. This is the analogue of goselfupdate's
+    with no way to tell which is newer. This is the analog of goselfupdate's
     ErrDevBuild.
     """
 

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/github.py

@@ -6,6 +6,7 @@ this package is that adding it to a project adds nothing else.
 
 from __future__ import annotations
 
+import http.client
 import json
 import os
 import shlex
@@ -19,6 +20,7 @@ from dataclasses import dataclass
 from dataclasses import field
 from datetime import UTC
 from datetime import datetime
+from typing import IO
 
 from pyselfupdate.errors import NoReleaseError
 from pyselfupdate.errors import SelfUpdateError
@@ -29,6 +31,49 @@ API = 'https://api.github.com'
 DEFAULT_TIMEOUT = 10.0
 
 
+def _origin(url: str) -> tuple[str, str]:
+    """Scheme and authority, which is what decides whether a credential travels.
+
+    Port is part of it. Two ports on one host are two origins, and treating them
+    as one is how a redirect to a service sharing a hostname gets the token.
+    """
+    split = urllib.parse.urlsplit(url)
+    return split.scheme, split.netloc
+
+
+class _CredentialScopedRedirects(urllib.request.HTTPRedirectHandler):
+    """Drop `Authorization` when a redirect leaves the origin it was sent to.
+
+    `urllib.request` carries the header to the new host instead. Measured across
+    3.11, 3.13 and 3.14 with two local servers: a `Bearer` sent to the first
+    arrives intact at the second on every one of them. So this is the library's
+    to do, at every version it supports, rather than something a floor bump ends.
+
+    It matters here because `API` is a reassignable module attribute and
+    `headers` is caller-supplied, which is what makes a redirect off GitHub
+    something other than hypothetical.
+    """
+
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: IO[bytes],
+        code: int,
+        msg: str,
+        headers: http.client.HTTPMessage,
+        newurl: str,
+    ) -> urllib.request.Request | None:
+        redirected = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if redirected is None or _origin(req.full_url) == _origin(newurl):
+            return redirected
+        redirected.headers = {name: value for name, value in redirected.headers.items() if name.lower() != 'authorization'}
+        return redirected
+
+
+_OPENER = urllib.request.build_opener(_CredentialScopedRedirects)
+"""Built once. Passing a `HTTPRedirectHandler` subclass replaces the default one."""
+
+
 # B105 reads any name carrying "token" as a credential. Both hold the name of a
 # variable and the text of a command; neither ever holds a secret.
 TOKEN_COMMAND_ENV = 'GITHUB_TOKEN_COMMAND'  # nosec B105
@@ -215,7 +260,7 @@ class GitHubSource:
     def _get(self, path: str):
         url = f'{API}{path}'
 
-        # urlopen honours file:, ftp: and data: as readily as http:. API is a
+        # urlopen honors file:, ftp: and data: as readily as http:. API is a
         # constant here, but it is a module attribute a caller can reassign --
         # tests do exactly that -- so the scheme is checked rather than assumed.
         # Without this, setting it to a file: URL turns a release check into an
@@ -235,10 +280,7 @@ class GitHubSource:
             request.add_header(name, value)
 
         try:
-            # B310 is a call blacklist rather than a dataflow check, so it fires
-            # on urlopen regardless of the scheme guard above. That guard, and
-            # test_a_non_http_scheme_is_refused, are the actual defence.
-            with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310  # nosec B310
+            with _OPENER.open(request, timeout=self.timeout) as response:
                 return json.load(response)
         except urllib.error.HTTPError as error:
             raise _http_error(self.owner, self.repo, error, authenticated=bool(token)) from error

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/install.py

@@ -1,6 +1,6 @@
 """Reading and rewriting a uv tool installation.
 
-This is the part with no analogue in goselfupdate. A Go tool updates by
+This is the part with no analog in goselfupdate. A Go tool updates by
 replacing one file; a uv tool updates by rebuilding the virtual environment its
 own interpreter is running inside, which is why `update` must be the last thing
 a process does before it exits or re-execs.

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/state.py

@@ -5,7 +5,7 @@ any tool can read any other tool's state and a single dashboard can glob
 `~/.local/state/*/autoupdate-*.json` with no per-tool knowledge.
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 """

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/updater.py

@@ -23,7 +23,7 @@ from pyselfupdate.source import Release
 class Result:
     """What an update found, whether or not it installed anything."""
 
-    # The running version, canonicalised with a leading "v".
+    # The running version, canonicalized with a leading "v".
     current: str
 
     # The version now installed, or the one `update` would install after a
@@ -129,7 +129,7 @@ def changelog(config: Config, from_version: str, to_version: str) -> list[str]:
 
 
 def _current_version(config: Config) -> str:
-    """The running version, canonicalised, rejecting one that is not a release.
+    """The running version, canonicalized, rejecting one that is not a release.
 
     An install that tracks a git branch rather than a tag reports whatever
     version was in pyproject.toml when it was built, which says nothing about

{pyselfupdate-0.4.0 → pyselfupdate-0.4.1}/src/pyselfupdate/version.py

@@ -2,12 +2,12 @@
 
 Implemented here rather than taken from `packaging` so that this package has no
 third-party dependencies. `packaging` also implements PEP 440, whose precedence
-rules differ from semver's in ways that matter: it normalises `1.0.0-rc.1` to
+rules differ from semver's in ways that matter: it normalizes `1.0.0-rc.1` to
 `1.0.0rc1` and orders `1.0.0.post1` above `1.0.0`, neither of which describes a
 git tag.
 
 Precedence follows https://semver.org section 11, and is byte-for-byte the same
-behaviour as goselfupdate's semver.go so that the two libraries never disagree
+behavior as goselfupdate's semver.go so that the two libraries never disagree
 about which of two releases is newer.
 """