pyselfupdate 0.4.0__tar.gz → 0.5.0__tar.gz

pyselfupdate-0.5.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Birch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/PKG-INFO

@@ -1,15 +1,15 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: pyselfupdate
-Version: 0.4.0
+Version: 0.5.0
 Summary: Self-update and update notification for Python CLIs installed with uv tool
 Keywords: uv,cli,self-update,update-notifier,release
 Author: Chris Birch
 Author-email: Chris Birch <datapointchris@gmail.com>
-License: MIT
+License-Expression: MIT
+License-File: LICENSE
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: System :: Software Distribution
@@ -56,9 +56,9 @@ version exists, so it silently drifts. The usual fix drags an HTTP client, a
 TOML parser and a version library into a tool that had none of them.
 
 This package has zero runtime dependencies — `urllib` for the network,
-`tomllib` for uv's receipt, and its own semver implementation — and CI enforces
-that by importing every module into a virtual environment containing nothing
-else.
+`tomllib` for uv's receipt and lock, and its own semver implementation — and
+CI enforces that by importing every module into a virtual environment
+containing nothing else.
 
 ## notify
 
@@ -128,7 +128,8 @@ environment the running interpreter lives in**. Unlike replacing a Unix binary
 from under a live process, so anything imported afterwards may fail in ways
 that are hard to read. Make it the last thing your process does, then call
 `exit_now` — or use `update_and_reexec` to replace the process with the new
-version immediately.
+version immediately. Its caller never sees the `Result`, so it writes
+`lock_warning` to stderr itself before the re-exec.
 
 That cuts both ways: anything you want to *print* after the install has to be
 fetched before it. `run_update` resolves its changelog first for exactly this
@@ -139,11 +140,34 @@ pieces `update` is made of rather than working around it:
 installation = require_updatable(config)  # refuses a checkout, costs nothing
 result = check(config)  # network, environment still intact
 notes = changelog(config, result.current, result.latest)
-install_release(config, result, installation)
+installed = install_release(config, result, installation)
 print(notes)
+if installed.lock_warning:
+    print(installed.lock_warning, file=sys.stderr)
 exit_now()
 ```
 
+### A git install is held to the release's `uv.lock`
+
+`uv tool install` never reads a lock. Handed a git requirement, it resolves
+every dependency to the newest version, so a tool would run on a set its CI
+never tested. `update` therefore clones the release's tag, exports its
+`uv.lock`, and passes registry pins as `--constraints` and git pins as
+`--overrides`. uv records both in the tool's receipt, so a later
+`uv tool upgrade` stays held to them.
+
+| The tag | What `update` does |
+| --- | --- |
+| Carries a `uv.lock` | Installs the locked versions |
+| Carries none | Installs unlocked and sets `lock_missing`. `lock_warning` names the tag, and `run_update` and `update_and_reexec` print it |
+| Will not clone, or uv will not export its lock | Raises `LockUnreadableError` and installs nothing |
+
+An install from an index reads no lock, because a wheel carries none.
+
+An update reinstalls the tool's own extras, as in `mytool[fast]`, with their
+dependencies held to the lock. Every `--with` and `--with-editable`
+requirement is passed back to uv as well.
+
 ## What will not be updated
 
 Read from uv's own receipt, written at install time, rather than guessed at
@@ -155,6 +179,7 @@ runtime:
 | `name = "mytool"` (from an index) | Updatable |
 | `git = "...git"` with no `rev` | Refused — tracks a branch, so its version says nothing about how far behind it is |
 | `directory` / `path` / `editable` | Refused — reinstalling would discard a working copy |
+| A `--with` requirement no requirements-file line reproduces, such as a relative path | Refused with `NotInstalledError` — the update would drop it |
 
 A tool that cannot be identified at all is treated as local and left alone.
 
@@ -206,8 +231,8 @@ It never raises. A command that is not installed, exits non-zero, or takes
 longer than ten seconds degrades to an unauthenticated request, which still
 works against a public repository.
 
-`token_func` is now only for a credential neither the environment nor a command
-can produce. It is called lazily, for the same reason the command is: the notify
+`token_func` is for a credential neither the environment nor a command can
+produce. It is called lazily, for the same reason the command is: the notify
 gate resolves a `Config` on every invocation and declines most of them without
 reaching the network, and a subprocess in front of that gate is the entire cost
 worth avoiding.
@@ -234,7 +259,7 @@ atomically:
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
@@ -263,6 +288,6 @@ names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/README.md

@@ -32,9 +32,9 @@ version exists, so it silently drifts. The usual fix drags an HTTP client, a
 TOML parser and a version library into a tool that had none of them.
 
 This package has zero runtime dependencies — `urllib` for the network,
-`tomllib` for uv's receipt, and its own semver implementation — and CI enforces
-that by importing every module into a virtual environment containing nothing
-else.
+`tomllib` for uv's receipt and lock, and its own semver implementation — and
+CI enforces that by importing every module into a virtual environment
+containing nothing else.
 
 ## notify
 
@@ -104,7 +104,8 @@ environment the running interpreter lives in**. Unlike replacing a Unix binary
 from under a live process, so anything imported afterwards may fail in ways
 that are hard to read. Make it the last thing your process does, then call
 `exit_now` — or use `update_and_reexec` to replace the process with the new
-version immediately.
+version immediately. Its caller never sees the `Result`, so it writes
+`lock_warning` to stderr itself before the re-exec.
 
 That cuts both ways: anything you want to *print* after the install has to be
 fetched before it. `run_update` resolves its changelog first for exactly this
@@ -115,11 +116,34 @@ pieces `update` is made of rather than working around it:
 installation = require_updatable(config)  # refuses a checkout, costs nothing
 result = check(config)  # network, environment still intact
 notes = changelog(config, result.current, result.latest)
-install_release(config, result, installation)
+installed = install_release(config, result, installation)
 print(notes)
+if installed.lock_warning:
+    print(installed.lock_warning, file=sys.stderr)
 exit_now()
 ```
 
