pyvbaanalysis 3.0.0__tar.gz → 3.0.1__tar.gz

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/fuzz.in

@@ -6,7 +6,7 @@
 #   uv pip compile fuzz.in --universal --generate-hashes --python-version 3.12 -o fuzz.txt
 # Dependabot proposes each new release.
 atheris==3.1.0
-pyopenvba==6.3.5
+pyopenvba==6.5.0
 defusedxml==0.7.1
 hatchling==1.32.4
 editables==0.6

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/fuzz.txt

@@ -29,9 +29,9 @@ pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
     # via hatchling
-pyopenvba==6.3.5 \
-    --hash=sha256:c098818b09ee9cc5e360c1712b40bbacae8ac0cc2fe3783329d283344b35aa6b \
-    --hash=sha256:c7c68ccc1c9452e9a46864f72e1b17eafe3935385f8f79f863df119c30cd358f
+pyopenvba==6.5.0 \
+    --hash=sha256:5151e147bf5723ea9dbe75a8670e19ef4e3295156b78a84fb01eab8dea16bb27 \
+    --hash=sha256:f83fbd2d5952bd05408bc4d123f0e0bf0b775f951cdce0913aecf306ba3fa7e5
     # via -r fuzz.in
 tomlkit==0.15.1 \
     --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/runtime.in

@@ -2,5 +2,5 @@
 # Security workflow's dependency audit. Dependabot moves the pin daily (the
 # owner's packages skip the cooldown), so the audit follows what PyPI serves.
 #   uv pip compile runtime.in --universal --generate-hashes --python-version 3.10 -o runtime.txt
-pyopenvba==6.3.5
+pyopenvba==6.5.0
 defusedxml==0.7.1

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/runtime.txt

@@ -4,7 +4,7 @@ defusedxml==0.7.1 \
     --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
     --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
     # via -r runtime.in
-pyopenvba==6.3.5 \
-    --hash=sha256:c098818b09ee9cc5e360c1712b40bbacae8ac0cc2fe3783329d283344b35aa6b \
-    --hash=sha256:c7c68ccc1c9452e9a46864f72e1b17eafe3935385f8f79f863df119c30cd358f
+pyopenvba==6.5.0 \
+    --hash=sha256:5151e147bf5723ea9dbe75a8670e19ef4e3295156b78a84fb01eab8dea16bb27 \
+    --hash=sha256:f83fbd2d5952bd05408bc4d123f0e0bf0b775f951cdce0913aecf306ba3fa7e5
     # via -r runtime.in

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/test.in

@@ -10,7 +10,14 @@
 pytest==9.1.1
 ruff==0.16.9
 mypy==2.3.1
-pyopenvba==6.3.5
+pyopenvba==6.5.0
 defusedxml==0.7.1
 hatchling==1.32.4
 editables==0.6
+# Keep cross-matrix dependencies explicit and unconditional: Dependabot's
+# pip-compile resolves on modern Linux and otherwise drops the Python 3.10
+# and Windows-only dependencies from this shared hash lock. Installing these
+# small compatibility packages on every test runner keeps future updates safe.
+colorama==0.4.6
+exceptiongroup==1.3.1
+tomli==2.4.1