+### A git install is held to the release's `uv.lock`
+
+`uv tool install` never reads a lock. Handed a git requirement, it resolves
+every dependency to the newest version, so a tool would run on a set its CI
+never tested. `update` therefore clones the release's tag, exports its
+`uv.lock`, and passes registry pins as `--constraints` and git pins as
+`--overrides`. uv records both in the tool's receipt, so a later
+`uv tool upgrade` stays held to them.
+
+| The tag | What `update` does |
+| --- | --- |
+| Carries a `uv.lock` | Installs the locked versions |
+| Carries none | Installs unlocked and sets `lock_missing`. `lock_warning` names the tag, and `run_update` and `update_and_reexec` print it |
+| Will not clone, or uv will not export its lock | Raises `LockUnreadableError` and installs nothing |
+
+An install from an index reads no lock, because a wheel carries none.
+
+An update reinstalls the tool's own extras, as in `mytool[fast]`, with their
+dependencies held to the lock. Every `--with` and `--with-editable`
+requirement is passed back to uv as well.
+
 ## What will not be updated
 
 Read from uv's own receipt, written at install time, rather than guessed at
@@ -131,6 +155,7 @@ runtime:
 | `name = "mytool"` (from an index) | Updatable |
 | `git = "...git"` with no `rev` | Refused — tracks a branch, so its version says nothing about how far behind it is |
 | `directory` / `path` / `editable` | Refused — reinstalling would discard a working copy |
+| A `--with` requirement no requirements-file line reproduces, such as a relative path | Refused with `NotInstalledError` — the update would drop it |
 
 A tool that cannot be identified at all is treated as local and left alone.
 
@@ -182,8 +207,8 @@ It never raises. A command that is not installed, exits non-zero, or takes
 longer than ten seconds degrades to an unauthenticated request, which still
 works against a public repository.
 
-`token_func` is now only for a credential neither the environment nor a command
-can produce. It is called lazily, for the same reason the command is: the notify
+`token_func` is for a credential neither the environment nor a command can
+produce. It is called lazily, for the same reason the command is: the notify
 gate resolves a `Config` on every invocation and declines most of them without
 reaching the network, and a subprocess in front of that gate is the entire cost
 worth avoiding.
@@ -210,7 +235,7 @@ atomically:
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
@@ -239,6 +264,6 @@ names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/pyproject.toml

@@ -1,7 +1,9 @@
 [project]
 name = "pyselfupdate"
-version = "0.4.0"
+version = "0.5.0"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
+license = "MIT"
+license-files = ["LICENSE"]
 readme = "README.md"
 keywords = [
     "uv",
@@ -14,7 +16,6 @@ classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
     "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3 :: Only",
     "Topic :: Software Development :: Libraries",
     "Topic :: System :: Software Distribution",
@@ -27,9 +28,6 @@ dependencies = []
 name = "Chris Birch"
 email = "datapointchris@gmail.com"
 
-[project.license]
-text = "MIT"
-
 [project.optional-dependencies]
 typer = ["typer>=0.12.0"]
 
@@ -44,7 +42,7 @@ dev = [
     "mypy>=1.10.0",
     "pre-commit>=4.3.0",
     "pytest>=8.0.0",
-    "ruff>=0.7.0",
+    "ruff==0.12.5",
     "typer>=0.12.0",
 ]
 
@@ -66,6 +64,9 @@ skips = [
 [tool.codespell]
 skip = "*.lock"
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 [tool.mypy]
 pretty = true
@@ -109,6 +110,7 @@ select = [
     "B",
     "SIM",
     "I",
+    "ICN",
 ]
 ignore = ["SIM108"]
 
@@ -118,9 +120,21 @@ force-single-line = true
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401"]
 
+[tool.ruff.lint.flake8-import-conventions]
+banned-from = [
+    "datetime",
+    "pyspark.sql.functions",
+    "pyspark.sql.types",
+]
+
+[tool.ruff.lint.flake8-import-conventions.extend-aliases]
+datetime = "dt"
+sqlalchemy = "sa"
+"pyspark.sql.functions" = "sf"
+"pyspark.sql.types" = "st"
+
 [tool.semantic_release]
 version_toml = ["pyproject.toml:project.version"]
-branch = "main"
 commit_message = "build(release): {version}"
 build_command = """
     pip install uv
@@ -178,6 +192,40 @@ managed = [
     "lint",
     "isort",
     "force-single-line",
+],
+    [
+    "ruff",
+    "lint",
+    "flake8-import-conventions",
+    "banned-from",
+],
+    [
+    "ruff",
+    "lint",
+    "flake8-import-conventions",
+    "extend-aliases",
+    "datetime",
+],
+    [
+    "ruff",
+    "lint",
+    "flake8-import-conventions",
+    "extend-aliases",
+    "sqlalchemy",
+],
+    [
+    "ruff",
+    "lint",
+    "flake8-import-conventions",
+    "extend-aliases",
+    "pyspark.sql.functions",
+],
+    [
+    "ruff",
+    "lint",
+    "flake8-import-conventions",
+    "extend-aliases",
+    "pyspark.sql.types",
 ],
     [
     "ruff",
@@ -212,6 +260,18 @@ managed = [
     [
     "codespell",
     "check-filenames",
+],
+    [
+    "codespell",
+    "check-hidden",
+],
+    [
+    "codespell",
+    "builtin",
+],
+    [
+    "codespell",
+    "uri-ignore-words-list",
 ],
     [
     "pytest",
@@ -229,11 +289,12 @@ managed = [
     "testpaths",
 ],
 ]
+pinned = ["ruff"]
 
 [tool.uv.build-backend]
 module-name = "pyselfupdate"
 module-root = "src"
 
 [build-system]
-requires = ["uv_build>=0.11.32,<0.12.0"]
+requires = ["uv_build>=0.12.2,<0.13.0"]
 build-backend = "uv_build"

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/pyproject.toml.orig

@@ -1,16 +1,16 @@
 [project]
 name = "pyselfupdate"
-version = "0.4.0"
+version = "0.5.0"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 authors = [{ name = "Chris Birch", email = "datapointchris@gmail.com" }]
-license = { text = "MIT" }
+license = "MIT"
+license-files = ["LICENSE"]
 readme = "README.md"
 keywords = ["uv", "cli", "self-update", "update-notifier", "release"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
     "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3 :: Only",
     "Topic :: Software Development :: Libraries",
     "Topic :: System :: Software Distribution",
@@ -42,7 +42,7 @@ dev = [
     "mypy>=1.10.0",
     "pre-commit>=4.3.0",
     "pytest>=8.0.0",
-    "ruff>=0.7.0",
+    "ruff==0.12.5",
     "typer>=0.12.0",
 ]
 
@@ -58,6 +58,9 @@ skips = ["B311", "B404", "B603"]
 [tool.codespell]
 skip = '*.lock'
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 
 [tool.mypy]
@@ -108,6 +111,7 @@ select = [
     "B",    # flake8-bugbear
     "SIM",  # flake8-simplify
     "I",    # isort
+    "ICN",  # flake8-import-conventions
 ]
 ignore = [
     "SIM108",  # ternary operator — often less readable
@@ -119,9 +123,17 @@ force-single-line = true
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401"]
 
+[tool.ruff.lint.flake8-import-conventions]
+banned-from = ["datetime", "pyspark.sql.functions", "pyspark.sql.types"]
+
+[tool.ruff.lint.flake8-import-conventions.extend-aliases]
+datetime = "dt"
+sqlalchemy = "sa"
+"pyspark.sql.functions" = "sf"
+"pyspark.sql.types" = "st"
+
 [tool.semantic_release]
 version_toml = ["pyproject.toml:project.version"]
-branch = "main"
 commit_message = "build(release): {version}"
 build_command = """
     pip install uv
@@ -138,7 +150,7 @@ typeCheckingMode = "standard"
 analyzeUnannotatedFunctions = true  # or pylance stops analyzing in vscode
 