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/requirements/test.txt

@@ -59,10 +59,12 @@ ast-serialize==0.11.2 \
     --hash=sha256:fd666cebd6ab3b3c0fd348a6202c26e18a401ee34293c3804d3472266bc146f6 \
     --hash=sha256:feb16d9c2a720e0120c58dd5d6e7b3c7c86b43249b60a3bc212bcb8fa031e2dd
     # via mypy
-colorama==0.4.6 ; sys_platform == 'win32' \
+colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
-    # via pytest
+    # via
+    #   -r test.in
+    #   pytest
 defusedxml==0.7.1 \
     --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \
     --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
@@ -71,10 +73,12 @@ editables==0.6 \
     --hash=sha256:1163834902381c4613787951c5914800fdf155ae08848a373b8ea5006780977c \
     --hash=sha256:d70e4698078a1d033e7786d9c64e5be070d058a67c21417024d38a58ac20aa43
     # via -r test.in
-exceptiongroup==1.3.1 ; python_full_version < '3.11' \
+exceptiongroup==1.3.1 \
     --hash=sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219 \
     --hash=sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598
-    # via pytest
+    # via
+    #   -r test.in
+    #   pytest
 hatchling==1.32.4 \
     --hash=sha256:08ecf7548fb48205e7f213d70c71e67b8271b7242093dc3f1da578b42c734a2c \
     --hash=sha256:c4468f73144c054d2aab4ef0f0378c43b9878bf07f8ffd6b79690e970d375f07
@@ -302,9 +306,9 @@ pygments==2.21.0 \
     --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
     --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
     # via pytest
-pyopenvba==6.3.5 \
-    --hash=sha256:c098818b09ee9cc5e360c1712b40bbacae8ac0cc2fe3783329d283344b35aa6b \
-    --hash=sha256:c7c68ccc1c9452e9a46864f72e1b17eafe3935385f8f79f863df119c30cd358f
+pyopenvba==6.5.0 \
+    --hash=sha256:5151e147bf5723ea9dbe75a8670e19ef4e3295156b78a84fb01eab8dea16bb27 \
+    --hash=sha256:f83fbd2d5952bd05408bc4d123f0e0bf0b775f951cdce0913aecf306ba3fa7e5
     # via -r test.in
 pytest==9.1.1 \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
@@ -330,7 +334,7 @@ ruff==0.16.9 \
     --hash=sha256:d29c934357e45642fda2f34c0b1f4025b4a6c01e15e4bf0016879d60078a142c \
     --hash=sha256:ed1a252039200f57a59eebc063b54beabea67bfbaaca0eeaa7f54b5fbcda2284
     # via -r test.in
-tomli==2.4.1 ; python_full_version < '3.11' \
+tomli==2.4.1 \
     --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
     --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
     --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
@@ -379,6 +383,7 @@ tomli==2.4.1 ; python_full_version < '3.11' \
     --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
     --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
     # via
+    #   -r test.in
     #   hatchling
     #   mypy
     #   pytest

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/security/yara.json

@@ -1,9 +1,9 @@
 {
   "yara_forge": {
-    "release": "20260920",
+    "release": "20261004",
     "asset": "yara-forge-rules-full.zip",
-    "url": "https://github.com/YARAHQ/yara-forge/releases/download/20260920/yara-forge-rules-full.zip",
-    "sha256": "24673112528aa93e13d5375312732cc2113bf4efdb8cd85f33aaeaebada35951"
+    "url": "https://github.com/YARAHQ/yara-forge/releases/download/20261004/yara-forge-rules-full.zip",
+    "sha256": "809fe0c2e6c58dd9dc74afad0cdae21a1ed3bd5e68e539504d211dbf4d872f8d"
   },
   "yara_x": {
     "release": "v1.20.0",

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/security/yara_update.py

@@ -37,8 +37,8 @@ Usage, from the two jobs of update-yara-rules.yml:
 nothing in DIR it cannot check: the proposal may change only the pin file,
 only in the fields a move allows, from the commit the workflow ran on. It
 commits through the GitHub API (no git credentials on disk), opens the pull
-request, and starts CI, Security and Malware scan on the branch, because a
-branch the workflow's own token creates starts no workflow by itself. It turns
+request with a GitHub App token, which triggers normal pull-request checks
+without manual workflow approval. It turns
 on auto-merge, so the pull request merges itself once those pass and stays
 open if any fails. It never reopens a pull request someone closed, and never
 overwrites a branch it did not just create.
@@ -62,7 +62,6 @@ SOURCES = {
     "yara_forge": {"repo": "YARAHQ/yara-forge", "name": "YARA Forge", "cooldown_days": 0},
     "yara_x": {"repo": "VirusTotal/yara-x", "name": "YARA-X", "cooldown_days": 7},
 }
-DISPATCH = ("ci.yml", "security.yml", "malware-scan.yml")
 SHA256 = re.compile(r"[0-9a-f]{64}")
 
 Api = Callable[..., Any]
@@ -178,8 +177,8 @@ def body(moved: list[str], new: dict[str, Any]) -> str:
               for k, p in new.items()]
     lines += ["",
               "CI, Security and Malware scan run on this branch. If a new rule matches a file, the "
-              "Malware scan fails until the match is fixed or accepted with a reason. Nothing here "
-              "was merged or approved automatically."]
+              "Malware scan fails until the match is fixed or accepted with a reason. Auto-merge "
+              "is enabled only subject to the repository's required checks and review rules."]
     return "\n".join(lines) + "\n"
 