 [tool.forge]
-# Keys the standard owns, written by `forge repos apply pyproject`.
+# Keys the shared toolchain standard owns, written by its generator.
 # Dropping one from the template removes it here on the next sync; a key absent
 # from this list belongs to the project and is never touched. Do not hand-edit.
 managed = [
@@ -151,6 +163,11 @@ managed = [
     ["ruff", "lint", "select"],
     ["ruff", "lint", "ignore"],
     ["ruff", "lint", "isort", "force-single-line"],
+    ["ruff", "lint", "flake8-import-conventions", "banned-from"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "datetime"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "sqlalchemy"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "pyspark.sql.functions"],
+    ["ruff", "lint", "flake8-import-conventions", "extend-aliases", "pyspark.sql.types"],
     ["ruff", "lint", "per-file-ignores", "__init__.py"],
     ["mypy", "pretty"],
     ["mypy", "ignore_missing_imports"],
@@ -159,13 +176,19 @@ managed = [
     ["pyright", "typeCheckingMode"],
     ["pyright", "analyzeUnannotatedFunctions"],
     ["codespell", "check-filenames"],
+    ["codespell", "check-hidden"],
+    ["codespell", "builtin"],
+    ["codespell", "uri-ignore-words-list"],
     ["pytest", "ini_options", "verbosity_assertions"],
     ["pytest", "ini_options", "minversion"],
     ["pytest", "ini_options", "testpaths"],
 ]
+# Dependencies held at the version the pre-commit hook runs, in every group
+# and extra that names them, so a local run and CI cannot disagree.
+pinned = ["ruff"]
 
 [build-system]
-requires = ["uv_build>=0.11.32,<0.12.0"]
+requires = ["uv_build>=0.12.2,<0.13.0"]
 build-backend = "uv_build"
 
 [tool.uv.build-backend]

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/src/pyselfupdate/__init__.py

@@ -21,6 +21,7 @@ from pyselfupdate.config import Config
 from pyselfupdate.errors import InstallFailedError
 from pyselfupdate.errors import InvalidConfigError
 from pyselfupdate.errors import LocalInstallError
+from pyselfupdate.errors import LockUnreadableError
 from pyselfupdate.errors import NoReleaseError
 from pyselfupdate.errors import NotInstalledError
 from pyselfupdate.errors import SelfUpdateError
@@ -54,6 +55,7 @@ __all__ = [
     'Installation',
     'InvalidConfigError',
     'LocalInstallError',
+    'LockUnreadableError',
     'NoReleaseError',
     'NotInstalledError',
     'Outcome',

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/src/pyselfupdate/errors.py

@@ -18,13 +18,17 @@ class LocalInstallError(SelfUpdateError):
     """The tool was installed from a local path or as an editable checkout.
 
     Reinstalling would discard a working copy for a release that may be older,
-    with no way to tell which is newer. This is the analogue of goselfupdate's
+    with no way to tell which is newer. This is the analog of goselfupdate's
     ErrDevBuild.
     """
 
 
 class NotInstalledError(SelfUpdateError):
-    """The tool is not installed as a uv tool, so there is nothing to update."""
+    """uv's receipt is missing, unreadable, or names no requirement for the tool.
+
+    `update` raises it too when the receipt lists a `--with` requirement that no
+    requirements-file line reproduces, because reinstalling would drop it.
+    """
 
 
 class NoReleaseError(SelfUpdateError):
@@ -37,3 +41,12 @@ class SourceError(SelfUpdateError):
 
 class InstallFailedError(SelfUpdateError):
     """The install command ran and failed."""
+
+
+class LockUnreadableError(SelfUpdateError):
+    """The release's `uv.lock` could not be read, so nothing was installed.
+
+    Raised when git or uv is not on PATH, the tag will not clone, or `uv export`
+    refuses the lock. A tag with no `uv.lock` at all is not this error: it
+    installs unlocked and sets `Result.lock_missing`.
+    """

{pyselfupdate-0.4.0 → pyselfupdate-0.5.0}/src/pyselfupdate/github.py

@@ -1,11 +1,19 @@
 """GitHub as a release source.
 
-Uses `urllib.request` rather than httpx or requests, because the whole point of
-this package is that adding it to a project adds nothing else.
+Uses `urllib.request` rather than httpx2. The package makes one JSON request and
+downloads nothing, and tools with no HTTP client of their own take it for
+self-update, so a client library would land in their dependency tree for this
+one call. `_CredentialScopedRedirects` covers the redirect hazard a client would.
+
+It moves to httpx2 when this package needs a second request shape — a client
+object, streaming, an asset download — or when every consumer already declares
+httpx2.
 """
 
 from __future__ import annotations
 
+import datetime as dt
+import http.client
 import json
 import os
 import shlex
@@ -17,8 +25,7 @@ import urllib.request
 from collections.abc import Callable
 from dataclasses import dataclass
 from dataclasses import field
-from datetime import UTC
-from datetime import datetime
+from typing import IO
 
 from pyselfupdate.errors import NoReleaseError
 from pyselfupdate.errors import SelfUpdateError
@@ -29,6 +36,49 @@ API = 'https://api.github.com'
 DEFAULT_TIMEOUT = 10.0
 
 
+def _origin(url: str) -> tuple[str, str]:
+    """Scheme and authority, which is what decides whether a credential travels.
+
+    Port is part of it. Two ports on one host are two origins, and treating them
+    as one is how a redirect to a service sharing a hostname gets the token.
+    """
+    split = urllib.parse.urlsplit(url)
+    return split.scheme, split.netloc
+
+
+class _CredentialScopedRedirects(urllib.request.HTTPRedirectHandler):
+    """Drop `Authorization` when a redirect leaves the origin it was sent to.
+
+    `urllib.request` carries the header to the new host instead. Measured across
+    3.11, 3.13 and 3.14 with two local servers: a `Bearer` sent to the first
+    arrives intact at the second on every one of them. So this is the library's
+    to do, at every version it supports, rather than something a floor bump ends.
+
+    It matters here because `API` is a reassignable module attribute and
+    `headers` is caller-supplied, which is what makes a redirect off GitHub
+    something other than hypothetical.
+    """
+
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: IO[bytes],
+        code: int,
+        msg: str,
+        headers: http.client.HTTPMessage,
+        newurl: str,
+    ) -> urllib.request.Request | None:
+        redirected = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if redirected is None or _origin(req.full_url) == _origin(newurl):
+            return redirected
+        redirected.headers = {name: value for name, value in redirected.headers.items() if name.lower() != 'authorization'}
+        return redirected
+
+
+_OPENER = urllib.request.build_opener(_CredentialScopedRedirects)
+"""Built once. Passing a `HTTPRedirectHandler` subclass replaces the default one."""
+
+
 # B105 reads any name carrying "token" as a credential. Both hold the name of a
 # variable and the text of a command; neither ever holds a secret.
 TOKEN_COMMAND_ENV = 'GITHUB_TOKEN_COMMAND'  # nosec B105
@@ -123,8 +173,8 @@ class GitHubSource:
     # notify gate declines to check at all. That gate is otherwise free, and a
     # spawn in front of it is the entire cost.
     #
-    # Reaching for `gh` no longer needs one: that is the default below. This is
-    # for a credential neither the environment nor a command can produce.
+    # `gh` needs no `token_func`, because it is the default below. This is for a
+    # credential neither the environment nor a command can produce.
     token_func: Callable[[], str] | None = None
 
     timeout: float = DEFAULT_TIMEOUT
@@ -215,7 +265,7 @@ class GitHubSource:
     def _get(self, path: str):
         url = f'{API}{path}'
 
-        # urlopen honours file:, ftp: and data: as readily as http:. API is a
+        # urlopen honors file:, ftp: and data: as readily as http:. API is a
         # constant here, but it is a module attribute a caller can reassign --
         # tests do exactly that -- so the scheme is checked rather than assumed.
         # Without this, setting it to a file: URL turns a release check into an
@@ -235,10 +285,7 @@ class GitHubSource:
             request.add_header(name, value)
 
         try:
-            # B310 is a call blacklist rather than a dataflow check, so it fires
-            # on urlopen regardless of the scheme guard above. That guard, and
-            # test_a_non_http_scheme_is_refused, are the actual defence.
-            with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310  # nosec B310
+            with _OPENER.open(request, timeout=self.timeout) as response:
                 return json.load(response)
         except urllib.error.HTTPError as error:
             raise _http_error(self.owner, self.repo, error, authenticated=bool(token)) from error
@@ -301,7 +348,7 @@ def _reset_clock(error: urllib.error.HTTPError) -> str:
     """
     header = error.headers.get('x-ratelimit-reset') if error.headers else None
     try:
-        moment = datetime.fromtimestamp(int(header or ''), tz=UTC)
+        moment = dt.datetime.fromtimestamp(int(header or ''), tz=dt.UTC)
     except (TypeError, ValueError, OSError, OverflowError):
         return ''
     return f'; resets at {moment:%H:%M} UTC'