 
@@ -242,18 +241,8 @@ def propose(root: Path, inp: Path, repository: str, base_sha: str, api: Api = gh
         pull = api(f"{base}/pulls", "POST", {
             "title": expected_title, "head": branch, "base": "main",
             "body": (inp / "body.md").read_text(encoding="utf-8")})
-    # Every scan is started even if one refuses, and any refusal then fails
-    # the run, so a pull request never sits unchecked without anyone knowing.
-    failed = []
-    for workflow in DISPATCH:
-        if (root / ".github" / "workflows" / workflow).exists():
-            try:
-                api(f"{base}/actions/workflows/{workflow}/dispatches", "POST", {"ref": branch})
-            except ApiError as exc:
-                failed.append(str(exc))
-    if failed:
-        raise ApiError(f"{pull['html_url']} is open, but these scans did not start:\n"
-                       + "\n".join(failed))
+    # The App-created PR triggers checks normally. Do not dispatch duplicate
+    # branch runs or restart the checks on a PR already awaiting review.
     # It merges itself once CI, Security and Malware scan pass; a failing scan
     # leaves it open. Without the "Allow auto-merge" setting it simply stays
     # open for review, which is not a failure of this run.

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/.github/workflows/update-yara-rules.yml

@@ -9,8 +9,9 @@ name: Update YARA rules
 # Two jobs, so the untrusted release metadata is only ever read without write
 # access: `prepare` works out the move with a read-only token, `propose` checks
 # the proposal against the pin file on main and commits it through the GitHub
-# API. No checkout keeps credentials. Needs the repository setting "Allow GitHub
-# Actions to create and approve pull requests".
+# API with a repository-scoped GitHub App token, so PR checks run without a
+# manual approval prompt. No checkout keeps credentials. See YARA_APP.md in
+# repo-standards for registration and secret provisioning.
 
 on:
   schedule:
@@ -62,9 +63,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
-      contents: write # the update branch and its commit, through the API
-      pull-requests: write # the pull request
-      actions: write # starting CI, Security and Malware scan on the branch
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -79,7 +78,16 @@ jobs:
           name: yara-proposal
           path: ${{ runner.temp }}/proposal
 
+      - name: Create a token for this repository
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.YARA_APP_CLIENT_ID }}
+          private-key: ${{ secrets.YARA_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Propose the update
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: python .github/security/yara_update.py propose --in "$RUNNER_TEMP/proposal"

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to pyVBAanalysis are recorded here. The format follows
 follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html): a minor version
 per milestone.
 
+## 3.0.1 - 2026-10-06
+
+Sync the analyzer and evidence data to XLIDE 11.1.0 (commit 8f64c2c).
+
+* Correct module-owned DefType defaults, indexed Property Let/Set contracts,
+  array setter values, enum storage types and bracketed source member names.
+* Check read-only Excel Range values and scalar host setter assignments.
+* Stop inferring runtime bounds from saved sheets, UserForm designer contents,
+  new Word documents or PowerPoint slide counts. Forget mutable state after
+  calls, aliases and error handlers that make a failure uncertain.
+* Add the upstream Scripting and VBScript RegExp reference models and preserve
+  the library that owns an Office or DAO enum.
+* Add the upstream `errors_only` analysis option and save differing replay
+  inputs so a failed differential can be rerun directly.
+
 ## 3.0.0 - 2026-10-04
 
 Sync to XLIDE 11.0.0 (commit 751fdb2). This major release includes the

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyvbaanalysis
-Version: 3.0.0
+Version: 3.0.1
 Summary: Pure-Python static analysis for Excel VBA
 Project-URL: Homepage, https://github.com/WilliamSmithEdward/pyVBAanalysis
 Project-URL: Repository, https://github.com/WilliamSmithEdward/pyVBAanalysis

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/pyvbaanalysis/__init__.py

@@ -42,7 +42,7 @@ from .reader import (
 )
 from .symbols import ModuleInput, ModuleSymbolKind, ProjectIndex, ProjectIndexOptions
 
-__version__ = "3.0.0"
+__version__ = "3.0.1"
 
 __all__ = [
     "AnalysisFailure",

{pyvbaanalysis-3.0.0 → pyvbaanalysis-3.0.1}/pyvbaanalysis/completion/member_access.py

@@ -62,6 +62,9 @@ from ..symbols.symbol_model import (
     VbaProjectClassMemberDefinition,
     VbaProjectClassMembers,
     VbaSymbolAttribute,
+    VbaProcedureParam,
+    VbaSymbol,
+    VbaSymbolKind,
     is_access_designer_class,
 )
 from ..types.type_names import is_known_scalar_type, normalize_type
@@ -92,6 +95,7 @@ class MemberCompletionContext:
     me_project_type: str | None = None
     # Source-declared workbook object members and visible UDT fields, keyed by type.
     project_class_members: Sequence[VbaProjectClassMembers] | None = None
+    project_symbols: Sequence[VbaSymbol] | None = None
     # True/default lets generic Object/Variant receivers narrow from preceding
     # simple Set assignments. Hard diagnostics disable this because VBA still
     # compile-binds those receivers late.
@@ -131,6 +135,8 @@ class MemberCompletionEntry:
     returns: str | None = None
     writable: bool | None = None
     write_type: str | None = None
+    write_is_array: bool | None = None
+    procedure_params: dict[str, list[VbaProcedureParam]] | None = None
     # The verified call signature, when the source or the host metadata has one.
     signature: str | None = None
     # The setters a project property declares (XLIDE issue #107); None for host
@@ -322,8 +328,8 @@ def _member_surface_at_dot(
         return None
     i = len(tokens) - 1
     typed_prefix = ""
-    if is_ident_like(tokens[i]) and i > 0 and tokens[i - 1].raw_text == ".":
-        typed_prefix = tokens[i].raw_text
+    if (is_ident_like(tokens[i]) or tokens[i].kind is TokenKind.BRACKETED_IDENTIFIER) and i > 0 and tokens[i - 1].raw_text == ".":
+        typed_prefix = tokens[i].raw_text[1:].removesuffix("]") if tokens[i].kind is TokenKind.BRACKETED_IDENTIFIER else tokens[i].raw_text
         i -= 1
     if i < 0 or tokens[i].raw_text != ".":
         return None
@@ -556,7 +562,7 @@ def resolve_receiver_type_at(
     if len(tokens) == 0:
         return None
     i = len(tokens) - 1
-    if is_ident_like(tokens[i]) and i > 0 and tokens[i - 1].raw_text == ".":
+    if (is_ident_like(tokens[i]) or tokens[i].kind is TokenKind.BRACKETED_IDENTIFIER) and i > 0 and tokens[i - 1].raw_text == ".":
         i -= 1
     if i < 0 or tokens[i].raw_text != ".":
         return None
@@ -1485,6 +1491,8 @@ def _project_member_entries(
             returns=m.returns,
             writable=m.writable,
             write_type=m.write_type,
+            write_is_array=m.write_is_array,
+            procedure_params=m.procedure_params,
             signature=m.signature,
             let_accessor=m.let_accessor,
             set_accessor=m.set_accessor,
@@ -1946,7 +1954,28 @@ def _find_declared_binding(
 
     bindings = _module_bindings(module)
     variable = bindings.variables.get(lower)
-    return variable if variable is not None else bindings.procedures.get(lower)
+    if variable is not None:
+        return variable
+    procedure = bindings.procedures.get(lower)
+    return procedure if procedure is not None else _exported_module_binding(ctx, lower)
+
+
+def _exported_module_binding(ctx: MemberCompletionContext, lower: str) -> _DeclaredBinding | None:
+    from ..symbols.name_resolution import _project_symbols_named
+    kinds = (VbaSymbolKind.FUNCTION, VbaSymbolKind.SUB, VbaSymbolKind.PROPERTY_GET, VbaSymbolKind.PROPERTY_LET, VbaSymbolKind.PROPERTY_SET, VbaSymbolKind.MODULE_VARIABLE, VbaSymbolKind.CONSTANT, VbaSymbolKind.ENUM_MEMBER)
+    symbols = [symbol for symbol in _project_symbols_named(ctx.project_symbols or (), lower) if symbol.kind in kinds]
+    if not symbols:
+        return None
+    if len({symbol.module_name.lower() for symbol in symbols}) > 1:
+        return _DeclaredBinding(as_type=None)
+    readable = next((symbol for symbol in symbols if symbol.kind in (VbaSymbolKind.FUNCTION, VbaSymbolKind.PROPERTY_GET, VbaSymbolKind.MODULE_VARIABLE, VbaSymbolKind.CONSTANT, VbaSymbolKind.ENUM_MEMBER)), None)
+    if readable is None:
+        return _DeclaredBinding(as_type=None)
+    if readable.as_type:
+        return _DeclaredBinding(as_type=readable.as_type)
+    surface = _project_class_members_by_name(ctx).get(readable.module_name.lower())
+    member = _project_member_by_name(surface, readable.name)
+    return _DeclaredBinding(as_type=member.returns if member else None)
 
 
 # Receiver lookups run once per dotted reference, and every member call a rule